141–150 of 187 posts
Earlier quoted context omitted.
I've worked with a company that at least 30% of our user base uses Qihoo brower. They blocked few of our domains and now, someone from Qihoo asked us to pay so that they will unblock our domains.
What do you mean by "blocked few of our domains"?
Earlier quoted context omitted.
Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.
I got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.
All in, the Lets Encrypt way brings you more security. Since the certificate validity is shorter, even generating an extra certificate will give the attacker a smaller average time with a valid cert than stealing your StartSSL cert.
Earlier quoted context omitted.
I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.
can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).
Earlier quoted context omitted.
> There's really not much reason to use StartSSL now that Let's Encrypt Have you tried using it? On every domain I've tried to obtain a cert it has failed. For me StartSSL may be suboptimal, but at least it works, which is more than I can say for Letsencrypt in its current state.
What client did you use? acme-tiny has been flawless for me, though it's more manual than the main client. https://github.com/diafygi/acme-tiny
In practice, for most people, reserve a few hours for your first deployment. After you got a script that calls openssl right, it's fast to adapt for other domains, but the first time is hard.
Pathetic let'sencrypt promotion. Now I'm gonna give you a few reasons not to use let's encrypt: it forces you to keep a piece of software that can generate keys in your server. It forces you to reload your web server config every two months, unattended (they won't issue certs valid for more than 90 days). The alernative would be to do the process manually every two months(wtf?). Also, its certificates are not trusted…
Earlier quoted context omitted.
> My point was that you referred to all other security as "half-assed" (and implied I was too), which would make almost all other sites half-assed. To be clear about that: My point about half-assed was your seeming unwillingness to back up client-certificates which gives full access to your real certificates and (in some cases) private certificate keys. Unless on Windows (where StartSSL has its private keys marked no…
Even if it's easy (and it may be now - I haven't done it for a while), it's still a whole extra backup workflow, which I have to work out how to do for all different browsers, and if I'm on another machine work out how to import, and work out if it's possible on mobile, and oh look, my personal certificate has expired so I can't login to renew it so I need to create a new account to get a new certificate and email th…
Why does the nationality of the company matter? Mentioning it so prominently just plays to our natural xenophobia.
I'm all for jumping over to Let's Encrypt... as soon as they offer certs I don't have to renew every 3 months