Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt has issued its first million certificates

eff.org

Post reply on HN
Print view View original

81–90 of 156 posts

Re: Let's Encrypt has issued its first million certificates

#81

Post by nly »

icebraining wrote: post #77
nly wrote: post #48

Earlier quoted context omitted.

> I think the LE endgame is that setting up HTTPS will be as easy as setting up SSH It already is. Use a self-signed cert and ask your visitors via a side channel to tick the box to add an exception. That's the security model of SSH, and has the same assurances. It's just a terrible comparison. We can do better. A better comparison would be with DNSSEC... The way to simplify TLS deployment, while getting a better lev…

The symmetries between DNSSEC and LetsEncrypt are striking. Your account key is your KSK. Your cert is your ZSK... but instead of your webserver (in DNSSEC, your DNS server) doing rollover for you, you're depending on a pile of scripts, leaning on an already insecure DNS, and setting it up is still, comparatively, a pita. As the Caddy server linked in another comment shows, nothing in LE requires you to depend on a "…

Yes, there will be products to make this simpler, but the point is, unless you are willing to grant LetsEncrypt a DV cert monopoly, to the exclusion of all others (or at least those not compatible with their API), then, in general, it can never be as easy as just turning it on.

DNSSEC puts the CA monopoly in the DNS. There is no API for a hypothetical web server using DANE, because there's no need for periodic domain validation. Of course, DNSSEC is a disaster, so it's a non-starter... but I'm still going to lament the fact that everything is terrible.

Re: Let's Encrypt has issued its first million certificates

#83

Post by zemanel »

Ayaz wrote: post #17
StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

> I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. Absolutely! Every time I had to create a CSR and install an SSL certificate on a server (having done it b…

I've wondered if this issue could have been solved a long time ago by commercial companies (the way LetsEncrypt solves it or similar), it just wasn't as good business :-)

Re: Let's Encrypt has issued its first million certificates

#84

Post by superkuh »

LE is okay but the 90 day limit puts me off. It's so much easier to do a self-signed for 10 years. The problem with self-signed certs isn't intrinsic to them, it's a problem with browsers scaremongering for the lowest common denominator.

For my mail server which only I use, my websites which only technical people visit, etc, there's no reason to deal with the hassle of LE.

Re: Let's Encrypt has issued its first million certificates

#85

Post by ohitsdom »

I host many small sites on a $10/month shared server with a typical LAMP stack host. Unfortunately, SSH access is limited so I keep running into issues getting Let's Encrypt running. Has anyone else run into any issues? Not looking for step-by-step help, just wondering if I'm alone.

I have seen paid software promising to solve this [0], but I'd rather not pay to get a free certificate.

[0] https://letsencrypt-for-cpanel.com/

Re: Let's Encrypt has issued its first million certificates

#86

Post by menacingly »

superkuh wrote: post #84

LE is okay but the 90 day limit puts me off. It's so much easier to do a self-signed for 10 years. The problem with self-signed certs isn't intrinsic to them, it's a problem with browsers scaremongering for the lowest common denominator. For my mail server which only I use, my websites which only technical people visit, etc, there's no reason to deal with the hassle of LE.

Absolutely. Browser warnings actually make it sound like unencrypted connections are preferable.

Re: Let's Encrypt has issued its first million certificates

#87

Post by haroldp »

nacs wrote: post #57
ngrilly wrote: post #40

I hope that Let's Encrypt will be able to issue wildcard certificates at some point.

I believe you can add 100 subdomains to an LE certificate which gets you pretty close to a wildcard IMO (if you have over 100 subdomains then buying a real wildcard cert is probably a negligible cost for your service).

This is not quite right. You can pack up to 100 hostnames into ONE cert. That might be useful if you are trying to avoid SNI issues on a single shared IP address.

However, you are limited to five subdomain registrations or renewals per seven day window. Since certs are only good for 90 days, you are effectively limited to 60 or so, and that only if you do some crazy timing acrobatics, carefully spread the registrations out over the full 90 days and never make a mistake.

So I would say, at this point, LE is not an effective replacement for a wildcard cert for many people.

Scroll down to "Rate Limits": https://community.letsencrypt.org/t/quick-start-guide/1631

Re: Let's Encrypt has issued its first million certificates

#88

Post by nuxi7 »

metachris wrote: post #55
XorNot wrote: post #27

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

acme-tiny is another good and simple client, which I personally prefer. I've recently compared 10 different Let's Encrypt / ACME clients: https://www.metachris.com/2015/12/comparison-of-10-acme-lets...

I forked acme-tiny the other day and replaced http-01 with dns-01. The dns-01 implementation is pretty simple and crude for now, I'll probably add dynamic dns update support at some point. All it does is print the records out and wait for you to add them manually.

https://github.com/nuxi/acme-tiny

For now I've just done enough to get a cert for a mail server.

Re: Let's Encrypt has issued its first million certificates

#89

Post by ygjb »

zemanel wrote: post #83
Ayaz wrote: post #17

Earlier quoted context omitted.

> I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. Absolutely! Every time I had to create a CSR and install an SSL certificate on a server (having done it b…

I've wondered if this issue could have been solved a long time ago by commercial companies (the way LetsEncrypt solves it or similar), it just wasn't as good business :-)

Heh. If the CAs had done this ages ago the cost of certs would have collapsed. I can't help but think that collusion between the CAs was a regular thing to prevent something like LE from happening in order to prevent the business model from souring.

Re: Let's Encrypt has issued its first million certificates

#90

Post by sbierwagen »

Ayaz wrote: post #17
StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

> I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. Absolutely! Every time I had to create a CSR and install an SSL certificate on a server (having done it b…

Certsimple does autorenewal.

https://certsimple.com/

Post reply on HN