Progress Towards 100% HTTPS, June 2016

#1

Post by dankohn1 » Wed, Jun 22, 2016, 4:22 PM UTC

Progress Towards 100% HTTPS, June 2016
letsencrypt.org

Re: Progress Towards 100% HTTPS, June 2016

#2

Post by projectramo » Wed, Jun 22, 2016, 4:29 PM UTC

Is there any work being done on being able to easily switch out standards?

That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

Re: Progress Towards 100% HTTPS, June 2016

#3

Post by p4lindromica » Wed, Jun 22, 2016, 4:37 PM UTC

projectramo wrote: post #2

Is there any work being done on being able to easily switch out standards? That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

The s in https just means secure. It has evolved from SSL to TLS with various versions of each.

The http in https just means http. It has evolved from http/1.0 to http/1.1 to http/2.

I'm not sure what you're asking or how it is relevant to Let's Encrypt.

Re: Progress Towards 100% HTTPS, June 2016

#4

Post by Abundnce10 » Wed, Jun 22, 2016, 4:51 PM UTC

Let’s Encrypt has issued more than 5 million certificates in total since we launched to the general public on December 3, 2015. Approximately 3.8 million of those are active, meaning unexpired and unrevoked. Our active certificates cover more than 7 million unique domains.

How can you cover 7 million unique domains if you've only issued 5 million certificates?

Re: Progress Towards 100% HTTPS, June 2016

#5

Post by waterphone » Wed, Jun 22, 2016, 4:51 PM UTC

Abundnce10 wrote: post #4

Let’s Encrypt has issued more than 5 million certificates in total since we launched to the general public on December 3, 2015. Approximately 3.8 million of those are active, meaning unexpired and unrevoked. Our active certificates cover more than 7 million unique domains. How can you cover 7 million unique domains if you've only issued 5 million certificates?

One certificate can be for more than one domain.

Re: Progress Towards 100% HTTPS, June 2016

#6

Post by schoen » Wed, Jun 22, 2016, 4:52 PM UTC

Abundnce10 wrote: post #4

Let’s Encrypt has issued more than 5 million certificates in total since we launched to the general public on December 3, 2015. Approximately 3.8 million of those are active, meaning unexpired and unrevoked. Our active certificates cover more than 7 million unique domains. How can you cover 7 million unique domains if you've only issued 5 million certificates?

A certificate can cover many domains thanks to the subjectAltName extension.

Re: Progress Towards 100% HTTPS, June 2016

#7

Post by zzzcpan » Wed, Jun 22, 2016, 4:56 PM UTC

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

Re: Progress Towards 100% HTTPS, June 2016

#8

Post by sp332 » Wed, Jun 22, 2016, 5:09 PM UTC

projectramo wrote: post #2

Is there any work being done on being able to easily switch out standards? That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

The situation is not ideal. But the consensus among browser makers is that the previously-relevant standards bodies move too slowly. They can implement new transport features independently (like Chrome did with SPDY and QUIC). But the downside is that fragmentation is more likely, as most browsers implemented SPDY's features in HTTP/2 but only Opera has added QUIC.

Re: Progress Towards 100% HTTPS, June 2016

#9

Post by Freaky » Wed, Jun 22, 2016, 5:13 PM UTC

zzzcpan wrote: post #7

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

Yep. You can get 20 different certificates per domain per week, with up to 100 names on each.

https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

Re: Progress Towards 100% HTTPS, June 2016

#10

Post by vtlynch » Wed, Jun 22, 2016, 5:34 PM UTC

projectramo wrote: post #2

Is there any work being done on being able to easily switch out standards? That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

This will likely never be the case due to how HTTPS actually works. As someone else stated, HTTPs is HTTP + TLS.

The "s" in HTTPS is for "secure", and TLS provides that security.

TLS is a evolving standard which is updated over time to add new features when necessary. When HTTPS is negotiated, it can seamlessly choose which version of TLS to use, based off what the client and server want to use.

So, HTTPS will never die due to lack of features. A new version of TLS will just be approved and deployed, and newer devices can use that while older devices can get by on an older version of TLS.

TLS is the successor to SSL. They are backwards compatible, so devices that support TLS also support SSL. The full version history, from newest to oldest, is: TLS 1.2, TLS 1.1, TLS 1.0, SSL 3, SSL 2. In reality, very few servers still use SSL 3 or SSL 2, due to known weaknesses, but colloquially, all the versions are just called "SSL".

TLS 1.3 is underway and will shortly be ready for primetime. Firefox and Cloudflare have already written some implementations based on the draft spec (sorta how routers will implemented the newest 802.11 standards before they are 100% official).