Let's Encrypt is Trusted • Hacker News Board

Re: Let's Encrypt is Trusted

#161

Post by Natanael_L » Tue, Oct 20, 2015, 9:05 AM UTC

mtgx wrote: post #96

joshmoz wrote: post #2

See a Let's Encrypt cert in action: https://helloworld.letsencrypt.org/ Nice work team!

So, Let's Encrypt doesn't support Certificate Transparency?! If there's one place where CT should be adopted, it's probably here.

I'm sure they're not opposed to it. It's a work in progress!

Re: Let's Encrypt is Trusted

#162

Post by ersii » Tue, Oct 20, 2015, 9:08 AM UTC

mholt wrote: post #3

Congratulations LE team! Final Star Wars VII trailer and LE gets cross-signed. Best. Day. Ever.

I would just like to point out the irony in using 'LE' as a short for Let's Encrypt, as 'LE' usually gets used for shortening Law Enforcement.

(Also: Congratulations and well done, Team Let's Encrypt!)

Re: Let's Encrypt is Trusted

#163

Post by Natanael_L » Tue, Oct 20, 2015, 9:10 AM UTC

vbezhenar wrote: post #58

Is there some web interface to sign my certificate, similar to startssl? I don't really want to run new program in my server just to generate certificate.

You could run it on a laptop to get the cert, then install on the server. But right now it remains an invite only beta until they get ready for general availability

Re: Let's Encrypt is Trusted

#164

Post by chetanahuja » Tue, Oct 20, 2015, 9:12 AM UTC

scott_karana wrote: post #7

> and we’re excited to be one big step closer to bringing secure connections to every corner of the Web. What steps are left now? :-)

to make TLS actually secure? http://www.theregister.co.uk/2015/10/19/snmp_bughunt_turns_u...

Re: Let's Encrypt is Trusted

#165

Post by alwillis » Tue, Oct 20, 2015, 9:18 AM UTC

flashman wrote: post #43

ubernostrum wrote: post #29

Earlier quoted context omitted.

Look at the tech overview: https://letsencrypt.org/howitworks/technology/ You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake…

> You can only obtain a certificate for a domain if you can validate that you control the domain. Technically, you only have to make their systems think you control the domain. If their servers or 'establish proof of ownership' process are hacked, wouldn't this allow an attacker to do the same thing that happened in the DigiNotar hack? https://en.wikipedia.org/wiki/DigiNotar

This is why HTTP Public Key Pinning was created as a way to tell browsers to trust only a particular certificate, not just any certificate that was signed by a CA in the browser's trust store: https://news.ycombinator.com/item?id=10418144.

Re: Let's Encrypt is Trusted

#166

Post by tychuz » Tue, Oct 20, 2015, 9:20 AM UTC

I'm all for native desktop and mobile applications, but in this case I'd actually love a web app - enter your domain, get certificate.

Downloading a tool, reading man page, works out of the box only with apache/nginx - ehhh, seems like a lot of work, considering some comments touting 'user friendliness' compared to StartSSL.

Re: Let's Encrypt is Trusted

#167

Post by jonah » Tue, Oct 20, 2015, 9:26 AM UTC

huhtenberg wrote: post #87

jakejake wrote: post #18

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

> Is there still value to buying an expensive cert from another vendor? If you are running a commercial, high-traffic website, then yes, there is. For example, EV (extended validation) certificates is currently the only way to quickly build and maintain a "reputation" with 3rd party website ranking systems such as Microsoft's SmartScreen and, based on anecdotal evidence, with Symantec SafeWeb and Google SafeBrowsing…

Do you have any recommendations on which CA is good for EV certs (that work in Chrome)?

Re: Let's Encrypt is Trusted

#168

Post by throwaway7767 » Tue, Oct 20, 2015, 9:27 AM UTC

Can someone who's tried the client confirm if it's possible to get a key/cert out of it without having it mess with my configuration files?

I'd like a manual mode, as years of sysadmin work have made me extremely skeptical of tools that try to automatically modify config files.

Re: Let's Encrypt is Trusted

#169

Post by leni536 » Tue, Oct 20, 2015, 9:30 AM UTC

johncolanduoni wrote: post #133

lorenzhs wrote: post #120

Earlier quoted context omitted.

I don't think that's true anymore, see https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

> self-signed cert which CloudFlare will not verify at all.

Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.

Re: Let's Encrypt is Trusted

#170

Post by vog » Tue, Oct 20, 2015, 9:31 AM UTC

Natanael_L wrote: post #156

j4cob wrote: post #52

Earlier quoted context omitted.

This was a performance decision. Cross-signing the root instead of the intermediate would mean that web servers would have to include both the root and the intermediate in the chain they serve, rather than just the intermediate. That would add a full packet to each handshake.

Why are there multiple intermediate certs? I don't know the details of the standard procedure.

In case the main intermediate cert has been compromised and must be revoked, the alternative intermediate cert is already signed and can be used immediately for desaster recovery.