Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Early Impacts of Let's Encrypt

tacticalsecret.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: Early Impacts of Let's Encrypt

#71

Post by schoen »

bogus- wrote: post #50
TazeTSchnitzel wrote: post #25

Earlier quoted context omitted.

The CLI version of the LE client is pretty simple to use. Literally one command line.

Yes, it's almost too convenient. Lazy me is still slightly miffed that auto nginx is not fully supported, however.

Sorry for the delay. It's turned out that parsing is hard, especially in the absence of a formal grammar for configuration file formats!

If you don't need the certs automatically installed, nginx users are generally doing well with the webroot plugin (which automatically creates files to perform the ACME challenge, regardless of what webserver is serving those files). This will also work for renewal, as long as you're able to do the initial configuration of your nginx to work with the certs you get.

Re: Early Impacts of Let's Encrypt

#72

Post by sandGorgon »

sansidentity wrote: post #28

Hypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permi…

while I agree with the importance of TLS and SSL for everyone , I do recommend buying a SSL straightup (about 8$ a year) and not going through the commandline setup unless you are comfortable. Most hosting services (especially the cpanel variety) just let you upload a certificate that you have bought.

It is probably more important that you do TLS/SSL than not do it because you are uncomfortable with Letsencrypt setup

here's the one I buy - https://www.ssls.com/ssl-certificates/geotrust-rapidssl

Re: Early Impacts of Let's Encrypt

#73

Post by rckclmbr »

toupeira wrote: post #51
MCRed wrote: post #9

Does anyone know where one can get a free wildcard certificate? Need it for development and foo/bar/baz/biff.example.com change names regularly (they include the hash of the code commit) so I would like to get a *.dev.example.com wildcard cert. (one that won't give warnings that scare the business types who are testing the code, and won't understand what self-signed means.)

If it's just for local development, you can make a self-signed certificate and add it as trusted to your browser(s).

To anyone wondering, this is also what the "big boys" do, so dont feel like this is a hack. Most big companies have their own company root CA, and install that cert on their company computers. They then have all internal apps use a cert signed with that root CA (or derivative thereof)

Re: Early Impacts of Let's Encrypt

#74

Post by detaro »

x0 wrote: post #57
AcidBurn wrote: post #20

Earlier quoted context omitted.

Other than Amazon Certificate Manager as moatra mentions (which I don't think let's you export the certificate), I don't think there is currently an option for free wildcard certificates. As an alternative you could incorporate provisioning of a Let's Encrypt certificate for the new subdomain into your deployment process since the process is designed to be automated.

Not if you have more than five subdomains, you have to wait for a week, like me.

... if you need a different certificate for each subdomain. You are limited to 5 certificates per domain per week, each of which can be valid for many subdomains. Bad if you want to be able to add them dynamically every time a new name comes up, but if it is a static set...

Re: Early Impacts of Let's Encrypt

#75

Post by zorked »

rckclmbr wrote: post #73
toupeira wrote: post #51

Earlier quoted context omitted.

If it's just for local development, you can make a self-signed certificate and add it as trusted to your browser(s).

To anyone wondering, this is also what the "big boys" do, so dont feel like this is a hack. Most big companies have their own company root CA, and install that cert on their company computers. They then have all internal apps use a cert signed with that root CA (or derivative thereof)

And that's how the CA system is actually supposed to work. You add to the trust store those entities you trust rather than those that are trusted by the browser makers...

Re: Early Impacts of Let's Encrypt

#76

Post by tacticus »

toupeira wrote: post #51
MCRed wrote: post #9

Does anyone know where one can get a free wildcard certificate? Need it for development and foo/bar/baz/biff.example.com change names regularly (they include the hash of the code commit) so I would like to get a *.dev.example.com wildcard cert. (one that won't give warnings that scare the business types who are testing the code, and won't understand what self-signed means.)

If it's just for local development, you can make a self-signed certificate and add it as trusted to your browser(s).

I've been thinking about grabbing the last release of ngrok and some internal setup of lets encrypt or just wildcard to run something like that.

Re: Early Impacts of Let's Encrypt

#77

Post by forlorn »

It doesnt support browsers in Windows XP and it is the only annoying thing which forced me to rollback letsencrypt. I know it is 2016 but complaining clients is not what you want anyway.

I still have no idea if they are able to fix this in future.

Re: Early Impacts of Let's Encrypt

#78

Post by mehrdada »

toyg wrote: post #18
jonlucc wrote: post #16

Earlier quoted context omitted.

There were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.

No there were not. Free options meant untrusted certificates or short-lived certificates that could not be renewed. LE made SSL free, trusted and long-term. You could have made it twice as hard to do the initial setup and people would have jumped at the opportunity regardless.

While I agree LetsEncrypt is awesome, the certificates are actually shorter-lived (90 days), I believe, than the former CAs that issued certs for free (e.g. StartSSL) that offered a year of validity. The rationale is replacing the keys sooner since you can easily do it automatically with LE.

Re: Early Impacts of Let's Encrypt

#79

Post by mehrdada »

beefhash wrote: post #70
_ak wrote: post #45

Earlier quoted context omitted.

StartSSL isn't free. They charge for certificate revocation.

Furthermore, their free certificates cannot be used for commercial purposes.

I don't know why your comment is downvoted -- this is acutally a legitimate issue mentioned in their terms of service.

Re: Early Impacts of Let's Encrypt

#80

Post by onuras »

forlorn wrote: post #77

It doesnt support browsers in Windows XP and it is the only annoying thing which forced me to rollback letsencrypt. I know it is 2016 but complaining clients is not what you want anyway. I still have no idea if they are able to fix this in future.

I installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.
Post reply on HN