Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

91–100 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#91

Post by GhotiFish »

xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

This 100% blocked me. I tried to work around it by using lets encrypt to provision me certificates on the fly, but I got rate limited.

Then I started speccing out a way to get single certs for many subdomains in one request using SAN, and the whole thing looked like it would require more development time compared to just buying a wildcard cert. Very frustrating.

Re: Let's Encrypt root certificate trusted by Mozilla

#92

Post by 0x0 »

scrollaway wrote: post #50
nailer wrote: post #34

Earlier quoted context omitted.

Heads up: I work for a company that speeds up the background checks used for EV. Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS. And yes, we (CertSimple) are looking at Certbot support for EV.

FYI: Your server's vulnerable to CVE-2016-2107 and is getting an F from ssllabs. https://www.ssllabs.com/ssltest/analyze.html?d=certsimple.co...

Lol

Re: Let's Encrypt root certificate trusted by Mozilla

#94

Post by joecool1029 »

discreditable wrote: post #87

I find it a little hilarious that the cert for the Test URL, https://helloworld.letsencrypt.org is a 90-day certificate that is expired as of a long time ago. https://i.imgur.com/1bQLHuF.png

If you read through the linked bug inside the bug, I think they had to do that as part of the review process. They had to wait 90 days after the initial cert was issued to have it reviewed. Since LE only issues 90 day certs this means they'd have to review an expired one.

The whole Mozilla CA review process is a little crazy and the thread talks about ways they could reform it in the future. (overview: https://wiki.mozilla.org/CA )

Re: Let's Encrypt root certificate trusted by Mozilla

#95

Post by oasisbob »

lllorddino wrote: post #39

Hacker News should switch from Comodo to Let's Encrypt. Scumbags attempted to trademark Let's Encrypt. https://letsencrypt.org/2016/06/23/defending-our-brand.html

True, that was really ugly.

However, I think some nuance is important here. Comodo has some really good people (like Rob Stradling) that are doing a lot of good work for PKI.

eg, the https://crt.sh tool is fantastic.

Re: Let's Encrypt root certificate trusted by Mozilla

#96

Post by gist »

arcticfox wrote: post #72
theandrewbailey wrote: post #52

Earlier quoted context omitted.

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

HN, of all places, may take the trouble to actually make a small statement however. People would actually notice here.

> may take the trouble to actually make a small statement however

Another move in the direction of political correctness and making decisions according to optics. Have you considered valid business purposes for a company doing a particular act or are you just deciding that everyone thinks this was a "scumbag" action?

Re: Let's Encrypt root certificate trusted by Mozilla

#97

Post by aroch »

icebraining wrote: post #65
aroch wrote: post #58

Earlier quoted context omitted.

That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind

> publish Sandstorm is a platform for personal computing; each person runs their own applications, much like in a PC. Also, applications don't get hostnames; each document (or equivalent) in the application gets its own hostname.

At which point we're back to my original point of why does the information disclosure matter?

Re: Let's Encrypt root certificate trusted by Mozilla

#98

Post by ww520 »

Walkman wrote: post #62
theandrewbailey wrote: post #52

Earlier quoted context omitted.

HN uses ycombinator's wildcard certificate, and it's not up until August 2019. It's likely that they don't want to go through the trouble until it's really needed.

With Let's Encrypt, the trouble became "Whoaaa I just ran a command and everything works like magic!"

Well, last time I tried, the compilation failed. I didn't understand why it had to do compilation.

Instead of magic, I would rather prefer simple and clear steps.

Re: Let's Encrypt root certificate trusted by Mozilla

#99

Post by kentonv »

icebraining wrote: post #65
aroch wrote: post #58

Earlier quoted context omitted.

That doesn't prevent domain enumeration for your application though. Once you publish an application, anyone using it can find the address its hosted behind

> publish Sandstorm is a platform for personal computing; each person runs their own applications, much like in a PC. Also, applications don't get hostnames; each document (or equivalent) in the application gets its own hostname.

It's even finer-grained than that. Each session gets a hostname -- if you open the same document twice, it's at a different hostname each time. This also implies that different users get different hostnames, so you can't discover the host another user sees even if you have access to the same document.

Re: Let's Encrypt root certificate trusted by Mozilla

#100

Post by saynsedit »

jerf wrote: post #26
wiradikusuma wrote: post #20

Question: any possible case of bad apples that make let's encrypt suddenly lose their trust? Eg bcoz it's free, it's used by "bad guys" just like .info tld.

The purpose of Let's Encrypt, and the SSL certificate infrastructure in general, isn't to prevent "bad guys" from getting certificates. It's to ensure that if you own the box, the certificate verifies that a web client is speaking directly to that box with nothing in between. (Or more generally, directly to an authorized end point by the owner of that DNS entry. Authority can be delegated.) In other words, it keeps b…

Source?

I remember reports in the past decrying CAs for issuing certificates for phishing sites in the style of "gooogle.com" etc.

Post reply on HN