Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Early Impacts of Let's Encrypt

tacticalsecret.com

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Early Impacts of Let's Encrypt

#21

Post by pfg »

toyg wrote: post #18
jonlucc wrote: post #16

Earlier quoted context omitted.

There were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.

No there were not. Free options meant untrusted certificates or short-lived certificates that could not be renewed. LE made SSL free, trusted and long-term. You could have made it twice as hard to do the initial setup and people would have jumped at the opportunity regardless.

StartSSL and WoSign have been offering free, publicly trusted certificates with one year lifetimes (and the ability to renew for free) for quite some time.

The former doesn't allow commercial usage, while the latter operates in China. That's probably why it wasn't an option for a lot of people. (That, and the terrible UX at least in StartSSL's case.)

Re: Early Impacts of Let's Encrypt

#22

Post by teh »

toyg wrote: post #13
comex wrote: post #3

Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.

There is always pent-up demand for a previously-expensive service to become free.

For us the free doesn't matter because certificates are cheap. It's the byzantine and insecure process of obtaining a cert (sending us our private cert in a zip in a plain text mail. I mean, really?) that makes LE so great.

Edit: Total brainfart, apologies; The company sending us private info as a zip was a different thing.

Re: Early Impacts of Let's Encrypt

#24

Post by pfg »

teh wrote: post #22
toyg wrote: post #13

Earlier quoted context omitted.

There is always pent-up demand for a previously-expensive service to become free.

For us the free doesn't matter because certificates are cheap. It's the byzantine and insecure process of obtaining a cert (sending us our private cert in a zip in a plain text mail. I mean, really?) that makes LE so great. Edit: Total brainfart, apologies; The company sending us private info as a zip was a different thing.

Your CA should not be in a position to send you your private key. They don't need it in order to sign your certificate. Pretty much every CA I'm aware of allows you to provide your own CSR (which only includes your public key).

Sending the certificate (as opposed to the private key) via email is fine, since that only includes your public key, which is visible to every site visitor anyway.

(I agree that an automated process based on an open, standardized specification is preferable.)

Re: Early Impacts of Let's Encrypt

#26

Post by nailer »

pfg wrote: post #24
teh wrote: post #22

Earlier quoted context omitted.

For us the free doesn't matter because certificates are cheap. It's the byzantine and insecure process of obtaining a cert (sending us our private cert in a zip in a plain text mail. I mean, really?) that makes LE so great. Edit: Total brainfart, apologies; The company sending us private info as a zip was a different thing.

Your CA should not be in a position to send you your private key. They don't need it in order to sign your certificate. Pretty much every CA I'm aware of allows you to provide your own CSR (which only includes your public key). Sending the certificate (as opposed to the private key) via email is fine, since that only includes your public key, which is visible to every site visitor anyway. (I agree that an automated p…

Agreed a thousand percent, but there are services that offer easy installs onto cloud providers that do know your private key - that's how they get it onto your ELB or Heroku.

Re: Early Impacts of Let's Encrypt

#27

Post by wildpeaks »

comex wrote: post #3

Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.

Another interesting stat is that it's mostly domains that didn't have https before.

Re: Early Impacts of Let's Encrypt

#28

Post by sansidentity »

Hypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permissions to even accomplish it without upgrading to something thing like a vps or administering my own vm with a cloud provider. Which is honestly something I am less than interested in doing if I can help it. Keeping a Web server secure is seems brutal to me.

Re: Early Impacts of Let's Encrypt

#29

Post by ralmidani »

Just the other day, we finished a "dry run" deployment of our new app for small businesses on a Digital Ocean droplet running Debian and Apache (our app is Ember and Django). Let's Encrypt was the final step.

We followed the instructions provided by DO[0], and aside from our mistake of leaving a previous attempt as a Virtualhost on port 443, the client just works out-of-the-box.

It automatically detects which file has the Virtualhost for port 80, asks you if you want to force redirect to https, copies your script to a new file with a Virtualhost on port 443 (adding SSL and telling Apache where to find the certs), and enables the site for you. Needless to say, my pair programmer and I were impressed thoroughly.

[0]https://www.digitalocean.com/community/tutorials/how-to-secu...

Re: Early Impacts of Let's Encrypt

#30

Post by suraj »

sansidentity wrote: post #28

Hypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permi…

In the case of library you would want to protect users privacy for searching books. I do not think it is possible to switch to https on shared hosting without explicit action from the provider. For minimal administration, a cloud provider will work best. Check out AWS since they also offer free certificates.
Post reply on HN