Let's Encrypt has issued its first million certificates • Hacker News Board

Re: Let's Encrypt has issued its first million certificates

#111

Post by ris » Tue, Mar 08, 2016, 7:49 PM UTC

r0muald wrote: post #46

IgorPartola wrote: post #39

Earlier quoted context omitted.

EV can die a fiery death. It is bullshit. I don't see a reason why LE can't issue wildcards in the future, though with their current setup they are even less important. Email certificates can be issued by LE as well. Code signing is the only one I see as problematic. In either case, I suspect that LE will take a huge bite out of CA's bottom lines, since there are a lot more DV certs out there than EV ones.

Yeah, wildcards are a necessity when every certificate is difficult to obtain, but LE really means we hit post-scarcity and certificates can be issued on the fly for new domains and subdomains.

To an extent - LE still has rate limits for the number of certificates issued to a second level domain (5 in 7 days currently), so if you have many subdomains it could conceivably become unmanageable to keep them all updated.

Re: Let's Encrypt has issued its first million certificates

#112

Post by ris » Tue, Mar 08, 2016, 7:50 PM UTC

ChristianBundy wrote: post #66

currysausage wrote: post #59

Earlier quoted context omitted.

If there only wasn't the limit of 5 certificates per domain per week [1]. [1] https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

When it comes to rate-limiting, example.com and foobar.example.com are treated as completely separate domains.

This is not true. I know from experience.

See the first point in https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

Re: Let's Encrypt has issued its first million certificates

#113

Post by ris » Tue, Mar 08, 2016, 7:52 PM UTC

Ao7bei3s wrote: post #5

pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

You're supposed to automate renewal. Since v0.4.0 all it takes is a "letsencrypt renew && apachectl graceful" in a daily cronjob (or, preferably, systemd timer), it handles the rest. Tweak as you like.

Since v0.4.0 all it takes is a "letsencrypt renew && apachectl graceful" in a daily cronjob"

I'm glad your setup is so simple.

Re: Let's Encrypt has issued its first million certificates

#114

Post by jamesblonde » Tue, Mar 08, 2016, 7:53 PM UTC

veeti wrote: post #56

XorNot wrote: post #27

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

In case anybody didn't know, there are already over 10 alternative clients. There should be something for everyone: https://community.letsencrypt.org/t/list-of-client-implement...

Still waiting on a Glassfish or Wildfly client. We managed to wrangle the standalone client to generate a certficate that can be used by glassfish, but it's not pretty. See the code here: https://github.com/hopshadoop/hopsworks-chef/blob/master/rec...

Re: Let's Encrypt has issued its first million certificates

#115

Post by joepie91_ » Tue, Mar 08, 2016, 7:54 PM UTC

zemanel wrote: post #83

Ayaz wrote: post #17

Earlier quoted context omitted.

> I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. Absolutely! Every time I had to create a CSR and install an SSL certificate on a server (having done it b…

I've wondered if this issue could have been solved a long time ago by commercial companies (the way LetsEncrypt solves it or similar), it just wasn't as good business :-)

SSLMate has been doing that for a while.

Re: Let's Encrypt has issued its first million certificates

#116

Post by igravious » Tue, Mar 08, 2016, 8:14 PM UTC

Super! Just set up my first secure website with Nginx.

Absolutely simple. Literally the only way it could have been easier is if letsencrypt had been installed on my Centos 6.7 box but it was only a `git clone' away.

---

1) Stop the web server.

2) ./letsencrypt-auto certonly --standalone -d _my_domain1_ -d _my_domain2_ ... At the curses prompt give it your contact email address, and accept the licence

3) Edit nginx.conf - Change all listen 80s to listen 443s. Add the following commands

   ssl_certificate /etc/letsencrypt/live/_my_domain_/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/_my_domain_/privkey.pem;

   # bump up protection

   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_prefer_server_ciphers on;
   ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

4) Start the web server

5) Doh! Go through website changing hardcoded http:// links to protocol (scheme) relative links // See here: https://www.paulirish.com/2010/the-protocol-relative-url/

6) Restart the web server

---

Ok. It's doesn't seem that simple now that I say it but it was easier than wrestling with Apache and rewrite rules :)

Re: Let's Encrypt has issued its first million certificates

#117

Post by comex » Tue, Mar 08, 2016, 8:16 PM UTC

nly wrote: post #81

icebraining wrote: post #77

Earlier quoted context omitted.

The symmetries between DNSSEC and LetsEncrypt are striking. Your account key is your KSK. Your cert is your ZSK... but instead of your webserver (in DNSSEC, your DNS server) doing rollover for you, you're depending on a pile of scripts, leaning on an already insecure DNS, and setting it up is still, comparatively, a pita. As the Caddy server linked in another comment shows, nothing in LE requires you to depend on a "…

Yes, there will be products to make this simpler, but the point is, unless you are willing to grant LetsEncrypt a DV cert monopoly, to the exclusion of all others (or at least those not compatible with their API), then, in general, it can never be as easy as just turning it on. DNSSEC puts the CA monopoly in the DNS. There is no API for a hypothetical web server using DANE, because there's no need for periodic domain…

Since LetsEncrypt's API protocol is being standardized through the IETF (https://tools.ietf.org/html/draft-ietf-acme-acme), there's no reason any new competing free certificate providers can't be compatible with it. In the long term, if more show up (and I wouldn't be surprised if some existing CAs refocus their business on EV and start offering free DV certs through ACME), I see no problem with software giving the protocol a "monopoly", in the sense of building in auto-configuration support for it.

Re: Let's Encrypt has issued its first million certificates

#118

Post by kn9 » Tue, Mar 08, 2016, 8:17 PM UTC

Certify for Windows IIS with autorenewal https://certify.webprofusion.com/

Re: Let's Encrypt has issued its first million certificates

#119

Post by Nullabillity » Tue, Mar 08, 2016, 8:41 PM UTC

ultramancool wrote: post #103

nly wrote: post #29

Earlier quoted context omitted.

I personally find the hassle of installing, configuring and, crucially, testing , both LetsEncrypts scripts, and an accompanying cronjob, much more work and worry than a static nginx ssl config.

I'm in the same boat - especially because I need wildcard certificates (or just lots of certs). I'm thinking the only thing that would really fix this is an nginx module that would automatically fetch certificates for domains when they're first requested via SNI. First hit takes some time, then it's cached and refreshed once a month or something... it would effectively mean 0 configuration SSL for all new domains.

Wouldn't work, sadly you're limited to 5 requests per apex per week.

Re: Let's Encrypt has issued its first million certificates

#120

Post by IgorPartola » Tue, Mar 08, 2016, 8:57 PM UTC

currysausage wrote: post #63

IgorPartola wrote: post #39

Earlier quoted context omitted.

EV can die a fiery death. It is bullshit. I don't see a reason why LE can't issue wildcards in the future, though with their current setup they are even less important. Email certificates can be issued by LE as well. Code signing is the only one I see as problematic. In either case, I suspect that LE will take a huge bite out of CA's bottom lines, since there are a lot more DV certs out there than EV ones.

Honest question: why is EV bullshit? It's easier for my mom to check for a green bar saying "Bank of America" than to understand the difference between bankofamerica.com and bankofamerica-onlinebanking491.com. EV may not be bulletproof, but it potentially makes some rather popular attacks way harder to execute at scale.

Well, for one because EV certs are ridiculously overpriced. Also, EV once again just guarantees that someone somewhere has a credit card and some papers they filed. Can I start a "Bang of America" and get an EV cert for that? Sure I can! (Don't google that).

Another example of where I think it's confusing is when EV actually uses the company name. Go to https://lastpass.com/ and take a look at their EV green bar. It says "LogMeIn, Inc [US]" and before it said "Marvasol". Neither of them says "LastPass" which is what I actually want to know. If the company name behind your product is not as widely known as your product, oops, you just scared your customer.

Basically, it's a hard problem: you are asking CA's to make the distinction between names that may be similar, and therefore used for fraud, vs distinct and used for legitimate purposes.