Why this Website is not, and may never be, HTTPS
A lot of the complexity the author is worried about is brought on by iconoclastic choices.<p>&gt; Code exists for authomating [sic] [LetsEncrypted renewal certificates], but when I last checked, it did not run on my hardware platform<p>I mean, we&#x27;re talking about a task scheduler here. *nix and BSD and MacOS have Cron. Windows has a task scheduler. Every cloud platform has a mechanism to schedule tasks. Is this a Temple OS situation?<p>But if minimal complexity is what the author wants, they should consider building a static site and deploying it, say, using GitHub Pages, which supports SSL out of the box right now.<p>&gt; Lastly, as the operator of a personal website, I object to any outside control. I run my own website on my own server for exactly this reason.<p>So then let&#x27;s dispense with the notion that HTTPS is adding complexity and get back to the actual point here: potentially well justified neuroticism about having everything under your control is leading to additional complexity. That&#x27;s fine. Just own it. The whole thing boils down to &quot;I don&#x27;t want to do HTTPS and I don&#x27;t want to let someone else do it for me because I don&#x27;t want to and that&#x27;s what I want&quot;. You do you, dude.<p>&gt; A TLS certificate is issued by an organization that is not controlled by website owners, website developers, or users of the Internet. That means any time the issuer wants to raise requirements or fees for issuing TLS certificates, he is free to do so.<p>Turn off your certificate when that happens? Unless you do pinning or HSTS you have no obligation to use HTTPS in perpetuity just because you use it now. If it was someone who wasn&#x27;t familiar with system administration I&#x27;d appreciate that maybe they don&#x27;t know how to set up their webserver as such, but given that this is a person who&#x27;s chosen to run their own.<p>I&#x27;m actually not really sure why even this parade of horribles would be coherent. The author has a custom domain for which they pay a registrar. If the registrar raised it prices, he would have to migrate to another registrar or allow the domain to deregister or pay the additional fee. Everything on this earth is transient, it&#x27;s OK, be at peace. If anything I&#x27;d be more interested in a parallel blog post that says &quot;Why I ran my own domain registrar rather than give someone else $10 USD a year for a custom domain&quot; -- that&#x27;d actually be the kind of adorable crankery I love to see.<p>I do get wanting to internalize the locus of control as much as possible, but at some point -- running your own email, running your own domain registrar, issuing your own SSL cert -- the level of complexity leaps up to the point that almost no one does. Which is totally fair! But also not a big deal! It&#x27;s OK to use external services.<p>Oddly I actually agree with the author about the underlying point that HTTPS is not really in a cosmic sense necessary for every little domain, but because it&#x27;s trivial to implement and free -- even notwithstanding engaging any of the ideas about privacy and surveillance that militate towards HTTPS -- I don&#x27;t understand the objection.