Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

71–80 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#71

Post by stephenr »

devishard wrote: post #61
nailer wrote: post #34

Earlier quoted context omitted.

Heads up: I work for a company that speeds up the background checks used for EV. Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS. And yes, we (CertSimple) are looking at Certbot support for EV.

> Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS. This would be a legit argument if EV HTTPS actually achieved that goal. They don't, though: the identity verification around EV HTTPS is a joke.

Can you elaborate?

Re: Let's Encrypt root certificate trusted by Mozilla

#72

Post by arcticfox »

theandrewbailey wrote: post #52
lllorddino wrote: post #39

Hacker News should switch from Comodo to Let's Encrypt. Scumbags attempted to trademark Let's Encrypt. https://letsencrypt.org/2016/06/23/defending-our-brand.html

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

HN, of all places, may take the trouble to actually make a small statement however. People would actually notice here.

Re: Let's Encrypt root certificate trusted by Mozilla

#73

Post by darklajid »

true_religion wrote: post #57
icebraining wrote: post #53

Earlier quoted context omitted.

LE is tied to a root CA (IdenTrust's). The support is almost universal, with only obsolete OSs not trusting them: https://community.letsencrypt.org/t/which-browsers-and-opera...

Lot's of people care about and make their money off users with "obsolete OS's and browsers".

Including HN / ycombinator?

Re: Let's Encrypt root certificate trusted by Mozilla

#74

Post by mholt »

dyladan wrote: post #64
Walkman wrote: post #62

Earlier quoted context omitted.

With Let's Encrypt, the trouble became "Whoaaa I just ran a command and everything works like magic!"

Sometimes magic isn't a good thing, especially when you're operating a service used by as many people as hn daily. Magic means things happened that I didn't explicitly instruct.

That's called automation and it's a good thing.

Re: Let's Encrypt root certificate trusted by Mozilla

#75

Post by [deleted] »

Nullabillity wrote: post #31
devy wrote: post #21

Earlier quoted context omitted.

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.

[deleted]

Re: Let's Encrypt root certificate trusted by Mozilla

#76

Post by devy »

Nullabillity wrote: post #31
devy wrote: post #21

Earlier quoted context omitted.

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.

Wildcard certificates have significant constraints of single level of the subdomain matching and security risks[1], putting side the debate of the real benefits of "not exposing subdomains".

[1]: https://tools.ietf.org/html/rfc6125#section-7.2

Re: Let's Encrypt root certificate trusted by Mozilla

#77

Post by LoSboccacc »

Walkman wrote: post #62
theandrewbailey wrote: post #52

Earlier quoted context omitted.

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

With Let's Encrypt, the trouble became "Whoaaa I just ran a command and everything works like magic!"

not for wildcards, also if you don't want to take your website down during the process, the command line becomes slightly more convoluted

Re: Let's Encrypt root certificate trusted by Mozilla

#78

Post by mook »

gkanai wrote: post #43
UnoriginalGuy wrote: post #2

Just to be clear, this is important because eventually Let's Encrypt wants to no longer have to cross-sign their certificates for them to be considered valid. For that to happen they have to be added as a trusted CA in most major platforms (and Firefox which has their own CA store for some reason).

> (and Firefox which has their own CA store for some reason). Firefox has it's own CA store because it's built for all 3 major (desktop) platforms. OSX and Windows have their own but Linux does not and uses Mozilla's.

More importantly, Firefox has its own CA store because it was derived from Netscape, which had its own because they came up with the whole SSL thing way back. The subsystem is still called NSS, even though there's been backbend changes (pkix).

Re: Let's Encrypt root certificate trusted by Mozilla

#79

Post by snassar »

LoSboccacc wrote: post #77
Walkman wrote: post #62

Earlier quoted context omitted.

With Let's Encrypt, the trouble became "Whoaaa I just ran a command and everything works like magic!"

not for wildcards, also if you don't want to take your website down during the process, the command line becomes slightly more convoluted

There are multiple ways of using Let's Encrypt that don't have to take the website down.

Re: Let's Encrypt root certificate trusted by Mozilla

#80

Post by duskwuff »

chc wrote: post #60
hughes wrote: post #24

Earlier quoted context omitted.

what's wrong with the .info tld?

People distrust it because it's 99% spam?

.info is really not all that bad, in the grand scheme of things. .biz is much worse (and has been since its launch in 2001!), and some of the new TLDs like .top and .xyz have been abused pretty heavily as well.
Post reply on HN