Hacker News Reader

If, like me, you don't want it to modify your configs files for you, and don't want to turn off the webserver everytime you renew certificates, use Webroot mode.

I updated my guide to setup Nginx + Ubuntu 16.04 + Let's encrypt (Nginx, IPv6, HTTP/2, and A+ rating at SLL Labs):

https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc...

I hope it helps those that hesitate to use Let's encrypt.

View on HN

You can now get those instructions in concise form from the simple widget at https://certbot.eff.org.

Let us know if there are any tweaks you'd like to see made to them (or send a PR to https://github.com/certbot/website, the instructions are in _scripts/instruction-widget)

Another good method is to use https://github.com/diafygi/acme-tiny and the ciphers from https://cipherli.st

I used acme-tiny to secure several domains on my server, including automated renewal via cron, running as an unprivileged user that only has access to the CSR, the ACME auth key, and the directory /.well-known/acme maps to, but not the server private key. Took about an hour to secure three domains, most of which was convincing OpenSSL to produce the right three CSRs with SubjectAltName set (to cover the "www." variants so I can securely redirect them).

Reply on news.ycombinator.com