Technology

59979 readers

3052 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

358

Let's Encrypt Announces New-Certificate-Every-6-Days Offering (letsencrypt.org)

submitted 2 days ago by [email protected] to c/[email protected]

92 comments fedilink hide all child comments

via https://it.slashdot.org/story/24/12/15/0059216/lets-encrypt-announces-new-certificate-every-6-days-offering

you are viewing a single comment's thread
view the rest of the comments

[–] sugar_in_your_tea 14 points 1 day ago (1 children)

Interesting. I use LetsEncrypt largely for internal services, of which I expose a handful externally, and I've been thinking of only opening the external port mapping for cert renewals. With this at 90 days, I was planning on doing this once/month or so, but maybe I'll just go script it and try doing it every 2-3 days (and only leave the external ports open for the duration of the challenge/response).

I'm guessing my use-case is pretty abnormal, but it would be super cool if they had support for this use-case. I basically just want my router to handle static routes and have everything be E2EE even on my LAN. Shortening to 6 days is cool from a security standpoint, but a bit annoying for this use-case.

[–] [email protected] 32 points 1 day ago (2 children)

You can use DNS challenge to renew your certificates without opening ports! Have a look at acme.sh for automation.

[–] [email protected] 4 points 1 day ago

certbot has modules for most DNS providers as well.

[–] sugar_in_your_tea 7 points 1 day ago* (last edited 1 day ago) (1 children)

Oh, awesome! I thought that was a manual process, so I've been using the regular method.

Looks like I have a new project for this weekend. My DNS is currently hosted at Cloudflare, so this should be pretty straightforward.

[–] [email protected] 5 points 1 day ago (1 children)

Caddy with the cloudflare module makes TLS with DNS verification insanely simple

https://github.com/caddy-dns/cloudflare

[–] sugar_in_your_tea 1 points 1 day ago

Nice! I use Caddy, so this should be a snap.