Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Beta: December 3, 2015

letsencrypt.org

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Public Beta: December 3, 2015

#41

Post by schoen »

diafygi wrote: post #33
tombrossman wrote: post #27

Earlier quoted context omitted.

Here's the issuer from the certificate I got, and I believe it was the (beta) production one and not the development endpoint. Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X1 Possibly user error still, but I use HTTPS across all my personal sites and they all rate well on third-party tests so I'm not a total noob (I hope...).

Ah! Ok, I think you need to add the intermediate certificate[1] that chains the Let's Encrypt Authority X1 to the IdenTrust root. Here's instructions on how to do this for nginx: https://github.com/diafygi/letsencrypt-nosudo#how-to-use-the... [1]: https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.p...

Note that you also have to do this step for other CAs, it's just that browsers often cache intermediates that they've seen before so sites may mysteriously work for most or almost all users but fail for others if the intermediates are missing. This configuration problem is extremely common and often confusing for people to diagnose. It might be more obvious with Let's Encrypt's intermediate because not as many browsers have that cached yet, but the configuration issue is technically the same regardless of what CA you're using. Sending chain files is mandatory if you want to be compatible with all user-agents that accept the root that you're chained to.

Re: Public Beta: December 3, 2015

#42

Post by plnii »

The beta was good timing for me. I installed an LE cert on Ubuntu running Apache and it's working fine. The instructions were a bit unclear about whether the "auto" option works yet for that setup (it doesn't). Also, I had an issue with permissions on the cert directory - I use a group for my server permissions (instead of running at root), so had to add that group to the cert directory. But the process is still better than what I've experienced implementing a comodo cert.

Re: Public Beta: December 3, 2015

#43

Post by GigabyteCoin »

atmosx wrote: post #8
discreditable wrote: post #5

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) she…

A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.

>I've seen (can't remember where) a 3 USD/month offering.

You're probably thinking of http://lowendbox.com/

Re: Public Beta: December 3, 2015

#44

Post by schoen »

flavmartins wrote: post #40
GavinMcG wrote: post #37

Earlier quoted context omitted.

The green padlock that casual users might misinterpret as meaning "to be trusted".

If you look at Chrome's change to https indicators, they give these sites with auto issued certs the lock so users will interpret it as "secure". Seems easy to create fraud sites and give them a legitimate site look.

Also discussed at

https://community.letsencrypt.org/t/the-cas-role-in-fighting...

which is the official discussion thread for Josh's article on this topic.

Re: Public Beta: December 3, 2015

#45

Post by sofaofthedamned »

atmosx wrote: post #8
discreditable wrote: post #5

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) she…

A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.

Let's Encrypt is brilliant and the web needs it but the tooling isn't quite there.

For example with haproxy you need the entire chain and private key together, which I have to do manually. As the API is open it's doable - I may even do something myself.

I can't wait until I have something that somebody else or I has written that, once the API is complete, you can stick in a cron job and does the concatenation and reloads haproxy/nginx/whatever. Until then the whole thing is beta.

It's not even the monetary aspect - i'd happily pay for certs, but LE is so on the way to making it a devop as opposed to a finance/ops thing that it needs to be encouraged. Donation incoming...

Re: Public Beta: December 3, 2015

#46

Post by pfg »

discreditable wrote: post #5

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) she…

That's a good point, domain registrars like GoDaddy generally don't make much on domains alone and focus on selling additional services like hosting packets (and SSL), where they probably make most of their money.

However, most browser vendors are already making plans to phase out HTTP without TLS by only providing new features/APIs to HTTPS sites (and eventually by displaying http:// as insecure in the UI).

I think in the end this will force shared hosting providers to include domain-validated certificates (from e.g. letsencrypt) in their base packages for free. Instead, they would probably push OV and EV certs to make up for any revenue loss.

Re: Public Beta: December 3, 2015

#47

Post by matt4077 »

tombrossman wrote: post #10

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it t…

I am actually incredibly happy with the process. nginx requires these concatenated certificates and I always get the order / file formats / trailing spaces wrong. With LE I got it up & running in < 3 minutes, including manually updating the config file.

Re: Public Beta: December 3, 2015

#48

Post by kevinreedy »

ars wrote: post #38
kevinreedy wrote: post #18

Earlier quoted context omitted.

I actually love the idea of 90 day (or less) certificates! Once you automate the process of replacing your certificate (which let's encrypt will greatly help with), it won't matter how short the period is. Also, if a key gets compromised, it'll be valid for a shorter time. Give https://letsencrypt.org/2015/11/09/why-90-days.html a read! If you want to get more in-depth about certificate revocation, http://news.netcra…

If someone compromised the key they also compromised the system used to automatically generate more keys, so a short expiration is not as helpful as it looks. It's even worse than that: A smart attacker will copy the method used to generate keys, and leave the server. Then they can keep generating keys and you will probably never notice. I feel that automation is a mistake, something security sensitive like this shou…

I'm not in the beta, and thus haven't been able to play with it yet. But, I don't believe there'd be anything prohibiting you from generating the certs on a separate machine. In fact, I'd imagine that's what you'd want to do (if you have more than one server) rather than generating a separate certificate for every web server or load balancer.

Re: Public Beta: December 3, 2015

#49

Post by diafygi »

tombrossman wrote: post #31
diafygi wrote: post #24

Earlier quoted context omitted.

Howdy, I wrote letsencrypt-nosudo. Sorry that the experience was so painful! Mind filing a detailed issue on the repo so I can fix it and make the user experience better?

Oh I think it's simple enough and thanks for the tool, but I'm comparing it to the workflow I currently use which has fewer steps (generate CSR, paste in form on issuer's website, click link to validate domain). Headed out now but I'll try to provide some better feedback later.

Yeah, unfortunately, the ACME protocol requires registering accounts and making requests using public key signatures, so it's not as user friendly as email confirmations (despite being way more secure and automatable).

Re: Public Beta: December 3, 2015

#50

Post by toomuchtodo »

gluejar wrote: post #19
tombrossman wrote: post #10

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it t…

I think you really have to understand that at its heart, Let's Encrypt is not about free certs as much as it is about automatic certs. If you just want a cert, definitely use an established provider. But a year from know, LE will be making this a "set and forget" thing, which is how it should be. LE is NOT a painless way to get certs for legacy infrastructure. I found this out by using it for an elastic beanstalk hos…

On the plus side, Amazon could choose to automate IAM SSL storage and renewal through Let's Encrypt so it would be fully automatic. Might take a bit until they do that though...

Paging /u/jeffbarr?

Post reply on HN