Milestone: 100M Certificates Issued • Hacker News Board

Re: Milestone: 100M Certificates Issued

#61

Post by swampangel » Thu, Jun 29, 2017, 1:51 PM UTC

TekMol wrote: post #40

msumpter wrote: post #37

Earlier quoted context omitted.

There is a nicely done 'how it works' on Let's Encrypt: https://letsencrypt.org/how-it-works/

I have read that, but it seems overly complicated. Why not just give the domain owner a private key and a script that is a few lines long. So he can sign a message from them and prove he has the key?

To know you're talking to the domain owner, I think you'd have to use the contact info from the whois info. I don't believe that's especially consistent across tlds.

The http or dns challenge/response is more reliable and pretty easy to automate and scale to many domains.

Re: Milestone: 100M Certificates Issued

#62

Post by nneonneo » Thu, Jun 29, 2017, 1:52 PM UTC

koolba wrote: post #43

SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…

The LE protocol is fully open and even specified in RFCs - I wonder if any paid cert providers will ever move to that type of painless automated renewal (plus automated billing, of course). This would allow folks to potentially get their "advanced" certs (EV, wildcard, crossdomain, etc.) renewed without the rigmarole that you mention (although some cert categories come with their own non-automatable processes).

Right now, I have LE certs for my main website and for a test webserver hosted on my laptop, both renewed automatically and painlessly through cron jobs. The fire and forget nature of LE is very convenient.

Re: Milestone: 100M Certificates Issued

#63

Post by techmagus » Thu, Jun 29, 2017, 1:52 PM UTC

jagermo wrote: post #2

I think they nail their point with "it illustrates the strong demand for our services." Letsencrypt is cheap (free) and easy to use. Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. Before letsencrypt I always wanted to secure my blog with https but never got around to it…

> Yes, you have to update it every three months

It can be automated. On mine, cronjob does the job!

Re: Milestone: 100M Certificates Issued

#64

Post by discordianfish » Thu, Jun 29, 2017, 1:53 PM UTC

koolba wrote: post #43

SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…

Totally agree. Actually wished there was a paid acme service, basically the same as letsencrypt but without such low rate limits.

Re: Milestone: 100M Certificates Issued

#65

Post by techmagus » Thu, Jun 29, 2017, 1:55 PM UTC

halloij wrote: post #50

Shame they can't issue wildcard certs. I don't see why they cannot.

It was, and I think it still is, a very much requested feature. I for one will benefit from it in one particular setup. But so far, can live without it.

Re: Milestone: 100M Certificates Issued

#66

Post by pg_is_a_butt » Thu, Jun 29, 2017, 1:56 PM UTC

tyingq wrote: post #51

This is an interesting situation where "public good" happened to align well with business goals of some deep pockets. Particularly, Google and Akamai...two of the biggest LE sponsors. They both retain good visibility to user behavior (like specific urls visited) because of things like GA,MITM proxying, etc. But, ubiquitous availability of that is taken away from ISP operators. Which is a good thing. Makes me curious…

eradicating the jews looks good on paper

Re: Milestone: 100M Certificates Issued

#67

Post by theandrewbailey » Thu, Jun 29, 2017, 1:56 PM UTC

weavie wrote: post #30

simias wrote: post #10

Earlier quoted context omitted.

I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.

acme.sh runs in pure shell, no need to install Python. It's my goto client and it just works.. everywhere. https://github.com/Neilpang/acme.sh

Seconded. I love that it supports custom port numbers, so I can use my not privileged web server port.

Re: Milestone: 100M Certificates Issued

#68

Post by theandrewbailey » Thu, Jun 29, 2017, 1:57 PM UTC

okket wrote: post #19

mavdi wrote: post #6

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

Why is nobody complaining about the fraudulent domain names and the registries that enable them? This is where the problem starts. The certificate only proves that the owner has access to the domain, nothing more.

That's not going to do much, because subdomains are a thing. Aren't a lot of phishing domains like:

fake-paypal.phish.com

Re: Milestone: 100M Certificates Issued

#69

Post by okket » Thu, Jun 29, 2017, 1:58 PM UTC

tyingq wrote: post #51

This is an interesting situation where "public good" happened to align well with business goals of some deep pockets. Particularly, Google and Akamai...two of the biggest LE sponsors. They both retain good visibility to user behavior (like specific urls visited) because of things like GA,MITM proxying, etc. But, ubiquitous availability of that is taken away from ISP operators. Which is a good thing. Makes me curious…

What also may have motivated Google & Co was that ISPs and, further down, hot spots like hotels etc. started to insert/replace ads on unencrypted connections...

Re: Milestone: 100M Certificates Issued

#70

Post by 0xfeba » Thu, Jun 29, 2017, 1:58 PM UTC

mavdi wrote: post #27

agrajag wrote: post #12

Earlier quoted context omitted.

That's .02% of all certs issued. A road might enable a bank robber to get away faster, but nobody is complaining that we shouldn't build roads because of it.

That's only Paypal :) There are hundreds more instances of abuse

And 99,900,000 instances of non-abuse. A free service gets abused, surprise surprise. As LE have said, it's not their problem to solve typo-squatters, or IP infringement.