Let's Encrypt has issued its first million certificates • Hacker News Board

Re: Let's Encrypt has issued its first million certificates

#151

Post by metachris » Wed, Mar 09, 2016, 3:17 PM UTC

labster wrote: post #143

metachris wrote: post #55

Earlier quoted context omitted.

acme-tiny is another good and simple client, which I personally prefer. I've recently compared 10 different Let's Encrypt / ACME clients: https://www.metachris.com/2015/12/comparison-of-10-acme-lets...

In your review, whenever I click a "show output" link, it navigates to another page containing only "[object Object]". Can you change the href to be an onclick attribute or something like that?

Thanks for the suggestion, I'll update the post tonight. Didn't notice / cannot reproduce - it seems to work for me in all browsers.

Re: Let's Encrypt has issued its first million certificates

#152

Post by pde3 » Wed, Mar 09, 2016, 11:01 PM UTC

nly wrote: post #29

StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

I personally find the hassle of installing, configuring and, crucially, testing , both LetsEncrypts scripts, and an accompanying cronjob, much more work and worry than a static nginx ssl config.

You're right, even with Let's Encrypt HTTPS is still more work than speaking insecure HTTP. But it's a brand new project, and we're working to ensure the amount of effort involved is monotonically decreasing.

In the next few months we'll be shipping an Nginx installer plugin and model renewal scripts for operating systems to provide native automated renewal with their packages of the client. Both of those should help to reduce the amount of work for your use case!

Re: Let's Encrypt has issued its first million certificates

#153

Post by pde3 » Thu, Mar 10, 2016, 1:42 AM UTC

nkuttler wrote: post #15

jqueryin wrote: post #8

Earlier quoted context omitted.

Assuming you use Apache. For many, it's simply not a fast enough web server without reverse proxies in front of it. Still crossing fingers for full nginx support soon.

I don't know, I don't want letsencrypt to touch my config files. It just works fine without that "magic" anyway if you're willing to add a few lines to a config file.

If you use the letsencrypt python client with "certonly --webroot", it will never touch your config files at all. You can add "-n" to make everything non-interactive and command line-only.

If you use letsencrypt with "certonly --apache" (or --nginx, when the nginx plugin is released) it will make only transient changes to your config in order to obtain the cert, and then restore it to the original state before exiting.

If you use letsencrypt with "run" (which is the default command) it will make config changes if those appear to be necessary for installing the cert.

One challenge we've had is how to design the command line interface to ensure that the users who want maximum automation get it, and the users who want maximum manual control also get that. Both set of behaviour are available.

Re: Let's Encrypt has issued its first million certificates

#154

Post by StavrosK » Thu, Mar 10, 2016, 1:17 PM UTC

mholt wrote: post #71

StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

> I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. I wrote a server that does this. Would be happy to have your feedback sometime: https://caddyserver.com - here's how it works with regards to Let's Encrypt certs: https://www.youtube.com/watch?v=OE5UhQGg_Fo&t=32m

Oh, I've downloaded Caddy and used it a few times, I love it but haven't switched anything to it yet.

To me, the killer feature right now is that I can just drop it in my /usr/bin directory and have a performant HTTP server in the current dir with just one command. I don't use the LE integration (even though I love the feature) because I haven't deployed it in anything outward-facing.

One small nit would be that I'm not very clear on how the LE fetching is done (where all the files are placed). The docs do mention this, but I left with a feeling that I was still not very clear on where the files go after reading it. Other than that, great job on Caddy!

Re: Let's Encrypt has issued its first million certificates

#155

Post by StavrosK » Thu, Mar 10, 2016, 1:22 PM UTC

vincentleeuwen wrote: post #138

mholt wrote: post #71

Earlier quoted context omitted.

> I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. I wrote a server that does this. Would be happy to have your feedback sometime: https://caddyserver.com - here's how it works with regards to Let's Encrypt certs: https://www.youtube.com/watch?v=OE5UhQGg_Fo&t=32m

Found this tutorial yesterday about how to do it with letsencrypt https://www.digitalocean.com/community/tutorials/how-to-secu...

I use simp_le for that. I more meant "I'd have paid a CA 10% more for automation", but that ship has sailed now that LE has launched. I'm probably not going to be using anything else any time soon.

Re: Let's Encrypt has issued its first million certificates

#156

Post by novaleaf » Thu, Mar 10, 2016, 8:21 PM UTC

metafunctor wrote: post #108

novaleaf wrote: post #80

Earlier quoted context omitted.

I think you are underestimating the cognitive burden this added complexity puts on your ops person (maybe yourself) I know for me, it was a choice between farting around with lets-encrypt for hours, or a $40 wildcard cert. so I went with the $40/year cert instead. There are just too many choices for lets-encrypt with no super-simple how-to for people who don't know this stuff (like myself).

I thought the same, until I actually took it upon myself to actually try LE. 15 minutes later, I had all my sites on LE, automatic renewal configured. I'm looking forward not having to sign in to some website, cut'n'paste certificates around, convert to/from PEM, figuring out what the correct chain is this time, etc.

I guess I'm stupid then, because I spent more than an hour trying to figure an easy way to add these to my auto-provisioned servers before giving up and using the static cert instead.