0

For maximumum compatibility, I want to use simple DV PositiveSSL certs, similar to what Let's Encrypt does.

But the biggest pain in the neck is that I can't find anything which renews automatically when the time comes, like certbot/Let's Encrypt.

Are there any other CLI/script options for paid SSL certs to be auto-renewed, without me having to

  • Paste in my CSR file
  • Wait on an email to confirm
  • Wait on an email to get my certs
  • Paste in the contents of the cert files on my server
  • Reboot apache

Certbot makes it so nice and simple, but only works with Let's Encrypt (which, after Sept 2016, loses a lot of compatibility with slightly older browsers/OSes).

1 Answer 1

1

but only works with Let's Encrypt

No, that is not true. Although LE is Certbot's default service, the same ACMEv2 issuance protocol has been implemented by a few other CAs. For example, I have already used it with Sectigo OV certificates (who had a very similar cross-signing issue earlier this year) and with DigiCert OV.

(You just specify a different "--server" URL in Certbot, and when registering the ACME account for the first time provide an "--eab-hmac-key" for associating it with your actual ordering account on that service, a feature specifically added for use by commercial operators.)

The same goes for all other ACMEv2 clients, not just Certbot. The list of CAs supporting this protocol is short but non-zero, and with the recent push by browsers to reduce certificate lifetimes further and further (emphasizing automated renewals), it's only likely to grow.


Aside from ACME, some CAs do also offer the older SCEP protocol as well as custom ordering APIs (DigiCert has two). These may be limited to bulk/enterprise plans though, and you'll have more difficulties finding usable clients.

Not the answer you're looking for? Browse other questions tagged or ask your own question.