Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

61–70 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#61

Post by devishard »

nailer wrote: post #34
koolba wrote: post #18

Earlier quoted context omitted.

> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)

Heads up: I work for a company that speeds up the background checks used for EV. Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS. And yes, we (CertSimple) are looking at Certbot support for EV.

> Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS.

This would be a legit argument if EV HTTPS actually achieved that goal. They don't, though: the identity verification around EV HTTPS is a joke.

Re: Let's Encrypt root certificate trusted by Mozilla

#62

Post by Walkman »

theandrewbailey wrote: post #52
lllorddino wrote: post #39

Hacker News should switch from Comodo to Let's Encrypt. Scumbags attempted to trademark Let's Encrypt. https://letsencrypt.org/2016/06/23/defending-our-brand.html

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

With Let's Encrypt, the trouble became "Whoaaa I just ran a command and everything works like magic!"

Re: Let's Encrypt root certificate trusted by Mozilla

#63

Post by mynameisvlad »

gkanai wrote: post #43
UnoriginalGuy wrote: post #2

Just to be clear, this is important because eventually Let's Encrypt wants to no longer have to cross-sign their certificates for them to be considered valid. For that to happen they have to be added as a trusted CA in most major platforms (and Firefox which has their own CA store for some reason).

> (and Firefox which has their own CA store for some reason). Firefox has it's own CA store because it's built for all 3 major (desktop) platforms. OSX and Windows have their own but Linux does not and uses Mozilla's.

Does Chrome provide its own CA store on Linux? It's also built for all 3 major desktop platforms but uses the OSX and Windows stores.

Re: Let's Encrypt root certificate trusted by Mozilla

#64

Post by dyladan »

Walkman wrote: post #62
theandrewbailey wrote: post #52

Earlier quoted context omitted.

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

With Let's Encrypt, the trouble became "Whoaaa I just ran a command and everything works like magic!"

Sometimes magic isn't a good thing, especially when you're operating a service used by as many people as hn daily. Magic means things happened that I didn't explicitly instruct.

Re: Let's Encrypt root certificate trusted by Mozilla

#65

Post by icebraining »

aroch wrote: post #58
kentonv wrote: post #45

Earlier quoted context omitted.

Well yes, that's the idea: Say you have a wildcard DNS entry and you cryptographically-randomly-generate hostnames in it, as an added layer of defense against CSRF bugs in the applications running on these hosts. https://docs.sandstorm.io/en/latest/administering/wildcard/#...

That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind

> publish

Sandstorm is a platform for personal computing; each person runs their own applications, much like in a PC. Also, applications don't get hostnames; each document (or equivalent) in the application gets its own hostname.

Re: Let's Encrypt root certificate trusted by Mozilla

#66

Post by mgkimsal »

koolba wrote: post #18
bhhaskin wrote: post #17

Earlier quoted context omitted.

Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal.

> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)

compatibility, at least in the short term?

I put a LE cert on a project, and some folks calling the API with old Java clients couldn't trust the cert. They could have upgraded, but it was easier to get a commercial cert and be done with it.

Re: Let's Encrypt root certificate trusted by Mozilla

#67

Post by pfg »

DisposableMike wrote: post #59
icebraining wrote: post #53

Earlier quoted context omitted.

LE is tied to a root CA (IdenTrust's). The support is almost universal, with only obsolete OSs not trusting them: https://community.letsencrypt.org/t/which-browsers-and-opera...

Despite a fairly large number of users on XP still (2.5% of total users on some sites I manage), I'll give you that it works on non-obsolete OS browsers. However, those are not the only pieces in the world of security. Java, for example, only started support as recently as 3 weeks ago (2016-07-19)

XP is supported. There was an issue due to some schannel bug in XP choking on the issuer certificate, but that was fixed earlier this year.

Re: Let's Encrypt root certificate trusted by Mozilla

#68

Post by gtk40 »

yacn wrote: post #25
wiradikusuma wrote: post #20

Question: any possible case of bad apples that make let's encrypt suddenly lose their trust? Eg bcoz it's free, it's used by "bad guys" just like .info tld.

Do you mean .tk? AFAIK .info costs money.

Yes, but it's usually cheaper.

Re: Let's Encrypt root certificate trusted by Mozilla

#69

Post by stephenr »

Nullabillity wrote: post #27
chc wrote: post #16

Earlier quoted context omitted.

Why? Is there something wrong with HN's current cert?

1. Funds Comodo's shady behaviour, and arguably increases their brand recognition 2. Ridiculous expiry time

You know that Comodo won't issue a refund if they decide not to use them any more right? They've paid the money.

I can understand moving things to show support for better alternatives but let's not kid ourselves - moving now or moving when the cert expires, doesn't hurt Comodo any differently.

Re: Let's Encrypt root certificate trusted by Mozilla

#70

Post by icebraining »

true_religion wrote: post #57
icebraining wrote: post #53

Earlier quoted context omitted.

LE is tied to a root CA (IdenTrust's). The support is almost universal, with only obsolete OSs not trusting them: https://community.letsencrypt.org/t/which-browsers-and-opera...

Lot's of people care about and make their money off users with "obsolete OS's and browsers".

And they're just as likely to have problems with any other CA.
Post reply on HN