Let's Encrypt has issued its first million certificates • Hacker News Board

Re: Let's Encrypt has issued its first million certificates

#141

Post by currysausage » Wed, Mar 09, 2016, 12:36 AM UTC

mike_hearn wrote: post #129

IgorPartola wrote: post #120

Earlier quoted context omitted.

Well, for one because EV certs are ridiculously overpriced. Also, EV once again just guarantees that someone somewhere has a credit card and some papers they filed. Can I start a "Bang of America" and get an EV cert for that? Sure I can! (Don't google that). Another example of where I think it's confusing is when EV actually uses the company name. Go to https://lastpass.com/ and take a look at their EV green bar. It…

If you think EV certs are over-priced, then there's a big market opportunity waiting for you: just make a CA that sells them cheaper! In practice, you probably won't do that, because if you look into the various costs EV CAs have, you'll find that the cost of what they're doing is actually non-trivial and it's not exactly a license to print money. Add up the costs of the company, the audits, the hardware to protect t…

> companies whose primary web identities don't match their legal identities

On https://www.washingtonpost.com/, the EV bar reads: "The Washington Post (WP Company Llc)", so there are solutions for that, too.

Re: Let's Encrypt has issued its first million certificates

#142

Post by regecks » Wed, Mar 09, 2016, 12:58 AM UTC

ohitsdom wrote: post #85

I host many small sites on a $10/month shared server with a typical LAMP stack host. Unfortunately, SSH access is limited so I keep running into issues getting Let's Encrypt running. Has anyone else run into any issues? Not looking for step-by-step help, just wondering if I'm alone. I have seen paid software promising to solve this [0], but I'd rather not pay to get a free certificate. [0] https://letsencrypt-for-cpa…

I'm one of the developers of that paid plugin. We developed it primarily for my day job (as a web host, SSL is one of the worst support burdens for us), but it's been really successful for other hosts as well.

The situation certainly sucks for shared hosting customers who do not have access to LE. However, cPanel have stated that they will be delivering the functionality as an out-of-release plugin between 11.56 and 11.58.

If you don't want to pay, I suggest taking a look at one of the dependency-free, root-less tools, such as acmetool[1]. You should be able to plug this into your crontab without any issues. Depends how limited your SSH is, though.

1. https://github.com/hlandau/acme . Great tool. Unfortunately the official Let's Encrypt client tooling is really quite poor. Python was not a good choice (way too many dependencies get pulled, esp. for such a simple ops tool, messed up situation with 2.6/2.7/3.x availability across Linux distros).

Re: Let's Encrypt has issued its first million certificates

#143

Post by labster » Wed, Mar 09, 2016, 1:23 AM UTC

metachris wrote: post #55

XorNot wrote: post #27

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

acme-tiny is another good and simple client, which I personally prefer. I've recently compared 10 different Let's Encrypt / ACME clients: https://www.metachris.com/2015/12/comparison-of-10-acme-lets...

In your review, whenever I click a "show output" link, it navigates to another page containing only "[object Object]". Can you change the href to be an onclick attribute or something like that?

Re: Let's Encrypt has issued its first million certificates

#144

Post by technion » Wed, Mar 09, 2016, 2:23 AM UTC

deepnet wrote: post #121

StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

And hosting companies selling certs are incentivised to not provide HTTPS by default. The number of not https wordpress admin pages and plain text ftp logins still in regular use is chilling and directly attributable to this misaligned incentive.

There's an oft-neglected issue with this. From experience, when a hosting company supplies an SSL certificate to a customer, here's the usual process. The first thing that happens is the site totally breaks because browsers won't render mixed content.

So the customer calls their developer and their developer calls the host and insists it's a server problem and someone spends an hour or more explaining what mixed content is to a developer and how to fix it.

Then someone runs it through the SSLLabs test and decides they don't like seeing RC4 supported. So you provide some warnings regarding it, confirm, and then oblige, but then you get angry, aggressive emails because their entire office uses Windows XP and their website doesn't work.

A company can burn hours on every individual SSL deployment. There's plenty of unfortunate incentives against hosting companies.

Re: Let's Encrypt has issued its first million certificates

#145

Post by technion » Wed, Mar 09, 2016, 2:30 AM UTC

warrenm wrote: post #132

pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

>"automating it is not an option in my use case" Then you're doing it wrong - there is no reason you shouldn't be able to automate it that I can envision

There are valid scenarios. Placing a certificate on something like an F5 or Citrix VPX appliance pretty well forces you down the email verification route.

Then you've got those appliances that take a power cycle and 30 minute outage to install such a certificate. Five year certs are very attractive for this situation.

Re: Let's Encrypt has issued its first million certificates

#146

Post by Sodel » Wed, Mar 09, 2016, 3:33 AM UTC

First of all, I love this.

One nagging thing in my mind, though, is how easy it seems it would be for a Three-Letter Agency to backdoor LE to pieces. Then again, I guess that's nearly just as true for any CA out there.

(I don't mean to pooh-pooh this useful service! And, if there's any interloper-mitigation going on that I don't know about, I'd be happily put straight!)

Re: Let's Encrypt has issued its first million certificates

#147

Post by aidenn0 » Wed, Mar 09, 2016, 4:57 AM UTC

lucb1e wrote: post #101

pfg wrote: post #99

Earlier quoted context omitted.

According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// as unsafe in the UI, I don't think that decision is going to change. [1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/

Well there is a difference between unsigned encrypted and unencrypted, I'm not saying marking http:// as unsafe implies that they'll always regard unsigned encrypted as completely unprotected, especially with closed source browsers (or browsers where development is a closed process). Thanks for all the information though! :)

From the point of view of an active MITM attack there is no difference between unsigned encrypted and unencrypted.

Re: Let's Encrypt has issued its first million certificates

#148

Post by tokenizerrr » Wed, Mar 09, 2016, 8:32 AM UTC

nly wrote: post #37

tokenizerrr wrote: post #31

Earlier quoted context omitted.

What are you talking about? My nginx ssl config is static as well. It looks at a specific path for my certs, which just happens to be a symlink managed my by letsencrypt tooling. You're going to have to renew anyway. Previously you would have to remember to do that once a year, or maybe once every two years. Now let's ignore the security implications of having certificates that are valid for a year for a moment, and…

"Once" assuming nothing randomly breaks while you're not looking. What if your cronjob doesn't fire? What if LEs script has a bug and you're not up to date? What if one of the (Python?) dependencies has a bug or breaks? What if LEs servers are being DDoS'd? Can you enumerate and account for all the failure scenarios? I've already botched things with acme-tiny&LE in several different ways. I'm not claiming these risks…

Nagios will tell me when my certificate is a month within expiring. This is a standard nagios plugin. The cronjob runs nightly, checks if renewal is necessary (once a month, certificates valid for 3 months, so will renew when 2 months are still left) and then does its thing.

Re: Let's Encrypt has issued its first million certificates

#149

Post by Ayaz » Wed, Mar 09, 2016, 9:29 AM UTC

zemanel wrote: post #83

Ayaz wrote: post #17

Earlier quoted context omitted.

> I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. Absolutely! Every time I had to create a CSR and install an SSL certificate on a server (having done it b…

I've wondered if this issue could have been solved a long time ago by commercial companies (the way LetsEncrypt solves it or similar), it just wasn't as good business :-)

I'd imagine so. I also like the approach that Amazon has taken with its recently launched AWS Certificate Manager. You can create as many SSL certificates as you like free of cost, even wild-card ones (which if I am correct Let's Encrypt does not support yet), and the AWS Certificate Manager takes care of the rest. The only restrictions, off the top of what I've read, are: 1) You have to be using the AWS infrastructure; b) You'd have to use their load balancer or CDN solutions, against which the certificates are placed.

Re: Let's Encrypt has issued its first million certificates

#150

Post by nickik » Wed, Mar 09, 2016, 12:56 PM UTC

igravious wrote: post #116

Super! Just set up my first secure website with Nginx. Absolutely simple. Literally the only way it could have been easier is if letsencrypt had been installed on my Centos 6.7 box but it was only a `git clone' away. --- 1) Stop the web server. 2) ./letsencrypt-auto certonly --standalone -d _my_domain1_ -d _my_domain2_ ... At the curses prompt give it your contact email address, and accept the licence 3) Edit nginx.c…

I had no experiance with Nginx and doing the 80-443 redirct was pretty simple.

server { listen 80; listen [::]:80 ipv6only=on; server_name www.mydomain.com; return 301 https://$server_name$request_uri; }