Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Early Impacts of Let's Encrypt

tacticalsecret.com

Post reply on HN
Print view View original

11–20 of 98 posts

Re: Early Impacts of Let's Encrypt

#11

Post by toomuchtodo »

diafygi wrote: post #7
tootie wrote: post #5

I've used them a bunch. We host a lot of internal-facing utilities that are low-profile, but occasionally hosting sensitive data. In the past I couldn't convince managers to spend money on certs even if the cost of someone stumbling on these sites could be very high and certs are cheap. Now I don't even have to ask.

Keep in mind that Let's Encrypt publishes a searchable list of all domains issued. https://crt.sh/?Identity=%25&iCAID=7395

This is why we're not using Let's Encrypt for internal/sensitive non-user facing services at the moment. Wildcard instead.

Re: Early Impacts of Let's Encrypt

#13

Post by toyg »

comex wrote: post #3

Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.

There is always pent-up demand for a previously-expensive service to become free.

Re: Early Impacts of Let's Encrypt

#14

Post by veeti »

yoha wrote: post #12

For anyone struggling with creating Let's Encrypt certificates (or just as lazy as I am), try out https://gethttpsforfree.com/ .

I'll plug my own client [1], which is also completely manual for those who don't want to go all in on the magic automation just yet. It also has DNS verification, which is probably more convenient in most cases.

[1] https://github.com/veeti/manuale

Re: Early Impacts of Let's Encrypt

#15

Post by pfg »

ex3ndr wrote: post #2

So, Let's Encrypt became 4-th in the world by amount of certs? Am i right?

4th largest counting certificates that are either on Certificate Transparency Log servers or in censys' data set.

CT logs are populated by CAs sending their certificates to log servers. Only a few CAs (including Let's Encrypt) do this consistently at the moment, since it's only mandatory for EV certs (for now), and CAs generally move rather slowly. Certificates encountered by Googlebot during web crawling also get pushed to their log servers. Censys probably does something similar.

It's possible that there's a large number of certificates issued only for internal systems that would not end up on CT log servers and that are not accessible by public crawlers, so the numbers are probably not painting a full picture. It is, however, as close as you can get to the full picture unless every CA is willing to release their internal numbers.

Re: Early Impacts of Let's Encrypt

#16

Post by jonlucc »

toyg wrote: post #13
comex wrote: post #3

Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.

There is always pent-up demand for a previously-expensive service to become free.

There were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.

Re: Early Impacts of Let's Encrypt

#17

Post by scrollaway »

MCRed wrote: post #9

Does anyone know where one can get a free wildcard certificate? Need it for development and foo/bar/baz/biff.example.com change names regularly (they include the hash of the code commit) so I would like to get a *.dev.example.com wildcard cert. (one that won't give warnings that scare the business types who are testing the code, and won't understand what self-signed means.)

You can get sub-€100/year wildcard certs on gandi.net (free the first year for their own domains I think?), which shouldn't be a problem for a business expense.

Re: Early Impacts of Let's Encrypt

#18

Post by toyg »

jonlucc wrote: post #16
toyg wrote: post #13

Earlier quoted context omitted.

There is always pent-up demand for a previously-expensive service to become free.

There were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.

No there were not. Free options meant untrusted certificates or short-lived certificates that could not be renewed.

LE made SSL free, trusted and long-term. You could have made it twice as hard to do the initial setup and people would have jumped at the opportunity regardless.

Re: Early Impacts of Let's Encrypt

#19

Post by IgorPartola »

jonlucc wrote: post #16
toyg wrote: post #13

Earlier quoted context omitted.

There is always pent-up demand for a previously-expensive service to become free.

There were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.

I used to use Wossl and StartSSL before for lots of little personal projects. I recently switched everything over to LE. I am looking forward to switching other projects to it too, such as ones for clients where we had to pay for wildcard certs in the past. Not having to mark the calendar to renew certs every year is going to be really nice.

Incidentally, does anyone have a good way to integrate LE with EC2's load balancers?

Re: Early Impacts of Let's Encrypt

#20

Post by AcidBurn »

MCRed wrote: post #9

Does anyone know where one can get a free wildcard certificate? Need it for development and foo/bar/baz/biff.example.com change names regularly (they include the hash of the code commit) so I would like to get a *.dev.example.com wildcard cert. (one that won't give warnings that scare the business types who are testing the code, and won't understand what self-signed means.)

Other than Amazon Certificate Manager as moatra mentions (which I don't think let's you export the certificate), I don't think there is currently an option for free wildcard certificates.

As an alternative you could incorporate provisioning of a Let's Encrypt certificate for the new subdomain into your deployment process since the process is designed to be automated.

Post reply on HN