This suggestion should be marked as Completed.

+1 for binding using thumbprint OR CN-name

For those who want to use the workaround and are working with SAN certificates, you can use this slightly modified PowerShell script to search for an appropriate certificate:

$sanAddress = "[DNS entry]"
Get-ChildItem Cert:\LocalMachine\My -Recurse | Where-Object {
$_.NotAfter -gt (get-date) -and $_.NotBefore -le (get-date)
} | Select-Object -Property Thumbprint,@{
Name="San";
Expression={$_.Extensions | Where-Object {$_.Oid.FriendlyName -eq "subject alternative name"}}
} | Where-Object {
$_.San.Count -gt 0 -and
$_.San.Format(1).Contains("DNS Name=$sanAddress")
} | Select-Object -ExpandProperty Thumbprint

Found a work around - powershell step to find the thumbprint.

$thumbprint = get-childitem cert:\localmachine\webhosting -Recurse | where { $_.subject.StartsWith("CN=blah.blah") } | where { $_.notafter -gt (get-date) } | select -expandproperty Thumbprint

Set-OctopusVariable -name "ThumbPrint" -value "$thumbprint"

octopus deploy always kills my letsencrypt settings. if there is no built-in support for LetsEncrypt, then at least there needs to be an option to disable cert update. i tried to disable the binding, as the comment states the binding shouldn't get updated. but apparrantely it gets updated...

Guys, could we at least have the option to retain current bindings until full support for LetsEncrypt is available?

Support for Let's Encrypt should also apply to the Octopus Server itself. I would like to see Octopus Server renew its own certificate to make it more hands-off.

I also use the same certificate for the RDP session. Bonus points for OD server setting the RDP thumbprint to the renewed certificate from Let's Encrypt.

Related: https://octopusdeploy.uservoice.com/forums/170787-general/suggestions/15887406-certificate-management

And I see that a github issue try to address this suggestion: https://github.com/OctopusDeploy/Issues/issues/2701

I agree with Sam : a more generic solution should be to allow binding a certificate by name instead of thumbprint. And if multiple certificates match, should use the most recent one.

Instead of specific support for Letsencrypt maybe it makes sense to be able to bind certificates via name instead of just thumbprint? That way we don't need to update octopus whenever we get new certs, no matter where the cert is sourced from.