Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt is Trusted

letsencrypt.org

Post reply on HN
Print view View original

71–80 of 318 posts

Re: Let's Encrypt is Trusted

#71

Post by nothrabannosir »

sarciszewski wrote: post #51
jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl * StartSSL https://startssl.com * WoSign https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept…

In addition to the other differences, as far as I know letsencrypt is the first to offer free and automated certs. None of the other ones offer an API, do they?

Re: Let's Encrypt is Trusted

#72

Post by joshmn »

chejazi wrote: post #65
JoelMcCracken wrote: post #36

Earlier quoted context omitted.

I tried to sign up for one, once, and it was broken. I don't remember the circumstances, precisely. Have you actually ever gotten one?

The last time I tried to use StartSSL, I kept getting an SSL failure on https://auth.startssl.com/.. . Go figure. I ended up paying $10 on namecheap instead.

Could save yourself $8 and add a Whoisguard thing to your cart, use promo code WHOISGUARD, and then add the ssl cert.

At least it used to work like that.

Re: Let's Encrypt is Trusted

#73

Post by mjevans »

dfabulich wrote: post #28
okigan wrote: post #21

Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?

As a condition of being trusted, LetsEncrypt has promised to do "domain validation" before creating such a certificate. Domain validation is usually done by sending an email to the technical contact in the domain's WHOIS records.

It can also be placing a file of authentication data at a chosen resource location within the domain in question. (which is, I think, what their tool automates doing)

Re: Let's Encrypt is Trusted

#74

Post by cm2187 »

Has anyone seen anything re IIS integration?

[EDIT] I have seen this: https://github.com/ebekker/letsencrypt-win

But ideally we would want Microsoft to add a checkbox in the UI of IIS Manager, which when creating a https binding offers to use let's encrypt instead of an installed certificate.

Re: Let's Encrypt is Trusted

#75

Post by itistoday2 »

alfredxing wrote: post #22
jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").

EV certs are a total waste of money. Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar.

Re: Let's Encrypt is Trusted

#76

Post by [deleted] »

Laforet wrote: post #60
bracewel wrote: post #34

A quick look at all the certificates Let's Encrypt has issued so far can be found using Comodo's CT based crt.sh tool. https://crt.sh/?Identity=%25&iCAID=7395

That's surprisingly fewer domains than I expected. No wonder I never received any replies for my application to their beta program.

[deleted]

Re: Let's Encrypt is Trusted

#77

Post by SimeVidas »

mathrawka wrote: post #33
SimeVidas wrote: post #31

So… we’re all still waiting for the client, right?

No, they have announced their launch schedule in the past. Here is the latest update: https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun...

But we are waiting for the client, no? If I understand correctly, the client will enable us to install Let’s Encrypt’s certificate on our web server. I assume, “general availability” is when the client will become available for everyone.

Re: Let's Encrypt is Trusted

#78

Post by pugtor »

newman314 wrote: post #46
pugtor wrote: post #15

Earlier quoted context omitted.

Taking a guess from the SSL Labs report[1], that site appears to be using the modern config from Mozilla's toolkit[2], which limits it to browsers from the last few years. 1: https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le... 2: https://mozilla.github.io/server-side-tls/ssl-config-generat...

It's also throwing a OSCP error as well as no HSTS/HPKP headers to get to A+ grade.

But hey, it's got OCSP stapling!

Re: Let's Encrypt is Trusted

#79

Post by pugtor »

Laforet wrote: post #60
bracewel wrote: post #34

A quick look at all the certificates Let's Encrypt has issued so far can be found using Comodo's CT based crt.sh tool. https://crt.sh/?Identity=%25&iCAID=7395

That's surprisingly fewer domains than I expected. No wonder I never received any replies for my application to their beta program.

I think the idea was the public beta should wait until the certs are valid everywhere.

Re: Let's Encrypt is Trusted

#80

Post by jhall1468 »

NateDad wrote: post #63
bpicolo wrote: post #57

Earlier quoted context omitted.

They provide docker packaging. So it's just as dep-free as Go. Not to mention python is on pretty much every platform in existence by default. If you're expecting this as a global binary like you would in go there's no reason you can't just "pip install letsencrypt"...

> They provide docker packaging. So it's just as dep-free as Go. ...except needing docker and everything running it in a docker container entails over a simple CLI. Also, it looks like they say "for god's sake don't pip install": Please do not use python setup.py install or ``sudo pip install`. Those mode of operation might corrupt your operating system and is not supported by the Let’s Encrypt team! https://letsencr…

> ....except Windows? Which also doesn't support docker.

So the actual problem you have is that you selected an operating system that has zero native support for interpreted languages, and you're mad that they didn't cater their software to you?

Post reply on HN