Technology

60112 readers

1966 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

362

Let's Encrypt Announces New-Certificate-Every-6-Days Offering (letsencrypt.org)

submitted 1 week ago by misk@sopuli.xyz to c/technology@lemmy.world

108 comments fedilink hide all child comments

via https://it.slashdot.org/story/24/12/15/0059216/lets-encrypt-announces-new-certificate-every-6-days-offering

you are viewing a single comment's thread
view the rest of the comments

[–] sugar_in_your_tea@sh.itjust.works 14 points 1 week ago (5 children)

Interesting. I use LetsEncrypt largely for internal services, of which I expose a handful externally, and I've been thinking of only opening the external port mapping for cert renewals. With this at 90 days, I was planning on doing this once/month or so, but maybe I'll just go script it and try doing it every 2-3 days (and only leave the external ports open for the duration of the challenge/response).

I'm guessing my use-case is pretty abnormal, but it would be super cool if they had support for this use-case. I basically just want my router to handle static routes and have everything be E2EE even on my LAN. Shortening to 6 days is cool from a security standpoint, but a bit annoying for this use-case.

[–] kurt@lemm.ee 32 points 1 week ago (2 children)

You can use DNS challenge to renew your certificates without opening ports! Have a look at acme.sh for automation.

[–] sugar_in_your_tea@sh.itjust.works 7 points 1 week ago* (last edited 1 week ago) (1 children)

Oh, awesome! I thought that was a manual process, so I've been using the regular method.

Looks like I have a new project for this weekend. My DNS is currently hosted at Cloudflare, so this should be pretty straightforward.

[–] Rogue@feddit.uk 6 points 1 week ago (1 children)

Caddy with the cloudflare module makes TLS with DNS verification insanely simple

https://github.com/caddy-dns/cloudflare

[–] sugar_in_your_tea@sh.itjust.works 2 points 1 week ago

Nice! I use Caddy, so this should be a snap.

[–] treadful@lemmy.zip 4 points 1 week ago

certbot has modules for most DNS providers as well.

load more comments (2 replies)