Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt is Trusted

letsencrypt.org

Post reply on HN
Print view View original

41–50 of 318 posts

Re: Let's Encrypt is Trusted

#41

Post by toomuchtodo »

mastax wrote: post #35
yokohummer7 wrote: post #30

Earlier quoted context omitted.

Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.

An argument can be made that Let's Encrypt doesn't need wildcard certificates since new certs can be generated automatically every time a subdomain is added.

True! But wildcards make cert management so much easier. If I have a handful of subdomains, that's fine. If I have thousands, I want a wildcard cert.

Re: Let's Encrypt is Trusted

#42

Post by est »

NateDad wrote: post #23

Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there ot…

> NateDad 28 minutes ago

> Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there other technical reasons? Anyone know? I bet this has been asked before, but not turning anything up with google.

wow what's going on here? Auto comment robot gone wrong?

Re: Let's Encrypt is Trusted

#43

Post by flashman »

ubernostrum wrote: post #29
okigan wrote: post #21

Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?

Look at the tech overview: https://letsencrypt.org/howitworks/technology/ You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake…

> You can only obtain a certificate for a domain if you can validate that you control the domain.

Technically, you only have to make their systems think you control the domain. If their servers or 'establish proof of ownership' process are hacked, wouldn't this allow an attacker to do the same thing that happened in the DigiNotar hack?

https://en.wikipedia.org/wiki/DigiNotar

Re: Let's Encrypt is Trusted

#44

Post by tlrobinson »

est wrote: post #42
NateDad wrote: post #23

Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there ot…

> NateDad 28 minutes ago > Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to pyth…

The client is written in Python, and the parent comment is ranting about it. https://github.com/letsencrypt/letsencrypt

Re: Let's Encrypt is Trusted

#45

Post by toast0 »

It seems odd to me that the intermediates were cross signed instead of the having the root be cross signed.

With a cross signed root, clients with only the IdenTrust root will validate the cert, and clients with only the LetsEncrypt root can validate the cert.

With a cross signed intermediate, the server has to guess which root the client has and serve the correct path, there's a TLS extension to indicate roots the client supports, but nothing actually uses it, so I don't know how the server is going to guess (other than to assume no one has the LetsEncrypt root, since it's new).

[1] but some clients are dumb and won't validate successfully when they reach a root they know :/ Most browsers will though.

Re: Let's Encrypt is Trusted

#46

Post by newman314 »

pugtor wrote: post #15
nitrogen wrote: post #9

Earlier quoted context omitted.

I was unable to connect using a vendor-specific browser on an old Android 4 device. Is this a limitation of the LE cert, or a cipher suite issue with older browsers, or something else? Really looking forward to spreading HTTPS far and wide.

Taking a guess from the SSL Labs report[1], that site appears to be using the modern config from Mozilla's toolkit[2], which limits it to browsers from the last few years. 1: https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le... 2: https://mozilla.github.io/server-side-tls/ssl-config-generat...

It's also throwing a OSCP error as well as no HSTS/HPKP headers to get to A+ grade.

Re: Let's Encrypt is Trusted

#47

Post by crisnoble »

yokohummer7 wrote: post #30
jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.

StartSSL is the opposite of user friendly.

Re: Let's Encrypt is Trusted

#48

Post by UnoriginalGuy »

alfredxing wrote: post #22
jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").

They couldn't possibly issue EV certificates without charging. The verification requirements are too high. You need actual staff to verify.

Re: Let's Encrypt is Trusted

#49

Post by Pyxl101 »

yokohummer7 wrote: post #30
jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.

What is the rationale for treating wildcard certificates differently? That is, why can't Let's Encrypt issue them?

Re: Let's Encrypt is Trusted

#50

Post by scott_karana »

Pyxl101 wrote: post #49
yokohummer7 wrote: post #30

Earlier quoted context omitted.

Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.

What is the rationale for treating wildcard certificates differently? That is, why can't Let's Encrypt issue them?

I think they're just going for a minimum viable product, and I'm sure it's on the roadmap. :-)
Post reply on HN