Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt has issued its first million certificates

eff.org

Post reply on HN
Print view View original

61–70 of 156 posts

Re: Let's Encrypt has issued its first million certificates

#61

Post by pkaye »

Buge wrote: post #58
pkaye wrote: post #44

How useful is this for a home server where there is no domain name registered? Can it be configured for my local secure web server?

You need a domain name registered. Otherwise what would they issue the certificate for? You could buy a domain though, then have a local dns resolve it to your own machine. Alternatively you could use a self signed cert and sign it to localhost or whatever, then configure all your browsers to trust this certificate.

Is it possible to do without Chrome complaining about the validity of the self signed cert?

Re: Let's Encrypt has issued its first million certificates

#63

Post by currysausage »

IgorPartola wrote: post #39
tallanvor wrote: post #36

Earlier quoted context omitted.

I doubt it. CAs still have EV, wildcard, email, and code signing certificates that are often twice as expensive (or more) than their DV offerings. And some people will choose to pay for a DV cert just so they don't have to swap them out every 3 months anyway.

EV can die a fiery death. It is bullshit. I don't see a reason why LE can't issue wildcards in the future, though with their current setup they are even less important. Email certificates can be issued by LE as well. Code signing is the only one I see as problematic. In either case, I suspect that LE will take a huge bite out of CA's bottom lines, since there are a lot more DV certs out there than EV ones.

Honest question: why is EV bullshit? It's easier for my mom to check for a green bar saying "Bank of America" than to understand the difference between bankofamerica.com and bankofamerica-onlinebanking491.com. EV may not be bulletproof, but it potentially makes some rather popular attacks way harder to execute at scale.

Re: Let's Encrypt has issued its first million certificates

#64

Post by dingaling »

Ao7bei3s wrote: post #5
pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

You're supposed to automate renewal. Since v0.4.0 all it takes is a "letsencrypt renew && apachectl graceful" in a daily cronjob (or, preferably, systemd timer), it handles the rest. Tweak as you like.

Be sure to have a script that checks the results of your cronjobs, though:

"It is possible to hit the rate limit using letsencrypt renew and have it fail or partially fail for that reason."

https://community.letsencrypt.org/t/help-us-test-renewal-wit...

They launched with 90-day expiry but without a robust renewal process.

Re: Let's Encrypt has issued its first million certificates

#65

Post by mapunk »

nly wrote: post #48
michaelt wrote: post #45

Earlier quoted context omitted.

given that LE takes just as much time and effort for initial set-up as a standard multi-year cert I think the LE endgame is that setting up HTTPS will be as easy as setting up SSH - i.e. every server will configure itself right on first launch and keep itself that way. It's just going to take a long time to get there :)

> I think the LE endgame is that setting up HTTPS will be as easy as setting up SSH It already is. Use a self-signed cert and ask your visitors via a side channel to tick the box to add an exception. That's the security model of SSH, and has the same assurances. It's just a terrible comparison. We can do better. A better comparison would be with DNSSEC... The way to simplify TLS deployment, while getting a better lev…

> Use a self-signed cert and ask your visitors via a side channel to tick the box to add an exception.

Don't do this. If you have to ask your users to add an SSL exception you're doing it very wrong.

Re: Let's Encrypt has issued its first million certificates

#66

Post by ChristianBundy »

currysausage wrote: post #59
merpnderp wrote: post #54

Earlier quoted context omitted.

That would be nice, but with it being so easy to get a certificate, you could just add a new SSL cert when you add the new subdomain.

If there only wasn't the limit of 5 certificates per domain per week [1]. [1] https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

When it comes to rate-limiting, example.com and foobar.example.com are treated as completely separate domains.

Re: Let's Encrypt has issued its first million certificates

#67

Post by [deleted] »

currysausage wrote: post #59
merpnderp wrote: post #54

Earlier quoted context omitted.

That would be nice, but with it being so easy to get a certificate, you could just add a new SSL cert when you add the new subdomain.

If there only wasn't the limit of 5 certificates per domain per week [1]. [1] https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

[deleted]

Re: Let's Encrypt has issued its first million certificates

#68

Post by technofiend »

Ao7bei3s wrote: post #19
lrem wrote: post #7

Earlier quoted context omitted.

However, imho, he biggest reason to ever use self signed is that you can set expiry @2099 and it won't degrade anything.

1. You'd have install the custom CA in all devices. Ever tried it on Android? The "network may be monitored" warning doesn't go away. 2. If the certificate is ever compromised, you'll have to keep it in the revocation list forever, or replace the entire CA. (And I hope your CA contains a DNS name restriction.)

>1. You'd have install the custom CA in all devices. Ever tried it on Android? The "network may be monitored" warning doesn't go away.

This is the most annoying part of using certs for Radius authentication with Android. Either you self-sign a cert and forever get these warnings, or you let someone else sign your cert and then that CA can issue device certs for your domain.

Re: Let's Encrypt has issued its first million certificates

#69

Post by nly »

svenfaw wrote: post #43
nly wrote: post #35

Earlier quoted context omitted.

CT doesn't seem that transparent. crt.sh only shows the certificate for one of my domains, despite them all having certs issued by the same CA on the same day. Go figure.

Interesting. Are you comfortable with mentioning the domain name(s) here? And for the record, here is the millionth LE cert in all its glory: https://crt.sh/?id=14392504

> Are you comfortable with mentioning the domain name(s) here?

Not to just anyone, no. The certificates aren't all in service for HTTPS, which might explain some of it, but I don't know.

Re: Let's Encrypt has issued its first million certificates

#70

Post by currysausage »

ChristianBundy wrote: post #66
currysausage wrote: post #59

Earlier quoted context omitted.

If there only wasn't the limit of 5 certificates per domain per week [1]. [1] https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

When it comes to rate-limiting, example.com and foobar.example.com are treated as completely separate domains.

That would be pretty awesome, but it's not how I interpret the following: "This limit measures certificates issued for a given combination of Public Suffix + Domain (a 'registered domain')."

Do you have a source?

Post reply on HN