31–40 of 197 posts
I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...
you're perfectly free to pay $10/year for a manually issued certificate from one of 50 other providers
I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle.
So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok.
But how did Let's Encrypt get the public key from the domain owner?
I know they make the domain owner install some software on his server. But how does that make sure they talk to a server by the domain owner and not a man in the middle? Does the software include some private key so they can send them a "hey, encrypt this" message and to prove the server in fact has that private key?
If so, why is the Let's Encrypt software so complicated and not just a 5 line script or something?
I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...
I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.
I started writing a small utility to do just that (and then upload the cert to CPanel using their API). It works, though I'm lazy to make it reliable enough for release.
Earlier quoted context omitted.
If you're comfortable with said cronjob having access to your private key
If the private key is only used for this purpose, and the cronjob as well as the key only reside on the server, is the security of the key then not a moot point if the server is breached? Genuinely curious.
I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…
I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…
I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…
- LE makes a request to example.com, to a known URL that contains a key that LE told you to put there
- LE does a DNS lookup for a specific TXT record (again, containing a key they told you to put there).
The complete answer to your question can be found in the ACME spec (the protocol LE uses):
https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.htm...
I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…
There is a nicely done 'how it works' on Let's Encrypt: https://letsencrypt.org/how-it-works/