Conversation

Sounds like they actually enable you to do this in a sensible and secure way vs Cloudflare just asking for the keys to the castle. Which is a big 👍

Quote Tweet

Ceej "I aim to be useful" Silverio

@ceejbot

Aug 27

Fastly requires more expertise than using Cloudflare. You have to bring your own DNS, and you have to think about what you’re doing with your certs instead of letting CF handle it all. OTOH, you’re making a clear statement that hosting assholes is not okay.

Show this thread

Replying to

No, Fastly would still be able to issue certs for your domain via the HTTP method, they just don't.

Replying to

Not if CAA disallows that.

Replying to

and

Has

still not moved CAA ACME method restrictions or account key pinning out of beta???

Replying to

and

No. validationmethods / accounturi are still only deployed for staging and I've asked them about it a few times in different places without getting an answer, likely because I'm not asking the right people if there are any right people. Possible whoever was working on it left...

11:14 PM · Aug 27, 2022Twitter Web App

Replying to

and

Uhg. This is so infuriating. It's literally one deploy (with basically zero risk of breakage to anyone not using it) away from being secured.

Replying to

and

You also get warned if your certificates are going to expire anyway. We use hardened service configuration for certbot renewal and recently it broke due to new system call so we got the usual email from Let's Encrypt and a warning from our NodePing monitoring setup about it.