[swinog] SSL Certs question

2021-05-13 Thread Andreas Fink
Hello all, I need to get some SSL certificates for some african country operations and i can unfortunately not use letsencrypt for this. I was trying to get a certificate from Swissign for this but for some reason they refuse issuing certificates to domains for Guinea and Guinea Bissau because the

Re: [swinog] SSL Certs question

2021-05-13 Thread Andreas Fink
Serge Droz wrote on 13.05.21 10:02: > Hi Andreas > > These two countries are not currently under comprehensive US sanctions: > > > https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information > > So any CA, except, it seems SwissSign, should do. > > Best

Re: [swinog] SSL Certs question

2021-05-13 Thread Andreas Fink
Jeroen Massar wrote on 13.05.21 10:46: > On 2021-05-13 11:29, Andreas Fink wrote: >> Hello all, >> >> I need to get some SSL certificates for some african country operations >> and i can unfortunately not use letsencrypt for this. > > Any reason? What are your requirements? the mailserver I use

Re: [swinog] SSL Certs question

2021-05-13 Thread Willy Manga
. On 13/05/2021 14:00, swinog-requ...@lists.swinog.ch wrote: > From: Andreas Fink > [...] In other words, I need another certificate > provider, preferrably not under US control (so not Comodo, Digicert, > Thawte, Symantec, Verisign etc), who can issue multidomain certificates > for .gw, .com.gn,

Re: [swinog] SSL Certs question

2021-05-13 Thread Serge Droz
Hi Andreas These two countries are not currently under comprehensive US sanctions: > https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information So any CA, except, it seems SwissSign, should do. Best Serge On 13.05.21 11:29, Andreas Fink wrote: > >

Re: [swinog] SSL Certs question

2021-05-13 Thread Jeroen Massar
On 2021-05-13 11:29, Andreas Fink wrote: Hello all, I need to get some SSL certificates for some african country operations and i can unfortunately not use letsencrypt for this. Any reason? What are your requirements? Would ZeroSSL (https://zerossl.com) who also do ACME work? (yes people, L

Re: [swinog] SSL Certs question

2021-05-13 Thread Jeroen Massar
On 2021-05-13 13:05, Andreas Fink wrote: Jeroen Massar wrote on 13.05.21 10:46: On 2021-05-13 11:29, Andreas Fink wrote: Hello all, I need to get some SSL certificates for some african country operations and i can unfortunately not use letsencrypt for this. Any reason? What are your requir

Re: [swinog] SSL Certs question

2021-05-13 Thread Roger
On 13.05.2021 13:05, Andreas Fink wrote: (yes people, Let's Encrypt is not the only game... if you do ACME for your systems, also setup zero ssl and issue certs from both places at the same time, just in case LE ever has an issue, though that will be resolved rather quickly with 72% marketsha

Re: [swinog] SSL Certs question

2021-05-14 Thread Fabian Wenk
Hello Andreas On 13.05.2021 13:05, Andreas Fink wrote: Jeroen Massar wrote on 13.05.21 10:46: On 2021-05-13 11:29, Andreas Fink wrote: Hello all, I need to get some SSL certificates for some african country operations and i can unfortunately not use letsencrypt for this. Any reason? What ar

Re: [swinog] SSL Certs question

2021-05-19 Thread Gregor Riepl
> the mailserver I use, does not support ACME setup. I can only do old > style SSL certificate requests. > for the webserver its not an issue though. Why does the mail server need to support ACME? Simply do periodic DNS verification and trigger a restart/reload of the internet-facing mail server

Re: [swinog] SSL Certs question

2021-05-20 Thread Jeroen Massar
On 2021-05-20 08:51, Gregor Riepl wrote: the mailserver I use, does not support ACME setup. I can only do old style SSL certificate requests. for the webserver its not an issue though. Why does the mail server need to support ACME? Simply do periodic DNS verification and trigger a restart/relo

Re: [swinog] SSL Certs question

2021-05-20 Thread Matthias Leisi
> I still find it funny that Digicert allows "Org Validated" (OV) certs to be > issued there. That is one of the few business cases that is left (e.g for > bare IP SSL certificates) And it may make sense for S/MIME certs (even though „LE for S/MIME“ is on the horizon, see RFC 8823). — Matthi