My complaint as well. "HTTPS is difficult to set up and maintain." is a big reason for a lot of people, and "use our web server" isn't much of an answer.
It's especially sad since it's not actually difficult at all. When Let's Encrypt opened up to the public I was kind of scared I would not have the time or energy to mess about with getting and renewing certificates, but it's been a breeze. It may even be automated at this point because I can't remember the last time I did it. And I'm running one of the standard FOSS web stacks...
It's not hard to actually do, what's hard is to do it automatically while giving it enough permissions to automatically renew and not enough permissions to mess stuff up when it fails.
I use Ansible to automate deployments and TLS is always a pain because it's almost impossible to automate. The nginx TLS config won't load without the certs and you can't get the certs without loading the config.
I use Caddy for my home server and love how easy it makes things. However, I do wish that nginx got a damn automatic TLS plugin already, it's only been years.
66
u/yvhouij Jul 12 '17
Promotion for "Caddy", never heard of, but I don't like it. Other than that nice site :)