Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Public Beta: December 3, 2015

letsencrypt.org

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Public Beta: December 3, 2015

#61

Post by joshmoz »

gluejar wrote: post #19
tombrossman wrote: post #10

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it t…

I think you really have to understand that at its heart, Let's Encrypt is not about free certs as much as it is about automatic certs. If you just want a cert, definitely use an established provider. But a year from know, LE will be making this a "set and forget" thing, which is how it should be. LE is NOT a painless way to get certs for legacy infrastructure. I found this out by using it for an elastic beanstalk hos…

Head of Let's Encrypt here.

You nailed it. It's important that our certs be free because we can't automate a billing interaction. If we had to charge then sysadmins couldn't just type a command and be on their way. Automated renewal could fail because billing info was out of date. This stuff has to just work, reliably, if we're going to expect the entire Web to use TLS.

Re: Public Beta: December 3, 2015

#62

Post by discreditable »

Diamons wrote: post #11
atmosx wrote: post #8

Earlier quoted context omitted.

A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.

Side question, does anyone actually enjoy running a VPS? Between managing the sites on it, you have to maintain the VPS, keep it up to date, its prone to security bugs and flaws, etc. Am I missing something here? I remember setting up multiple VPSes on Linode / DO and it was always a painful process of installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. On…

I much prefer using NearlyFreeSpeech. I like being able to outsource the server management to them. Since my sites are static and largely cached by Cloudflare, I think I've paid them less than $10 for the last year's worth of service.

Re: Public Beta: December 3, 2015

#64

Post by CzarSpider »

0x0 wrote: post #2

So a slight delay then, previously they announced general availability for November 16th: https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun...

And before that it was announced that general availability was going to be September 14th: https://letsencrypt.org/2015/06/16/lets-encrypt-launch-sched...

It's a shame they've pushed it back twice so far.

Re: Public Beta: December 3, 2015

#65

Post by ge0rg »

SuperKlaus wrote: post #16
flyingmutant wrote: post #4

Is there finally a way to renew the certificate without taking down the web server listening on :443? This was the major thing missing from being able to deploy it in production.

There's no downtime when using the webroot method, see here for details: https://community.letsencrypt.org/t/using-the-webroot-domain...

The downtime happens when you restart the server so it loads the new certificate. This must probably be addressed in the server implementation.

Re: Public Beta: December 3, 2015

#66

Post by technion »

fenesiistvan wrote: post #3

I am still unable to run the tool to get the certificates on Windows OS. I know that there are some development in progress, but still far to be finished. Windows OS is running around 30% of the web servers. Please don't neglect it.

I'd be interested in whether my script[0] works on Windows, aside from the obvious fact most Windows servers don't have Ruby.

You could also just put a gets on line 43 to pause it before the verify, and copy the generated verify files onto said Windows server from any Linux box anywhere.

[0] https://lolware.net/2015/10/27/letsencrypt_go_live.html

Re: Public Beta: December 3, 2015

#67

Post by voltagex_ »

fenesiistvan wrote: post #3

I am still unable to run the tool to get the certificates on Windows OS. I know that there are some development in progress, but still far to be finished. Windows OS is running around 30% of the web servers. Please don't neglect it.

Anyone want to help write a Powershell version?

Edit: https://github.com/natemrice/letsencrypt-powershell could use a hand.

I can't afford to spin up too many Windows servers on AWS but I'd like to have a look at this.

Re: Public Beta: December 3, 2015

#68

Post by voltagex_ »

geerlingguy wrote: post #55
Diamons wrote: post #11

Earlier quoted context omitted.

Side question, does anyone actually enjoy running a VPS? Between managing the sites on it, you have to maintain the VPS, keep it up to date, its prone to security bugs and flaws, etc. Am I missing something here? I remember setting up multiple VPSes on Linode / DO and it was always a painful process of installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. On…

On a basic level, shell scripts to do the basic config work in a pinch. But if you can learn the basics of Ansible, setting up a new VM can take just a few minutes and not be painful at all. It's quicker for me to add a new VM and apply a few Ansible roles I've written for a new client site/app than to log into some shared hosting provider and click through their UI to do the same.

Have you got any hints on learning Ansible? I've tried but I find YAML quite tedious to write - I'm more likely to reach for shell scripts.

I'd also like to integrate it with https://github.com/voltagex/junkcode/blob/master/Python/spot... so I can do "least cost provisioning"

Re: Public Beta: December 3, 2015

#70

Post by blibble »

flavmartins wrote: post #28

Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?

the vast majority of phishing websites I seem encounter these days are all wrapped in https by cloudflare.

seems that letsencrypt unlikely to make the problem any worse!

Post reply on HN