Let's Encrypt is Trusted • Hacker News Board

Re: Let's Encrypt is Trusted

#51

Post by sarciszewski » Tue, Oct 20, 2015, 4:55 AM UTC

jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

Let's Encrypt isn't the first to offer free TLS certificates.

I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4:

* CloudFlare https://www.cloudflare.com/ssl

* StartSSL https://startssl.com

* WoSign https://buy.wosign.com/free

* Let's Encrypt https://letsencrypt.org

For people reading this comment dozens of months in the future, a maintained list will be kept at https://paragonie.com/white-paper/2015-secure-php-data-encry...

Re: Let's Encrypt is Trusted

#52

Post by j4cob » Tue, Oct 20, 2015, 4:56 AM UTC

toast0 wrote: post #45

It seems odd to me that the intermediates were cross signed instead of the having the root be cross signed. With a cross signed root, clients with only the IdenTrust root will validate the cert, and clients with only the LetsEncrypt root can validate the cert. With a cross signed intermediate, the server has to guess which root the client has and serve the correct path, there's a TLS extension to indicate roots the c…

This was a performance decision. Cross-signing the root instead of the intermediate would mean that web servers would have to include both the root and the intermediate in the chain they serve, rather than just the intermediate. That would add a full packet to each handshake.

Re: Let's Encrypt is Trusted

#53

Post by zmmmmm » Tue, Oct 20, 2015, 4:59 AM UTC

Yay!

Honestly, it is amazing to me that someone like Google or Amazon did not do this as free service a long time ago. But having an independent entity like this do it is far better.

Re: Let's Encrypt is Trusted

#54

Post by nodesocket » Tue, Oct 20, 2015, 5:01 AM UTC

Am I missing where I can signup? Love to try them.

Re: Let's Encrypt is Trusted

#55

Post by bracewel » Tue, Oct 20, 2015, 5:04 AM UTC

nodesocket wrote: post #54

Am I missing where I can signup? Love to try them.

The general availability period hasn't begun yet, but you can still sign up for the beta program here -- https://docs.google.com/forms/d/15Ucm4A20y2rf9gySCTXD6yoLG6T...

Re: Let's Encrypt is Trusted

#56

Post by bpicolo » Tue, Oct 20, 2015, 5:04 AM UTC

nodesocket wrote: post #54

Am I missing where I can signup? Love to try them.

https://docs.google.com/forms/d/15Ucm4A20y2rf9gySCTXD6yoLG6T...

Re: Let's Encrypt is Trusted

#57

Post by bpicolo » Tue, Oct 20, 2015, 5:08 AM UTC

NateDad wrote: post #23

Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there ot…

They provide docker packaging. So it's just as dep-free as Go.

Not to mention python is on pretty much every platform in existence by default.

If you're expecting this as a global binary like you would in go there's no reason you can't just "pip install letsencrypt"...

Re: Let's Encrypt is Trusted

#58

Post by vbezhenar » Tue, Oct 20, 2015, 5:08 AM UTC

Is there some web interface to sign my certificate, similar to startssl? I don't really want to run new program in my server just to generate certificate.

Re: Let's Encrypt is Trusted

#59

Post by cinquemb » Tue, Oct 20, 2015, 5:10 AM UTC

zmmmmm wrote: post #53

Yay! Honestly, it is amazing to me that someone like Google or Amazon did not do this as free service a long time ago. But having an independent entity like this do it is far better.

Serious question, to what degree is one defined as being independent? When you have "platinum" sponsors like akamai and cisco, and can take donations through paypal?

Re: Let's Encrypt is Trusted

#60

Post by Laforet » Tue, Oct 20, 2015, 5:11 AM UTC

bracewel wrote: post #34

A quick look at all the certificates Let's Encrypt has issued so far can be found using Comodo's CT based crt.sh tool. https://crt.sh/?Identity=%25&iCAID=7395

That's surprisingly fewer domains than I expected. No wonder I never received any replies for my application to their beta program.