Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt has issued its first million certificates

eff.org

Post reply on HN
Print view View original

51–60 of 156 posts

Re: Let's Encrypt has issued its first million certificates

#51

Post by jpablo »

Ao7bei3s wrote: post #9
throwaway7767 wrote: post #6

Earlier quoted context omitted.

Yes. I think they do that on purpose to get people to automate the certificate renewal. Their default client of course messes with all sorts of configuration to make auto-renew work "out of the box". Many people (myself included) aren't fans of their client getting so much access, but there are other clients out there that don't need it. I use acme-tiny[0] in a small shell cronjob once a month. It lets acme-tiny requ…

Stop spreading FUD: it does not "mess with all sorts of configuration". _Renewal doesn't touch any config files at all._ "letsencrypt-auto" puts the certs/keys under /etc/letsencrypt/keys. On renewal, new files get added. Old files are never touched. /etc/letsencrypt/live contains symlinks to the most recent files. Your webserver config uses these => its config does not need to be changed for renewal. What you're tal…

I don't think its fud. Calling apt-get is just crazy on my view.

Re: Let's Encrypt has issued its first million certificates

#52

Post by akerro »

StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

I tried to get SSL cert for my fathers company and different kinds of certificates just scared me. Do you know there is a kind of cert where you need to go in person with your ID and register yourself? I'm currently using LE for 6 domains, 2 of them joined as first 100 LE domains, before LE was supported by Ubuntu.

Re: Let's Encrypt has issued its first million certificates

#53

Post by Vespasian »

ceejayoz wrote: post #20
Ao7bei3s wrote: post #9

Earlier quoted context omitted.

Stop spreading FUD: it does not "mess with all sorts of configuration". _Renewal doesn't touch any config files at all._ "letsencrypt-auto" puts the certs/keys under /etc/letsencrypt/keys. On renewal, new files get added. Old files are never touched. /etc/letsencrypt/live contains symlinks to the most recent files. Your webserver config uses these => its config does not need to be changed for renewal. What you're tal…

> Stop spreading FUD: it does not "mess with all sorts of configuration". It does more than you'd expect, IMO. > letsencrypt-auto is a wrapper which installs some dependencies from your OS standard package repositories (e.g. using apt-get or yum), and for other dependencies it sets up a virtualized Python environment with packages downloaded from PyPI. http://letsencrypt.readthedocs.org/en/latest/using.html I was cer…

As said by others if you run it with certonly it doesn't touch the config at all. My cronjob contains a

path/to/letsencrypt-auto certonly --webroot --renew-by-default -w /var/www/letsencrypt/ -d example.com

and puts the signed certificates into /etc/letsencrypt/live/excample.com/fullchain.pem . This is followed by a service nginx reload

I did not trust their automatic configuration as well so I simply configured nginx to use the keys + cert and to serve .well-known/acme from /var/www/letsencrypt/ for all my domains.

That's all. It works quite fine and if something does not work (e.g. python breaks.) such that the renewal is unsuccessful. LE will send you an email in advance (I think 30 days) so you have plenty of time to look after it.

Re: Let's Encrypt has issued its first million certificates

#55

Post by metachris »

XorNot wrote: post #27

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

acme-tiny is another good and simple client, which I personally prefer.

I've recently compared 10 different Let's Encrypt / ACME clients: https://www.metachris.com/2015/12/comparison-of-10-acme-lets...

Re: Let's Encrypt has issued its first million certificates

#56

Post by veeti »

XorNot wrote: post #27

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

In case anybody didn't know, there are already over 10 alternative clients. There should be something for everyone:

https://community.letsencrypt.org/t/list-of-client-implement...

Re: Let's Encrypt has issued its first million certificates

#57

Post by nacs »

ngrilly wrote: post #40

I hope that Let's Encrypt will be able to issue wildcard certificates at some point.

I believe you can add 100 subdomains to an LE certificate which gets you pretty close to a wildcard IMO (if you have over 100 subdomains then buying a real wildcard cert is probably a negligible cost for your service).

Re: Let's Encrypt has issued its first million certificates

#58

Post by Buge »

pkaye wrote: post #44

How useful is this for a home server where there is no domain name registered? Can it be configured for my local secure web server?

You need a domain name registered. Otherwise what would they issue the certificate for? You could buy a domain though, then have a local dns resolve it to your own machine.

Alternatively you could use a self signed cert and sign it to localhost or whatever, then configure all your browsers to trust this certificate.

Re: Let's Encrypt has issued its first million certificates

#59

Post by currysausage »

merpnderp wrote: post #54
ngrilly wrote: post #40

I hope that Let's Encrypt will be able to issue wildcard certificates at some point.

That would be nice, but with it being so easy to get a certificate, you could just add a new SSL cert when you add the new subdomain.

If there only wasn't the limit of 5 certificates per domain per week [1].

[1] https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

Re: Let's Encrypt has issued its first million certificates

#60

Post by wcoenen »

pkaye wrote: post #44

How useful is this for a home server where there is no domain name registered? Can it be configured for my local secure web server?

You mean getting a CA-issued certificate for a host name like "myfileserver", without a domain name? No, if that were allowed, you could use that globally trusted certificate to go play man-in-the-middle on somebody else's network which also happens to have a "myfileserver".

In general, certificate authorities should only issue certificates with unambiguous subjects.

Of course, if you don't need a certificate that is automatically trusted by everyone, then you can still generate a certificate yourself, without the help of a Let's Encrypt or any other CA. You would have to configure the machines on your network to trust it though.

Post reply on HN