@NH. I'm a bit of a snob the other way - I inherently distrust a shinŷ website

I generally agree with that with that sentiment, but I'd also raise Let's Encrypt as a counter-example

Arguably, they do provide one-click privacy on a shiny, responsive website

I do not know why but I feel protected here ;)

@MagicHat clearly you haven't been here long ;)

@Arminius have you used Let's Encrypt for any complex SSL needs? One-click, shiney and responsive are not my words of choice for them

though I did eventually get to a one click solution after building out fairly extensive custom tooling, including writing an auto-DNS verifier from scratch

and even then it times out half the time running my verification batches

with no ability to have them sign an existing private key from what I've been able to get working so far

I miss StartSSL. Makes me very sad that they got sold to Wosign

they just announced they are closing up shop and giving up on trying to get back in as a CA now

the prospect of having to rotate my keys every 3 months across multiple different services is... unattractive

but I'm not going to pay $6000 for my SSL certs

@AJHenderson I've used it for a very tricky Postfix SSL/TLS email setup twice. But I hate it.

i had to write a script to kick Postfix into restart with it. I got annoyed :P

I don't miss StartSSL if only because they gave me grief with 'new domains' that were spun up.

@ThomasWard really?

even though they're clearly listed as subsidiaries of the company I own and a parent domain.

yep, twice.

Finally got mad enough at them I just started using Namecheap for SSL, or Gandi where I register my domains (free single site SSL cert with a domain!)

you just setup the new SSL cert with the primary name as a different site or subdomain and it worked perfectly fine. It was pretty trivial for me to work around

@AJHenderson yeah well back when i uised them they had to hand-check the domain ages.

I don't want to have to use SNI and I have some 18 domains with some 98 subdomains

the 'new domain' was replied to with "Wait two weeks before requesting, let the domain mature a little"

and do SSL everywhere

@AJHenderson I usually don't have to worry about that with my wildcard certs.

so my costs for a multi-site wildcard would be extremely prohibitively expensive

I use LE for simple things, but I'm fairly familiar with it I can kick the system around to make it all function :P

but it's nontrivial to get that all set up

90% of my sites are under a wildcard. because same parent domain.

yeah, I now have a tool built off of Certify and the powershell scripts that is able to call in to make MSDNS records to respond to the DNS verifier and spitout a cert for a text file's worth of subdomains

the remaining 10% are Cloudflare'd so they do the SSL

but the tooling is like 50% custom built

@AJHenderson welcome to the world of the sysadmin: custom-building solutions to make crap work.

just to make it work and I still have to manually update the cert in IIS, RDP, e-mail server and irc server

where as StartSSL just worked and was good for two years

three if you timed it right

indeed.

StartSSL just made me mad after the first three subsidiary-company domains were denied for this one client of mine just because they were brand new domains.

if they would allow you to submit the public key for signing with a real CSR, LetsEncrypt would be much better

but they needed to be up and running, so I said "Screw it" :P

@AJHenderson I know, right?

I actually wrote a hackish script that could decode a CSR and then pass the data to LE and my DNS servers in the public view to make it become the SSL master temporarily for verification, and then revert to what it was..

@ThomasWard that's odd, I never had a problem with brand new domains with them

I guess it's probably a registrar thing

based on when the whois is available

@AJHenderson well, when I got my Ubuntu membership and saw that I get nice discounts on single-site domains from Gandi, i just started using those.

and I found a cheaper Comodo wildcard reseller than NameCheap and Namecheap gave me a pricematch code so I save about $60 a year on my wildcards.

since they were big on whois based domain validation (which was it's own breed of pita)

@ThomasWard in a few years I'll probably break down and go the wild card route for single domains once non SNI compliant browsers are less common

or once IPV6 support is more broad

@AJHenderson well the Whois was available same-day and they still rejected then so I just got angry at them. I also haven't had an issue with SNI yet, namely because I'm a stickler for one-IP, one-service. With a handful of exceptions.

... like all the things running at my home network heh.

Most of my things run on systems in datacenters so I have a small set of IPs I use :p

yay for dedicated systems :P

@ThomasWard I have a dedicated server, but it costs extra for additional IPV4 addtesses

I think it's like $1 a month per IP

which would significantly increase my server cost to get IPs for every domain

and some domains go to the same service

@AJHenderson by 'dedicated server' i mean my own hardware colocated in a datacenter, and that datacenter gave me a pretty darned good deal for IP addresses. I also don't run that many sites, and really only worry about mail servers :P

which further complicates things

though I could handle that with IP bindings still I suppose

or one mail gateway server which has its own rDNS and certs.

since I could bind multiple IPs to the same service

but I understand where you are coming from there.

@ThomasWard I rent my server, but it's in a data center

and a dedicated rack unit

the package I have that i've been grandfathered into gave me a /28 of IPv4 so that's a good number of IPv4 there. Plus an entire /64 for v6 so that helped too.

1&1, while I hate their shared hosting, has really great deals on cheap dedicated boxes

true statement

I boycotted 1&1 when they fubar'd billing me and billed me erroneously for four services three months in a row.,

I pay $105 a month for a windows server 2016 box with a TB of redundant storage, 16gigs of ram, an unmetered 100mbps connection and quad core intel server processor (which my mind is blanking on the name of atm)

Xeon?

yeah

that one

dual quad Xeons in my box, unmetered 100/100, and I put a huge 128GB RAM in that damned thing. It's an Ubuntu box, but it in turn runs multiple containers or KVM-based VMs. With all the chaotic IPv4 routing and all of it :P

100 upload? nice!

honestly, 100/100 is a bit limited for data center space. I wish 1&1 would offer a cheaper gigabit option, but they only have it on their higher end packages last time I upgraded my box

I hit the limit of my server's bandwidth more regularly than any other limit on it

@AJHenderson well my full time job starts in January with a much better paycheck so I'll be able to get the higher ocnnection speed in the 250 symmetric range. But i've kept it at 100/100 because $45 a month for the whole package is damned nice.

as i said before though I'm on an old plan, so it's a grandfathered plan.

@ThomasWard sounds like probably about what I'd be paying if I owned the hardware and was just collocating

oh, just read further up... you are talking about rented servers... makes more sense now

@AJHenderson yep.

@NH. well, @AJHenderson is. I'm talking about my own hardware colo'd in a datacenter :P

@ThomasWard still talking data centers though

true.

ah.

I have two virtual dedicated servers also from RamNode - essentially VPSes, but with two dedicated CPU cores for each.

pretty decent, and for $1.50/month for extra v4 ($3/month for DDoS protected v4) it's not bad.

$800 a year for both.

plus IPs.

shrugs

... oops speaking of those VDS, I just exploded my routing to the containers for two fo the public IPs...

... where'd I put my backups of the NAT routing rules...

but yeah, I have that thing fully decked out with replicated DNS with DNSSEC, full suite of anti-spam and secure mail server configurations, SSL supporting IRC connection, full IPV6 support with most services on independent ipv6 addresses, SSL everywhere except for a few services that require unencrypted connections, some voice chat servers with DNS service resolution

etc, etc

nice.

... urgh I guess I broke IT Rule #1 - "Always make sure your backups function properly."

but it makes for a semi-crowded box

@ThomasWard my DNS replication is on one of those through Azure

and I have another virtual server on azure for doing some service bridging

nice. I have a cluster of 5 VPSes (one in each datacenter they serve from) from RamNode that do all my DNS

and then use Azure for my backup

I get a $100 a month credit for Azure with my MAPS subscription

so it costs me nothing for all my azure usage

... ugh now I have to do this NAT stuff again >.<

automated nightly backup with differentials for the week and weekly backups for the month

and monthlys going back until start of backups

I think I might have set it for 3 years or something like that

but I started them like a year and a half ago so haven't reached it yet

nice.

I started that because of a fun situation I ran in to with a dual drive failure of my raid 1 array though

I was able to piece stuff back together by splittly the array and seperating the good from the bad

but it was dicey

and this is why RAID5 with many additional drives in teh array is better :P

shot

@ThomasWard yeah, that's what I use personally, but isn't an option on my rented

mmm

guess I'm lucky that this is my hardware then :p

well other than my cache drive, my cache drive is raid 0'd ssds

sure it crashes at the first speedbump it hits, but boy does it move data around

4k raw video editing in real time

it's only 240MB/sec per clip I'm working with

nice

@AJHenderson hehe... i gona be pro here...

see you

@AJHenderson what do you do for system security with that being a Windows box

heavy duty firewalling? A firewall appliance in front of the box? Just curious

because I have a pfSense in front of my equipment at the colo

@ThomasWard since it's just my personal stuff, I just end up using the built in firewall systems. It seems to have worked ok so far. It isn't ideal, but I don't have particularly extensive routing control

it's the one downside

but not enough of one to make me pay $450 a month instead

mmm, understandable.

was merely curious :P

it still blocks access to ports that aren't in use though

true.

because it's smart enough to only open ports when services are running

it's much better now than it was in the bad old days. Still not as good as a dedicated hardware firewall, but works well enough for my needs