Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt has issued its first million certificates

eff.org

Post reply on HN
Print view View original

31–40 of 156 posts

Re: Let's Encrypt has issued its first million certificates

#31

Post by tokenizerrr »

nly wrote: post #29
StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

I personally find the hassle of installing, configuring and, crucially, testing , both LetsEncrypts scripts, and an accompanying cronjob, much more work and worry than a static nginx ssl config.

What are you talking about? My nginx ssl config is static as well. It looks at a specific path for my certs, which just happens to be a symlink managed my by letsencrypt tooling.

You're going to have to renew anyway. Previously you would have to remember to do that once a year, or maybe once every two years. Now let's ignore the security implications of having certificates that are valid for a year for a moment, and just focus on the actual work. Every year, you have to request a new certificate, wait for your certificate authority, upload the new certificate to the server, reload your webserver, check if everything works.

With LE, you do all of that once. You set up the tooling and the cronjob once. You make sure it works once. And you're done. No more hassle.

Re: Let's Encrypt has issued its first million certificates

#32

Post by rev_bird »

_qhtn wrote: post #23
kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to. So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification. EDIT: I am very wrong.

To be fair, with LE you do need to verify you're requesting the cert from the domain for which you're requesting it, so there's some validation. It would be really difficult (for me, impossible) to get a Let's Encrypt cert for, say, wellsfargo.com. It's not one of the fancy CV certs like at https://www.grc.com/intro.htm, but they're the same certs Amazon.com uses.

Re: Let's Encrypt has issued its first million certificates

#33

Post by detaro »

throwaway7767 wrote: post #11
Ao7bei3s wrote: post #9

Earlier quoted context omitted.

Stop spreading FUD: it does not "mess with all sorts of configuration". _Renewal doesn't touch any config files at all._ "letsencrypt-auto" puts the certs/keys under /etc/letsencrypt/keys. On renewal, new files get added. Old files are never touched. /etc/letsencrypt/live contains symlinks to the most recent files. Your webserver config uses these => its config does not need to be changed for renewal. What you're tal…

It wasn't intended to be FUD. The letsencrypt client needs to change the configuration of other services. This is a fact. Not everyone is happy about that, so I pointed out an alternative. If you're happy with the official client, by all means, use it! There's nothing inherently wrong with that approach, it's just not compatible with the way I and some others prefer to do things. EDIT in response to your edit: > And…

> The letsencrypt client needs to change the configuration of other services. This is a fact. Not everyone is happy about that, so I pointed out an alternative.

No, it doesn't NEED to. It's the most commonly discussed option, but it is not necessary. It can do the exact same "write to a folder in the webroot" mode most of the alternatives use.

(I'm not saying that there is no reason to use an alternative client, but that's not it)

Re: Let's Encrypt has issued its first million certificates

#34

Post by [deleted] »

ceejayoz wrote: post #20
Ao7bei3s wrote: post #9

Earlier quoted context omitted.

Stop spreading FUD: it does not "mess with all sorts of configuration". _Renewal doesn't touch any config files at all._ "letsencrypt-auto" puts the certs/keys under /etc/letsencrypt/keys. On renewal, new files get added. Old files are never touched. /etc/letsencrypt/live contains symlinks to the most recent files. Your webserver config uses these => its config does not need to be changed for renewal. What you're tal…

> Stop spreading FUD: it does not "mess with all sorts of configuration". It does more than you'd expect, IMO. > letsencrypt-auto is a wrapper which installs some dependencies from your OS standard package repositories (e.g. using apt-get or yum), and for other dependencies it sets up a virtualized Python environment with packages downloaded from PyPI. http://letsencrypt.readthedocs.org/en/latest/using.html I was cer…

[deleted]

Re: Let's Encrypt has issued its first million certificates

#35

Post by nly »

Sir_Cmpwn wrote: post #26

Given that LE does certificate transparency, would it be possible to find out what their millionth certificate was?

CT doesn't seem that transparent. crt.sh only shows the certificate for one of my domains, despite them all having certs issued by the same CA on the same day. Go figure.

Re: Let's Encrypt has issued its first million certificates

#36

Post by tallanvor »

kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

I doubt it. CAs still have EV, wildcard, email, and code signing certificates that are often twice as expensive (or more) than their DV offerings. And some people will choose to pay for a DV cert just so they don't have to swap them out every 3 months anyway.

Re: Let's Encrypt has issued its first million certificates

#37

Post by nly »

tokenizerrr wrote: post #31
nly wrote: post #29

Earlier quoted context omitted.

I personally find the hassle of installing, configuring and, crucially, testing , both LetsEncrypts scripts, and an accompanying cronjob, much more work and worry than a static nginx ssl config.

What are you talking about? My nginx ssl config is static as well. It looks at a specific path for my certs, which just happens to be a symlink managed my by letsencrypt tooling. You're going to have to renew anyway. Previously you would have to remember to do that once a year, or maybe once every two years. Now let's ignore the security implications of having certificates that are valid for a year for a moment, and…

"Once" assuming nothing randomly breaks while you're not looking. What if your cronjob doesn't fire? What if LEs script has a bug and you're not up to date? What if one of the (Python?) dependencies has a bug or breaks? What if LEs servers are being DDoS'd? Can you enumerate and account for all the failure scenarios? I've already botched things with acme-tiny&LE in several different ways.

I'm not claiming these risks are that significant, but given that LE takes just as much time and effort for initial set-up as a standard multi-year cert, if not more, I think the mantra "some risk of failure is more risk of failure than no risk of failure" is something worth baring in mind.

And I'm not convinced having 90 day certs is a huge security win. Not only can someone do a lot of damage in 90 days, but your private key (the important bit) can't be rolled every 90 days anyway without integrating your rollover scripts with your HPKP config. If you botch that then your visitors can't come back to your website until the pin expires. Scary. Site ending scary. And if you're not using HPKP then i'm not even going to debate the security pros and cons.

On remembering to renew certs... there are many many services out there to send you reminders. Pick 2 or 3 and use them all. Or use a CA that sends reminders.

I'm glad LetsEncrypt exists, but let's not treat it like the be-all-and-end-all.

Re: Let's Encrypt has issued its first million certificates

#38

Post by nzoschke »

XorNot wrote: post #27

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

Thanks for sharing your experience here, I'll go straight to lego when I go to set it up. It's hard to beat the simplicity of a Go binary for system tools like this.

Re: Let's Encrypt has issued its first million certificates

#39

Post by IgorPartola »

tallanvor wrote: post #36
kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

I doubt it. CAs still have EV, wildcard, email, and code signing certificates that are often twice as expensive (or more) than their DV offerings. And some people will choose to pay for a DV cert just so they don't have to swap them out every 3 months anyway.

EV can die a fiery death. It is bullshit. I don't see a reason why LE can't issue wildcards in the future, though with their current setup they are even less important. Email certificates can be issued by LE as well. Code signing is the only one I see as problematic.

In either case, I suspect that LE will take a huge bite out of CA's bottom lines, since there are a lot more DV certs out there than EV ones.

Post reply on HN