Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

51–60 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#51

Post by koolba »

nailer wrote: post #34
koolba wrote: post #18

Earlier quoted context omitted.

> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)

Heads up: I work for a company that speeds up the background checks used for EV. Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS. And yes, we (CertSimple) are looking at Certbot support for EV.

> Heads up: I work for a company that speeds up the background checks used for EV.

How much faster? The one time I've gotten an EV cert it took a couple hours to get verified. Didn't seem too long at all and compared to the time to plan the swap out of the cert in production, the wait was a non issue.

The verification itself was a joke though. It was basically just a phone call asking "Are you X? Ok great! Here's your cert!"

> Tying real world identities to public keys is very much a part of crypto.

Joe User isn't going to look at the details and validation chain of a certificate. The whole idea of the green bar for "more trusted" is a scamola by the cert providers as they saw the writing on the wall for their margins going to zero for domain validated ones (granted they saw it early enough to get traction on it!).

Re: Let's Encrypt root certificate trusted by Mozilla

#52

Post by theandrewbailey »

lllorddino wrote: post #39

Hacker News should switch from Comodo to Let's Encrypt. Scumbags attempted to trademark Let's Encrypt. https://letsencrypt.org/2016/06/23/defending-our-brand.html

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

Re: Let's Encrypt root certificate trusted by Mozilla

#53

Post by icebraining »

DisposableMike wrote: post #44
koolba wrote: post #18

Earlier quoted context omitted.

> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)

One of them is tied to a root CA and works on all devices. The other is not, and does not.

LE is tied to a root CA (IdenTrust's). The support is almost universal, with only obsolete OSs not trusting them: https://community.letsencrypt.org/t/which-browsers-and-opera...

Re: Let's Encrypt root certificate trusted by Mozilla

#54

Post by pfg »

DisposableMike wrote: post #44
koolba wrote: post #18

Earlier quoted context omitted.

> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)

One of them is tied to a root CA and works on all devices. The other is not, and does not.

Certificates issued by Let's Encrypt are cross-signed by IdenTrust and are trusted by all major browsers[1]. This is just about their own root certificate. Being cross-signed by an existing, trusted CA is a common practice for new CAs, as it would take years for the CA to become usable in practice otherwise.

[1]: https://community.letsencrypt.org/t/which-browsers-and-opera...

Re: Let's Encrypt root certificate trusted by Mozilla

#55

Post by wlesieutre »

polysaturate wrote: post #11
0xmohit wrote: post #7

Earlier quoted context omitted.

Comodo also had the idea to trademark "Let's Encrypt" [0]. [0] https://letsencrypt.org/2016/06/23/defending-our-brand.html

That's the joke

More specifically, Comodo's defense of that included "We did a 30 day free SSL certificate first! Let's Encrypt is copying our business model!"

The free certificate they were referring to was a time-limited free trial that you could use once and then start paying for.

Re: Let's Encrypt root certificate trusted by Mozilla

#56

Post by [deleted] »

teraflop wrote: post #46
mholt wrote: post #33

Earlier quoted context omitted.

I spoke about this earlier this week at a meetup. The consensus in the group was that wildcard certificates are desirable because they're easier to manage. If your tooling is good, the automation afforded by ACME can invalidate the need for wildcard certificates.

The problem is that Let's Encrypt enforces rate limits on how frequently you can request new certificates. According to the documentation[1], the limit averages out to one certificate (which can include up to 100 hostnames) per roughly 8 hours, per domain. That's probably good enough for almost everyone who uses hostnames to represent physical machines or services. But it's totally unusable if you want to create cert…

[deleted]

Re: Let's Encrypt root certificate trusted by Mozilla

#57

Post by true_religion »

icebraining wrote: post #53
DisposableMike wrote: post #44

Earlier quoted context omitted.

One of them is tied to a root CA and works on all devices. The other is not, and does not.

LE is tied to a root CA (IdenTrust's). The support is almost universal, with only obsolete OSs not trusting them: https://community.letsencrypt.org/t/which-browsers-and-opera...

Lot's of people care about and make their money off users with "obsolete OS's and browsers".

Re: Let's Encrypt root certificate trusted by Mozilla

#58

Post by aroch »

kentonv wrote: post #45
aroch wrote: post #38

Earlier quoted context omitted.

Unless all your subdomains are unique (e.g. coming out of a PRNG) AND there are no public DNS entries for them, subdomain enumeration by DNS or IP space is super easy. Not using SAN because of info disclosure concerns is security through obscurity.

Well yes, that's the idea: Say you have a wildcard DNS entry and you cryptographically-randomly-generate hostnames in it, as an added layer of defense against CSRF bugs in the applications running on these hosts. https://docs.sandstorm.io/en/latest/administering/wildcard/#...

That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind

Re: Let's Encrypt root certificate trusted by Mozilla

#59

Post by DisposableMike »

icebraining wrote: post #53
DisposableMike wrote: post #44

Earlier quoted context omitted.

One of them is tied to a root CA and works on all devices. The other is not, and does not.

LE is tied to a root CA (IdenTrust's). The support is almost universal, with only obsolete OSs not trusting them: https://community.letsencrypt.org/t/which-browsers-and-opera...

Despite a fairly large number of users on XP still (2.5% of total users on some sites I manage), I'll give you that it works on non-obsolete OS browsers. However, those are not the only pieces in the world of security.

Java, for example, only started support as recently as 3 weeks ago (2016-07-19)

Re: Let's Encrypt root certificate trusted by Mozilla

#60

Post by chc »

hughes wrote: post #24
wiradikusuma wrote: post #20

Question: any possible case of bad apples that make let's encrypt suddenly lose their trust? Eg bcoz it's free, it's used by "bad guys" just like .info tld.

what's wrong with the .info tld?

People distrust it because it's 99% spam?
Post reply on HN