99M PayPal certs!
Milestone: 100M Certificates Issued
71–80 of 197 posts
Re: Milestone: 100M Certificates Issued
#7299M PayPal certificates and counting...
Re: Milestone: 100M Certificates Issued
#73SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…
The LE protocol is fully open and even specified in RFCs - I wonder if any paid cert providers will ever move to that type of painless automated renewal (plus automated billing, of course). This would allow folks to potentially get their "advanced" certs (EV, wildcard, crossdomain, etc.) renewed without the rigmarole that you mention (although some cert categories come with their own non-automatable processes). Right…
EV certificates are not allowed to be renewed automatically AFAIK.
Re: Milestone: 100M Certificates Issued
#74SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…
The price is nice, but what makes it a must have for me is the ability to generate a cert with 100 domains on it and have it validated by hitting the server.
The "old" way required all customers/domain owners to either give us control of their domain or to answer an email every time we needed to get a new cert. Now we've automated moving around domains between certs and generate new ones as needed. Validation by email to 100 different people is like herding cats. Validation that happens in an automated way - priceless.
Re: Milestone: 100M Certificates Issued
#75I think they nail their point with "it illustrates the strong demand for our services." Letsencrypt is cheap (free) and easy to use. Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. Before letsencrypt I always wanted to secure my blog with https but never got around to it…
acme.sh reduces SSL deployment to fifteen minutes with virtually no maintenance.
Re: Milestone: 100M Certificates Issued
#76I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...
LetsEncrypt could easily sell extended expirations out-of-band. I see it as nearly inevitable when they need (more) money.
It's unlikely. Google and Mozilla are pushing hard for short-lived certificates, and the CA/B Forum has already passed a ballot that limits certificate lifetimes to 27 months, starting with March 1, 2018. Google wants to see that brought down to 12 months and might enforce that in their own products if the CA/B Forum doesn't keep up.
Re: Milestone: 100M Certificates Issued
#77Genuine question: Are the other smaller cert-issuing services going out of business? If not, what has been their response to LetsEncrypt? Not that all of them should survive, there are a lot of crappy services that deserved this. But I'm just trying to place myself in their CEOs position and wondering how the game plan should be.
Go upmarket and sell EV certs or codesigning certificates.
Re: Milestone: 100M Certificates Issued
#78LE really fills a big need for cert issuance for massive web hosts with custom domains (WPEngine, Hubspot, Shopify are all on LE) as it both greatly reduces the support burden of setting up certs for all of their sites and sidesteps some of the limitations of the legacy cert structure.
Re: Milestone: 100M Certificates Issued
#79I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…
> A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle.
> So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok.
It works quite differently -- the browser doesn't have to talk to Let's Encrypt at all to verify correctness.
How it works:
1. Browser connects to the server
2. TLS handshake, crypto-stuff
3. The server cryptographically presents the browser his certificate
4. The server's certificate is the server's public key, some attributes (like what domain names the cert is valid for) and a digital signature of all that stuff
5. The browser has a list of certificate authorities
6. The browser checks whether the digital signature on the server's certificate is valid and was made by a CA the browser trusts
7. The browser checks that the certificate is valid for the site it's currently accessing
8. Connection legit
The problem that the CAs (including Let's Encrypt) solve is not distribution of public keys, but rather trusting public keys presented by someone.
> But how did Let's Encrypt get the public key from the domain owner? > I know they make the domain owner install some software on his server
What the ACME clients do is two-fold:
1. They put up some sort of challenge response mechanism. This is used by Let's Encrypt to test whether a client is authorized to rule over a domain.
2. They generate (or use) a "Certificate Signing Request" (CSR). A CSR is basically a digital "sign here" field. The CSR contains the server's public key, what domains it wants to represent etc.. The CA checks the CSR using the challenge-response mechanism from (1) and then signs it digitally. The result is a certificate, which is sent back to the client and installed by the client. The private key of the certificate never left the server.
> If so, why is the Let's Encrypt software so complicated and not just a 5 line script or something?
Well it doesn't have to be complicated. acme.sh is only five (thousand) lines of shell :)
There are a bunch of ways the challenge-response mechanism can work, and there are also a lot of other options, which add to the complexity, as well as installation routines for certificates, which support a bunch of different servers.
A specific case with "static" challenge-response could conceivably boil down to just a dozen lines of shell or so.
Re: Milestone: 100M Certificates Issued
#80I love letsencrypt but I wish they would hurry up with deterministic dns challenges. It would make securely automating certificate renewal vastly simpler and easier (especially for certs that are being used for non www serving endpoints e.g. mail servers etc).
I worry that at the moment there are probably a lot of systems out there that leave DNS API keys lying around on endpoints because it's easier to automate the renewal than write a convoluted two stage ansible role/play that delegates sensitive actions to the controller running the play.