Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt
-
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@travisdh1 said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller Wildcard certs work now, so the Exchange server needing 4 just for it is now this easy?
In theory, yeah.
I might have to try spinning up a temp one to try this. Could make life that much easier for a bunch of us at work.
-
@scottalanmiller Is this for self-issued certificates?
-
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller Is this for self-issued certificates?
No, this is for LetsEncrypt certs.
-
Is the Win-ACME tool scheduling the renewal of the LetsEncrypt SSL certificates?
-
@magicmarker said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
Is the Win-ACME tool scheduling the renewal of the LetsEncrypt SSL certificates?
It doesn't do the scheduling itself, but recommends that you schedule it with the task scheduler to auto-renew.
-
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller Is this for self-issued certificates?
No, this is for LetsEncrypt certs.
I must admit, this is the first time I've heard of them.
I've looked at the site and if I read things correctly, we can use their certificates for Remote Desktop Services publishing where we have an internal domain setup?
-
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller Is this for self-issued certificates?
No, this is for LetsEncrypt certs.
I must admit, this is the first time I've heard of them.
Seriously? You need to get out more.
-
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
-
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?
-
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller Is this for self-issued certificates?
No, this is for LetsEncrypt certs.
I must admit, this is the first time I've heard of them.
Seriously? You need to get out more.
Heh … that's one of the reasons I'm on this forum.
-
Glad they finally got wildcard. For years every time SSL cert cost came up on slashdot I argued that it was basically a scam and was even more irritated when everyone seemingly at the same time went to require signed certificates. It was like Verisign bribed everyone. LetsEncrypt made life better and I was disappointed they didn't support wildcards for a while but glad to see it finally.
So much for all those counter arguments on slashdot that the cost is for the insurance in case the certificate doesn't properly work or something else unclear, as if any of the potential problems wouldn't also be a problem for the entire Internet infrastructure when it came to security. Really people are just paying thousands of dollars in some cases for 640 bytes, or whatever, to be stored at a server somewhere and some requests for verification from time to time. It's a racket. If you want a CA though still gotta pay through the nose unless you push your CA cert to all the work stations in your business or whatever.
LetsEncrypt is the best thing to happen to the Internet, but especially the web, since IPSec and SSL itself.
-
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?
One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO.
-
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?
One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO.
Snag: Valid for 90 days. In larger RDS farm settings this would be a bear to manage. That means the need for an automated process.
-
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?
One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO.
Snag: Valid for 90 days. In larger RDS farm settings this would be a bear to manage. That means the need for an automated process.
It is expected to be automated. SSL Cert updates should not be intrusive. All of the tools for LE SSL Certs are designed around the idea that you will automate them and never need to worry about them again. It's about being less of a snag, not more of one.
-
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?
One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO.
Snag: Valid for 90 days. In larger RDS farm settings this would be a bear to manage. That means the need for an automated process.
It is expected to be automated. SSL Cert updates should not be intrusive. All of the tools for LE SSL Certs are designed around the idea that you will automate them and never need to worry about them again. It's about being less of a snag, not more of one.
Got it thanks. Looks like a bit of a learning curve then.
-
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt:
@scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE.
Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy?
One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO.
Snag: Valid for 90 days. In larger RDS farm settings this would be a bear to manage. That means the need for an automated process.
It is expected to be automated. SSL Cert updates should not be intrusive. All of the tools for LE SSL Certs are designed around the idea that you will automate them and never need to worry about them again. It's about being less of a snag, not more of one.
Got it thanks. Looks like a bit of a learning curve then.
It's not bad. I find learning the LE pieces easier than learning to do it the old fashioned way
And with LE it is "learn once and ignore", rather than "learn once, forget, do again in a year or two all over again."
