Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milestone: 100M Certificates Issued

letsencrypt.org

Post reply on HN
Print view View original

21–30 of 197 posts

Re: Milestone: 100M Certificates Issued

#21

Post by corobo »

simias wrote: post #10
pulse7 wrote: post #3

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.

> startssl

I must have at least 4 accounts there due to them using client certificate login. Great proof of concept why certificate based website logins never took off.

Re: Milestone: 100M Certificates Issued

#23

Post by j_s »

pulse7 wrote: post #3

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

LetsEncrypt could easily sell extended expirations out-of-band. I see it as nearly inevitable when they need (more) money.

Re: Milestone: 100M Certificates Issued

#24

Post by j_s »

mixedbit wrote: post #7
mavdi wrote: post #6

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

What prevented Paypal phishing sites from buying certificates from other providers?

The part where it wasn't scalable because it wasn't free.

Re: Milestone: 100M Certificates Issued

#25

Post by tskaiser »

m12k wrote: post #14
the_common_man wrote: post #9

Earlier quoted context omitted.

> Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. This is just a cronjob, no?

If you're comfortable with said cronjob having access to your private key

If the private key is only used for this purpose, and the cronjob as well as the key only reside on the server, is the security of the key then not a moot point if the server is breached? Genuinely curious.

Re: Milestone: 100M Certificates Issued

#26

Post by catdog »

simias wrote: post #10
pulse7 wrote: post #3

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.

There also are a lot of alternative [1] implementations which are less bloated, some are really small with only some hundred lines of code and few dependencies.

[1] https://letsencrypt.org/docs/client-options/

Re: Milestone: 100M Certificates Issued

#27

Post by mavdi »

agrajag wrote: post #12
mavdi wrote: post #6

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

That's .02% of all certs issued. A road might enable a bank robber to get away faster, but nobody is complaining that we shouldn't build roads because of it.

That's only Paypal :) There are hundreds more instances of abuse

Re: Milestone: 100M Certificates Issued

#28

Post by philamonster »

the_common_man wrote: post #9
jagermo wrote: post #2

I think they nail their point with "it illustrates the strong demand for our services." Letsencrypt is cheap (free) and easy to use. Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. Before letsencrypt I always wanted to secure my blog with https but never got around to it…

> Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. This is just a cronjob, no?

Yes and no. I ran into an instance where certbot itself needed to be updated and the scheduled renewal didn't take place until I did so the next day.

I also use Subsonic @home which requires generating a keystore as the app doesn't yet handle LE natively.

Re: Milestone: 100M Certificates Issued

#29

Post by detaro »

mavdi wrote: post #15
mixedbit wrote: post #7

Earlier quoted context omitted.

What prevented Paypal phishing sites from buying certificates from other providers?

checks they're supposed to be performing. Some are ignoring them but being punished for it. http://www.bbc.com/news/technology-39365315

DV certificates were never required to have different checks than what LE is doing, so what checks are you talking about?

Re: Milestone: 100M Certificates Issued

#30

Post by weavie »

simias wrote: post #10
pulse7 wrote: post #3

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.

acme.sh runs in pure shell, no need to install Python. It's my goto client and it just works.. everywhere.

https://github.com/Neilpang/acme.sh

Post reply on HN