Hacker News new | past | comments | ask | show | jobs | submit login

I don’t get why people are saying it’s hard to install Certbot. I just do:

  sudo apt install certbot python3-certbot-nginx
And it “just works” on Ubuntu. The whole thing is super easy and takes around 1 minute to get a cert installed and configured with nginx.



> And it “just works” on Ubuntu.

Sure. Now look at the dependencies that are installed compared to dependencies that are installed for dehydrated (or acme.sh, etc) which generally are: bash, OpenSSL, cURL. This is very handy for more appliance-like system (I ran dehydrated on (RH-based) F5s for years before ACME was put into the GUI; also ran it on (FreeBSD-based) Isilons.)

Also, if you want to do an audit of the code, how many lines of Python need to be examined (including dependencies) compared to how many lines of Bash? (Both would have common dependencies like (Open)SSL and HTTP/cURL libraries.) As we saw with the recent XZ kerfuffle, 'software supply chains' are becoming important.

Personally I find it much easier to understand / configure dehydrated:

    $ git clone https://github.com/dehydrated-io/dehydrated.git
    $ sudo cp dehydrated/dehydrated /usr/bin/
    
    # cat > /etc/dehydrated/config
    WELLKNOWN="/var/www/htdocs/.well-known/acme-challenge"
    CONTACT_EMAIL="you@example.com"
    # cat > /etc/dehydrated/domains.txt
    example.com www.example.com
    # mkdir -p /var/www/htdocs/.well-known/acme-challenge

    $ sudo dehydrated -c
(Ubuntu/Debian has packages for it as well.)


Not everyone's happy to allow certbot to change nginx configs. I never tried it and I'll never try it.

Also not everyone wants to install few dozens of packages just for this little thing.


It has a mode where it doesn't touch your nginx config. That's what I use because indeed, I don't want it to mess with my nginx config.

For the rest, I'll indeed look into lighter alternatives some day. But the setup works on its own so I'm a bit lazy.


All you need is certbot and a post-hook to restart nginx.

There’s this misconception that you need extra packages to get certificates working with different software.


Certbot just works? It has a ton of bugs.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: