←back to thread

Six day and IP address certificate options in 2025

(letsencrypt.org)
197 points SGran | 1 comments | 16 Jan 25 15:36 UTC | HN request time: 0.205s | source
Show context
jabart ◴[16 Jan 25 19:57 UTC] No.42730099[source]▶
Six days? I can't even set the cron job to weekly. Maybe that is the point of this though from being on call I really hate thing restarting every day. Caddy, Nginx, HAProxy, and IIS all seem to handle certs without a full restart. MS SQL Server, nope.
replies(2): >>42730153 #>>42733250 #
mholt ◴[16 Jan 25 20:02 UTC] No.42730153[source]▶
AFAIK, Caddy is the only integrated ACME client that is tuned for short-lived certificates. All its own self-signed certs are already 24-hour certificates, so 6-day certs will be no problem.
replies(1): >>42730215 #
yjftsjthsd-h ◴[16 Jan 25 20:06 UTC] No.42730215[source]▶
Why would that matter? Replacing the cert and sighup'ing nginx or whatever isn't functionally different from doing it in-process.
replies(2): >>42730366 #>>42730860 #
apitman ◴[16 Jan 25 21:01 UTC] No.42730860[source]▶
As someone who has rolled my own cert updates and used Caddy, I much prefer the Caddy way.
replies(1): >>42731039 #
1. yjftsjthsd-h ◴[16 Jan 25 21:19 UTC] No.42731039[source]▶
I'm happy to agree that caddy is easier, but the claim here is that it's "tuned for short-lived certificates", which... I guess could be true, but I seriously doubt that it's meaningful (on the basis that reloading certs isn't exactly expensive on any other major web server, so even if the most obvious interpretation is true and the made it take, say, 100 ms instead of 1000 ms, but we're talking about reloading every few days, who cares?).