Podcast
Root Causes 293: What Is Certbot?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
April 10, 2023
Certbot is an important part of the ACME standard. This open source tool makes it easier for many IT administrators to use ACME to automate provisioning and installation of SSL / TLS certificates.
Podcast Transcript
Lightly edited for flow and brevity.
And for those of you who want to experiment with installing a certificate onto a website, I’ll tell you something. I went through an experience recently with colleagues and even some friends and said, hey, let’s have some fun and we’re gonna actually go through the process of doing this. You know, installing certificates, installing SSL, and getting it done because I think, Tim, it’s quite daunting to the average non-technical person. If you’re not a died in wool Linux administrator, even if you are, there’s some things to know. And if you come more from the business world and you deal with risk and you deal with, hey, I want to make sure I have uptime. My websites are going to have a valid certificate. Then, I think learning something like Certbot is great and one of the great things about it, Tim, is there’s a ton of documentation out there and, again, congratulations to the community for - - you can do an internet search on Certbot and get a heck of a lot of support in using it. And it’s worth learning it. I think even for those of you who are not super technical, there’s a lot to get out of it and people who have – the friends and colleagues who I forced to do it – I tell you; they came away with a better appreciation for what it takes to actually install a certificate onto a website.
And now we have Wildcard and we have all kinds of options we have now and Certbot supports all of that, which is terrific. And so therefore, all the way to the point where Certbot does a nice clean job – again, all part of the ACME standard, it’s wrapped really nicely. Standards and implementations are very different things and Certbot is a nice implementation of the ACME standard all the way to point where I’ve really never had a problem and those of you who do this a lot more than I do, maybe you have, but I have never had a problem with Certbot at all in making a modification to my Nginx server or my Apache server – whatever my web server happens to be. The necessary modifications to the configurations that have to happen usually work out really well and next thing you know, I walk away and I’ve got a website that has a certificate, Tim, and what a great feeling that is to do such a complicated process in just a few steps.
And those are really easy to use as well. There were some transition periods where the ACME standard had changed and Apache server themselves, that community, hadn’t quite updated their inbuilt open-source implementation of the ACME protocol and so, you know, it just might take a little bit of time but I just happened to experience that hiccup during that period of time, and it was a little bit frustrating because there were some things I wanted to do, couldn’t do it and had to wait. But eventually the community came around and put it in.
It’s a big deal and it’s great because it’s so fundamental. It’s not what I would call certificate lifecycle management but it certainly is a first step in a best practices automation and provisioning of certificates and hallelujah that we’ve got this new way of doing things. Even if you are a hardened Linux administrator, you are gonna have a hard time convincing me that it doesn’t save you a lot of time and saving a lot of guesswork in, hey, did I do that right? Did I check off all the boxes? Well, really good implementations like Certbot of the ACME standard will get you there.
You know, for those of you who are super technical and you are just listening in, you know, we are not talking about some kind of very friendly little Windows application or mobile application that you fire up and it’s got a little GUI and you click a few buttons and you get your cert. This is still some work in the Linux world, at the Linux command line, but certainly it’s an application that runs at the command line that does the best practices of implementing the ACME standard and getting that cert installed correctly, safely, securely and even in a friendly way that does your complex, sometimes complex configuration of that web server – of your web server configuration. Which to me, my goodness, the ease and ability to fat finger that, Tim, and to get it wrong and to take your site down.

