[Bug 1366355] Review Request: acme-tiny - Tiny auditable ACME script for Let's Encrypt

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.redhat.com/show_bug.cgi?id=1366355



--- Comment #3 from Stuart D Gathman <stuart@xxxxxxxxxxx> ---
Why acme-tiny and not the existing certbot package?

Certbot is an all singing, all dancing, configure your web server for you (with
plugins for various web servers), ACME client plus general cert management
tool.  Let's Encrypt is a web service using the ACME protocol.

Acme-tiny is a tiny ACME client that doesn't do all that stuff - because it
only needs to be done once, so it is a really bad idea to have some generic
script editing your configuration (and who knows what else hidden among all
that code).  Plus, certbot needs root access to your system.  Acme-tiny does
not.  It runs as the acme user, and only has access to csrs you give it, certs
it signs, and the Let's Encrypt account key (when using letsencrypt to sign).

In summary, IMO certbot is targeting the wrong audience.  The people that would
need certbot to do all that one time configuration for them probably aren't
running a web server to begin with.  But I could be wrong.  There are a lot of
non-technical Fedora users, that just may in fact run web servers and
appreciate certbot.

With the apache drop-in I provide in acme-tiny, 99% of apache configurations
work out of the box anyway.  You only need to adjust the config if you use
<Location "/"> deny all inside a <VirtualHost> (which overrides the global
acme-challenge config).

In summary: letsencrypt is a web service.  ACME is a wire protocol.  certbot is
a bloated client implementation of ACME.  acme-tiny is a lean and mean client
implementation.  My acme-tiny package adds pre-made directories, user, and a
tiny cron script so that everything mostly works out of the box.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
_______________________________________________
package-review mailing list
package-review@xxxxxxxxxxxxxxxxxxxxxxx
https://lists.fedoraproject.org/admin/lists/package-review@xxxxxxxxxxxxxxxxxxxxxxx




[Index of Archives]     [Fedora Legacy]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]     [Fedora Tools]