the amount of switches, and the systemd being involved. I don’t use systemd
systemd.software is just a website and isn't related to running certbot. Indeed, if you'd visit the site you'd see I have a lot of gripes about systemd too!
Systemd here is only used as an example for the renewal service. It actually just calls `certbot renew`:
$ cat /usr/lib/systemd/system/certbot-renew.service
[Unit]
Description=This service automatically renews any certbot certificates found
[Service]
EnvironmentFile=/etc/sysconfig/certbot
Type=oneshot
ExecStart=/usr/bin/certbot renew --noninteractive --no-random-sleep-on-renew $PRE_HOOK $POST_HOOK $RENEW_HOOK $DEPLOY_HOOK $CERTBOT_ARGS
If the systemctl is what you're objecting to, on the other hand, then you need to get a grip.
google certbot systemd or certbot openrc to see it fail. tack on that they had to invalidate all of their certs one day and gave little warning and you could easily have experienced revoked SSL certs if your system wasn't the default setup.
I'm sorry, what? Are you projecting? By what measure is "custom" and by what measure is "no one"? My old setup was very custom and worked quite fine with certbot. My current setup is less custom and still works quite fine with certbot. I literally haven't had any trouble whatsoever with certbot.
> the fact that they don't have easy guides on how to do it without certbot is worrying
Without Certbot we'd be using openssl's arcane command line. And you're absolutely right, openssl is a !@#$ing dumpster fire. I'd argue that openssl's garbage tools are exactly why certbot was created.
> google certbot systemd or certbot openrc to see it fail.
I did google certbot systemd and certbot openrc. I don't see failures. Please cite some.
> they had to invalidate all of their certs one day and gave little warning and you could easily have experienced revoked SSL certs if your system wasn't the default setup
"They" are LetsEncrypt. And "They" aren't Certbot.
In retrospect I thought I'd vouch for your message since I thought it would be a decently constructed argument. Instead I now recognize you didn't write a reasoned argument. That was my fault for vouching before reading.
If you don't like Certbot or LetsEncrypt then nobody's forcing you to use them. Go pay for a SSL certificate since you don't understand how to use free tools. Or just use unencrypted connections and let your users get hacked.