Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Beta: December 3, 2015

letsencrypt.org

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Public Beta: December 3, 2015

#31

Post by tombrossman »

diafygi wrote: post #24
tombrossman wrote: post #10

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it t…

Howdy, I wrote letsencrypt-nosudo. Sorry that the experience was so painful! Mind filing a detailed issue on the repo so I can fix it and make the user experience better?

Oh I think it's simple enough and thanks for the tool, but I'm comparing it to the workflow I currently use which has fewer steps (generate CSR, paste in form on issuer's website, click link to validate domain). Headed out now but I'll try to provide some better feedback later.

Re: Public Beta: December 3, 2015

#33

Post by diafygi »

tombrossman wrote: post #27
Maakuth wrote: post #20

Earlier quoted context omitted.

There's definitely some rough edges on the tooling that will make this less painful. You likely used it with development endpoints, which only give certificates signed by untrusted CA (happy hacker fake CA or something like that). However, the point[1] of short lifetime of the certificates is to incentivize automating it. I'm highly hopeful that in a short while, having an HTTPS certificate is a matter of apt-get ins…

Here's the issuer from the certificate I got, and I believe it was the (beta) production one and not the development endpoint. Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X1 Possibly user error still, but I use HTTPS across all my personal sites and they all rate well on third-party tests so I'm not a total noob (I hope...).

Ah! Ok, I think you need to add the intermediate certificate[1] that chains the Let's Encrypt Authority X1 to the IdenTrust root. Here's instructions on how to do this for nginx: https://github.com/diafygi/letsencrypt-nosudo#how-to-use-the...

[1]: https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.p...

Re: Public Beta: December 3, 2015

#34

Post by bketelsen »

mholt wrote: post #21
flyingmutant wrote: post #4

Is there finally a way to renew the certificate without taking down the web server listening on :443? This was the major thing missing from being able to deploy it in production.

If you're willing to use an alternative web server, this is possible: https://caddyserver.com/blog/lets-encrypt-progress-report Caddy (currently in beta) will issue and renew SSL certificates automatically with no downtime (on Linux; Windows has very brief downtime during restarts).

I can confirm that Caddy + Let's Encrypt is the most seamless and awesome way to run TLS. I did this last night for one of my LE beta whitelisted domains and it took MAYBE 4 minutes. Caddy did all the work. Kudos to the Caddy team for such a great admin experience.

Re: Public Beta: December 3, 2015

#35

Post by jnbiche »

xienze wrote: post #15
atmosx wrote: post #8

Earlier quoted context omitted.

A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.

I don't think cost is what's keeping people on shared hosting versus VPS. It's that there is a whole wide world of people just doing a little static hosting. They don't want, need, or know how to use a VPS.

In fact, I think most people on shared hosting are not hosting static sites, but rather sites based on one or more of the hundreds of PHP application frameworks out there (WordPress, PHPBB, Joomla, Drupal, Magento, MediaWiki, etc, etc.)

Back when I used to do frequent freelancing for the type of client who used shared hosting, I don't think I met a single one who hosted static sites, even though for many of them static would have been more appropriate and far more secure and performant.

Re: Public Beta: December 3, 2015

#36

Post by Bedon292 »

flavmartins wrote: post #28

Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?

These certs are to verify you control the domain name, not that you are who you say you are. Those certificates are much more complicated and expensive. See https://letsencrypt.org/2015/10/29/phishing-and-malware.html for more information

Re: Public Beta: December 3, 2015

#37

Post by GavinMcG »

foldor wrote: post #32
flavmartins wrote: post #28

Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?

What benefit would a phishing site have with https that they didn't have without it?

The green padlock that casual users might misinterpret as meaning "to be trusted".

Re: Public Beta: December 3, 2015

#38

Post by ars »

kevinreedy wrote: post #18
tombrossman wrote: post #10

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it t…

I actually love the idea of 90 day (or less) certificates! Once you automate the process of replacing your certificate (which let's encrypt will greatly help with), it won't matter how short the period is. Also, if a key gets compromised, it'll be valid for a shorter time. Give https://letsencrypt.org/2015/11/09/why-90-days.html a read! If you want to get more in-depth about certificate revocation, http://news.netcra…

If someone compromised the key they also compromised the system used to automatically generate more keys, so a short expiration is not as helpful as it looks.

It's even worse than that:

A smart attacker will copy the method used to generate keys, and leave the server. Then they can keep generating keys and you will probably never notice.

I feel that automation is a mistake, something security sensitive like this should be on a completely different machine.

Re: Public Beta: December 3, 2015

#39

Post by bracewel »

discreditable wrote: post #5

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) she…

Many hosting providers are choosing to integrate LE into their products directly so even if you don't get shell access you will still be able to get a cert. As far as I know both Plesk and cPanel are also working on official plugins for their software.

Re: Public Beta: December 3, 2015

#40

Post by flavmartins »

GavinMcG wrote: post #37
foldor wrote: post #32

Earlier quoted context omitted.

What benefit would a phishing site have with https that they didn't have without it?

The green padlock that casual users might misinterpret as meaning "to be trusted".

If you look at Chrome's change to https indicators, they give these sites with auto issued certs the lock so users will interpret it as "secure". Seems easy to create fraud sites and give them a legitimate site look.
Post reply on HN