Am I missing where I can signup? Love to try them.
[deleted]
Let's Encrypt is Trusted
61–70 of 318 posts
Re: Let's Encrypt is Trusted
#62Earlier quoted context omitted.
Look at the tech overview: https://letsencrypt.org/howitworks/technology/ You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake…
> You can only obtain a certificate for a domain if you can validate that you control the domain. Technically, you only have to make their systems think you control the domain. If their servers or 'establish proof of ownership' process are hacked, wouldn't this allow an attacker to do the same thing that happened in the DigiNotar hack? https://en.wikipedia.org/wiki/DigiNotar
It's not like it ain't broken already.
http://arstechnica.com/security/2015/03/bogus-ssl-certificat...
Re: Let's Encrypt is Trusted
#63Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there ot…
They provide docker packaging. So it's just as dep-free as Go. Not to mention python is on pretty much every platform in existence by default. If you're expecting this as a global binary like you would in go there's no reason you can't just "pip install letsencrypt"...
> They provide docker packaging. So it's just as dep-free as Go.
...except needing docker and everything running it in a docker container entails over a simple CLI.
Also, it looks like they say "for god's sake don't pip install":
Please do not use python setup.py install or ``sudo pip install`. Those mode of operation might corrupt your operating system and is not supported by the Let’s Encrypt team! https://letsencrypt.readthedocs.org/en/latest/using.html#ins...
> python is on pretty much every platform in existence by default.
....except Windows? Which also doesn't support docker.
Re: Let's Encrypt is Trusted
#64Earlier quoted context omitted.
> NateDad 28 minutes ago > Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to pyth…
The client is written in Python, and the parent comment is ranting about it. https://github.com/letsencrypt/letsencrypt
I really tried not to make it a rant. Sorry if it came off that way. Just seems like they made some unfortunate sacrifices to keep it as a python application (like Windows support).
Re: Let's Encrypt is Trusted
#65Earlier quoted context omitted.
Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.
I tried to sign up for one, once, and it was broken. I don't remember the circumstances, precisely. Have you actually ever gotten one?
The last time I tried to use StartSSL, I kept getting an SSL failure on https://auth.startssl.com/... Go figure.
I ended up paying $10 on namecheap instead.
Re: Let's Encrypt is Trusted
#66Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?
Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl * StartSSL https://startssl.com * WoSign https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept…
They are not quite the same thing:
* CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to.
* StartSSL free tier is for non-commerical use only.
* Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction when it comes to security products.)
Let's Encrypt is a big step forward in having a legitimate, actual, user-friendly, free TLS certificate issuer without restrictions for usage scenarios.
Re: Let's Encrypt is Trusted
#67[deleted]
Re: Let's Encrypt is Trusted
#68Re: Let's Encrypt is Trusted
#69Earlier quoted context omitted.
Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl * StartSSL https://startssl.com * WoSign https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept…
They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction…
> user-friendly
This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
Re: Let's Encrypt is Trusted
#70Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there ot…
I can't speak for them obviously, but here's a Go ACME client if you're looking for one: https://github.com/xenolf/lego - we're using it in Caddy[1] to make HTTPS the default for websites. [1]: https://github.com/mholt/caddy/commits/letsencrypt
Wow, that's awesome. Nice work integrating this into caddy.
Although, it makes me even more confused as to why they used python for the official client.