Technology

59466 readers

3247 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

920

Let's Encrypt is 10 years old today ! (letsencrypt.org)

submitted 1 day ago by pcouy@lemmy.pierre-couy.fr to c/technology@lemmy.world

78 comments fedilink hide all child comments

Happy birthday to Let's Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

you are viewing a single comment's thread
view the rest of the comments

[–] Redjard@lemmy.dbzer0.com 1 points 1 day ago (1 children)

They don't offer wildcard certs, but otherwise I think they are.
I wanna say acme.sh defaults to them.

[–] Laser@feddit.org 1 points 1 day ago (1 children)

Never used them, but they state at https://zerossl.com/features/acme/ that their free acme certs include wildcards.

[–] Redjard@lemmy.dbzer0.com 1 points 17 hours ago* (last edited 17 hours ago) (1 children)

Yes, seems you are right. Not sure where I got the impression.

Unrelated, when I researched this I saw that acme.sh, zerossl, and a bunch of other acme clients are owned by the same entity, "Stack Holdings"/"apilayer.com". According to this, zerossl also has some limitations over letsencrypt in account requirements and limits on free certificates.

By using ZeroSSL's ACME feature, you will be able to generate an unlimited amount of 90-day SSL certificates at no charge, also supporting multi-domain certificates and wildcards. Each certificate you create will be stored in your ZeroSSL account.

It is suspicious that they impose so many restrictions then waive most on the acme api, where they presumably could not compete otherwise. On their gui they allow only 3 certificates and don't allow multi-domain at all. Then even in the acme client they somehow push an account into the process.

[...] for using our ACME service you have to create and use EAB (External Account Binding) credentials within your ZeroSSL dashboard.

EAB credentials are limited to a maximum per user/per day. [This might be for creating them, not uses per credential, unsure how to interpret this.]

This all does make me slightly worry this block around apilayer.com will fall before letsencrypt does.

Other than letsencrypt and zerossl, this page also lists no other full equivalents for what letsencrypt does.

[–] Laser@feddit.org 1 points 17 hours ago

I think if LetsEncrypt went away, so would ZeroSSL's free offer.

However, I do think not having limitations on the API is good; automation is good practice and I guess this is a concession to customers /users who have no automation in place (though this is a sad state by now). LE doesn't offer anything comparable AFAIK.