41–50 of 197 posts
Earlier quoted context omitted.
If the private key is only used for this purpose, and the cronjob as well as the key only reside on the server, is the security of the key then not a moot point if the server is breached? Genuinely curious.
If you update the certificates manually, then the private key would just reside on your local machine and not need to be exposed on the server.
I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…
Of course it doesn't prevent a total hack of your infrastructure but when you've come to that point, you've got bigger issues.
SSL certificate from a traditional provider valid for two years: $20.
Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless.
---
That's the real value for me. At $10/cert, that's not even a rounding error. But manually generating a new CSR, uploading it via crappy web form, waiting a random amount of time, proving domain ownership by responding to an email (sent in plaintext), waiting a different random amount of time, downloading the new cert (again usually sent via plaintext email), and finally copying it over the old cert and reloading the SSL conf ... now that costs some serious time and time is money.
I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...
Why not? There are even docker containers that will do everything for you, all you have to do is tag your application containers: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...
Earlier quoted context omitted.
If the private key is only used for this purpose, and the cronjob as well as the key only reside on the server, is the security of the key then not a moot point if the server is breached? Genuinely curious.
If you update the certificates manually, then the private key would just reside on your local machine and not need to be exposed on the server.
I think they nail their point with "it illustrates the strong demand for our services." Letsencrypt is cheap (free) and easy to use. Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. Before letsencrypt I always wanted to secure my blog with https but never got around to it…
With certbot it's actually easier to update every three months with Letsencrypt that updating every/other year with a traditional SSL CA.
I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...
https://groups.google.com/a/chromium.org/forum/#!topic/blink...
Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.
Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.
As designed, it was supposed to be that:
Domain Validation (DV) certs would indicate that your connection was secure.
Extended Validation (EV) certs would indicate that your connection was secure and you were connecting to the proper site.
In reality, the problems with phishing and mis-issued DV certs got so bad that that issuers like GeoTrust (owned by Symantec) began keyword checking DV certs for major company trademarks, phishing targets, etc. that depending on what it was would put your through varying degrees of scrutiny.
Examples:
- Some used bookstore had a domain like "the-good-book.com" which got flagged for manual review b/c of the "book.com" string and so many "facebook.com" phishing attempts.
- Anytime people would request certs for BMW, HBO, would trigger requests for contact information within those organizations and often a phone call from GeoTrust
- It was basically impossible to get anything issued with the term "paypal", "bank" or "apple" in the domain.
Please note that these were all for run of the mill - $15 single domain, DV certs.
This was for a fairly high end service that required credit card accounts, etc and we still saw around 5% of requests get pulled (rightly or wrongly) into one of these manual review filters.
It was a fairly unsung and unappreciated part of the what the cert issuers were doing - but it absolutely 100% helped.
LetsEncrypt is forcing the Cert and Browser industry back to the original DV/EV split and it's unclear where we're going to land.
Right now even technical people _trust_ the green lock and it's wildly easy to miss the fact that you're on a domain that is paypal-login-security-usa-1.com
I think we're going to see a future where the browser indicators are:
Red -> No SSL
Gray -> DV SSL
Green -> EV SSL