Technology

60055 readers

2823 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

362

Let's Encrypt Announces New-Certificate-Every-6-Days Offering (letsencrypt.org)

submitted 6 days ago by [email protected] to c/[email protected]

108 comments fedilink hide all child comments

via https://it.slashdot.org/story/24/12/15/0059216/lets-encrypt-announces-new-certificate-every-6-days-offering

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 14 points 6 days ago (1 children)

Interesting. I use LetsEncrypt largely for internal services, of which I expose a handful externally, and I've been thinking of only opening the external port mapping for cert renewals. With this at 90 days, I was planning on doing this once/month or so, but maybe I'll just go script it and try doing it every 2-3 days (and only leave the external ports open for the duration of the challenge/response).

I'm guessing my use-case is pretty abnormal, but it would be super cool if they had support for this use-case. I basically just want my router to handle static routes and have everything be E2EE even on my LAN. Shortening to 6 days is cool from a security standpoint, but a bit annoying for this use-case.

[–] [email protected] 32 points 6 days ago (2 children)

You can use DNS challenge to renew your certificates without opening ports! Have a look at acme.sh for automation.

[–] [email protected] 7 points 6 days ago* (last edited 6 days ago) (1 children)

Oh, awesome! I thought that was a manual process, so I've been using the regular method.

Looks like I have a new project for this weekend. My DNS is currently hosted at Cloudflare, so this should be pretty straightforward.

[–] [email protected] 6 points 6 days ago (1 children)

Caddy with the cloudflare module makes TLS with DNS verification insanely simple

https://github.com/caddy-dns/cloudflare

[–] [email protected] 2 points 6 days ago

Nice! I use Caddy, so this should be a snap.

[–] [email protected] 4 points 5 days ago

certbot has modules for most DNS providers as well.