Ask HN: Other CA with API, similar to Lets Encrypt?

1 pointsprohor9y ago6 comments

Hi, We started to use Lets Encrypt for automatic certificate generation. Unfortunately we start to get close to rate limits [1], so we requested an increase. Apparently our use case isn't eligible for increased limits, as it wasn't approved (no response, so not declined either). So we started to look for an alternative.

Do you know other CA that provide API for certificate requests? It can be paid. The API doesn't need to be compatible with Lets Encrypt, but it would be nice.

Thank you!

1. https://letsencrypt.org/docs/rate-limits/

6 comments

scrollaway9y ago

ACME (https://en.wikipedia.org/wiki/Automated_Certificate_Manageme...) is still new, I don't believe any other certified CA implements it.

What is your use case? Maybe there's a better way.

prohorOP9y ago

Well, ACME would be perfect, but actually any fully automated process would do.

We provide an on-prem software available via browser. And well, we want to be very nice for our customers, so upon installation we also setup a subdomain in a domain that we control and request a certificate for that. At the end of installation we provide user with HTTPS URL where the service is available and with a valid certificate :-) Of course they can later opt-out, use their domain or certificate, but we make it work without security warnings from the first moment.

scrollaway9y ago

Do you have to control the domain? That's the main source of your rate limiting issues.

If you can use different domains for different customers, then you can scale that better.

Look into Caddy for automatic ACME integration: https://caddyserver.com/ - This + DNS or HTTP challenge, it sounds like this might work for you.

1 more reply

stephenr9y ago

Can I suggest that perhaps you could just start using alternative domains to avoid the rate limit?

Edit: also, how long since you requested the increase? They say it takes a few weeks.

prohorOP9y ago

It is about 1.5 month now.

Yes, using different domains is a potential option too, but the domain is directly connected with the product, so want to consider other options too.

j / k navigate · click thread line to collapse

Ask HN: Other CA with API, similar to Lets Encrypt?

1 pointsprohor9y ago6 comments

Do you know other CA that provide API for certificate requests? It can be paid. The API doesn't need to be compatible with Lets Encrypt, but it would be nice.

Thank you!

1. https://letsencrypt.org/docs/rate-limits/

6 comments

scrollaway9y ago

ACME (https://en.wikipedia.org/wiki/Automated_Certificate_Manageme...) is still new, I don't believe any other certified CA implements it.

What is your use case? Maybe there's a better way.

prohorOP9y ago

Well, ACME would be perfect, but actually any fully automated process would do.

scrollaway9y ago

Do you have to control the domain? That's the main source of your rate limiting issues.

If you can use different domains for different customers, then you can scale that better.

Look into Caddy for automatic ACME integration: https://caddyserver.com/ - This + DNS or HTTP challenge, it sounds like this might work for you.

1 more reply

stephenr9y ago

Can I suggest that perhaps you could just start using alternative domains to avoid the rate limit?

Edit: also, how long since you requested the increase? They say it takes a few weeks.

prohorOP9y ago

It is about 1.5 month now.

Yes, using different domains is a potential option too, but the domain is directly connected with the product, so want to consider other options too.

j / k navigate · click thread line to collapse