Comment on Decreasing Certificate Lifetimes to 45 Days
kungen@feddit.nu 5 weeks agoHot take: for-profit orgs should be buying TLS certificates from the CA cartel instead of using Let’s Encrypt. Unless you’re donating to LE, and in that case it’s cool.
jj4211@lemmy.world 5 weeks ago
Frankly, another choice virtually forced by the broader IT.
If the broader IT either provides or brokers a service, we are not allowed to independently spend money and must go through them.
Fine, they will broker commercial certificates, so just do that, right? Well, to renew a certificate, we have to open a ticket and attach our csr as well as a “business justification” and our dept incurs a hundred dollar internal charge for opening that ticket at all. Then they will let it sit for a day or two until one of their techs can get to it. Then we are likely to get feedback about something like their policy changing to forbid EC keys and we must do RSA instead, or vice versa because someone changed their mind. They may email an unexpected manager for confirmation in accordance to some new review process they implemented. Then, eventually, their tech manually renews it with a provider and attaches the certificate to the ticket.
It’s pretty much a loophole that we can use let’s encrypt because they don’t charge and technically the restrictions only come in when purchasing is involved. There was a security guy raising hell that some of our sites used that “insecure” let’s encrypt and demanding standards change to explicitly ban them, but the bearaucracy to do that was insurmountable so we continue.