Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Beta: December 3, 2015

letsencrypt.org

Post reply on HN
Print view View original

1–10 of 70 posts

Re: Public Beta: December 3, 2015

#5

Post by discreditable »

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) shell access.

Re: Public Beta: December 3, 2015

#6

Post by the_angry_angel »

flyingmutant wrote: post #4

Is there finally a way to renew the certificate without taking down the web server listening on :443? This was the major thing missing from being able to deploy it in production.

There are multiple modes to the letscrypt client. The [webroot mode](https://github.com/letsencrypt/letsencrypt/issues/1370) allows you to use an existing web server.

Re: Public Beta: December 3, 2015

#8

Post by atmosx »

discreditable wrote: post #5

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) she…

A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays.

For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.

Re: Public Beta: December 3, 2015

#9

Post by gluejar »

fenesiistvan wrote: post #3

I am still unable to run the tool to get the certificates on Windows OS. I know that there are some development in progress, but still far to be finished. Windows OS is running around 30% of the web servers. Please don't neglect it.

Don't feel so bad, it doesn't run on Mac OSX or even RHEL. Use the Docker container, it worked for me.

Re: Public Beta: December 3, 2015

#10

Post by tombrossman »

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it took much more work than I expected. Then I noticed the certs will only ever be good for 90 days, and I'll have to do this multiple times a year!

Bottom line for me is that with DV certs so inexpensive and simple to get, I'd rather pay a few dollars a year for normal commercial certificates. I can do things like use CloudFront at a custom subdomain with HTTPS without needing to point DNS somewhere every few months to get a cert reissued.

I simply can't justify the extra work involved to get 'free' certificates, and I'm happy to continue buying regular DV certs. Maybe these are temporary limitations and if so I will definitely try again in the future.

[0]https://github.com/diafygi/letsencrypt-nosudo [1]https://www.ssllabs.com/ssltest/index.html

Post reply on HN