Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milestone: 100M Certificates Issued

letsencrypt.org

Post reply on HN
Print view View original

91–100 of 197 posts

Re: Milestone: 100M Certificates Issued

#91

Post by skybrian »

okket wrote: post #69
tyingq wrote: post #51

This is an interesting situation where "public good" happened to align well with business goals of some deep pockets. Particularly, Google and Akamai...two of the biggest LE sponsors. They both retain good visibility to user behavior (like specific urls visited) because of things like GA,MITM proxying, etc. But, ubiquitous availability of that is taken away from ISP operators. Which is a good thing. Makes me curious…

What also may have motivated Google & Co was that ISPs and, further down, hot spots like hotels etc. started to insert/replace ads on unencrypted connections...

Security professionals tend to be motivated to work on improving security because they think it's important to protect users from the bad guys. And it's not like people have a sudden change of heart when joining Google.

Re: Milestone: 100M Certificates Issued

#92

Post by the_common_man »

gator-io wrote: post #89

The biggest issue we've had is the short expirations. We have 51 certificates in our organization and do not want to rely on auto-renew. As our community project, we built a totally free to the public service to monitor certs and alert you when they get close to expiration or are invalid, etc: https://letsmonitor.org Feel free to use it for any certs.

LE already sends me notifications by email. What am I missing?

Re: Milestone: 100M Certificates Issued

#93

Post by catdog »

michaelbuckbee wrote: post #49
mavdi wrote: post #6

Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.

I did some work in this space. The cert authorities were never really designed to be a backstop against phishers as that threat really rose up in prominence after they were setup. And it placed them in a weird gatekeeper role. As designed, it was supposed to be that: Domain Validation (DV) certs would indicate that your connection was secure. Extended Validation (EV) certs would indicate that your connection was secu…

Browsers should also completely drop that lock icon for any type of connection as it's connotated wrongly in too many heads (even for EV because what you really need to check is that it is issued to the right company).

Re: Milestone: 100M Certificates Issued

#94

Post by antsar »

gator-io wrote: post #89

The biggest issue we've had is the short expirations. We have 51 certificates in our organization and do not want to rely on auto-renew. As our community project, we built a totally free to the public service to monitor certs and alert you when they get close to expiration or are invalid, etc: https://letsmonitor.org Feel free to use it for any certs.

That's a neat service. If anyone is looking for a self-hosted option, this looks promising: https://github.com/RaymiiOrg/certificate-expiry-monitor

Re: Milestone: 100M Certificates Issued

#95

Post by Intermernet »

the_common_man wrote: post #9
jagermo wrote: post #2

I think they nail their point with "it illustrates the strong demand for our services." Letsencrypt is cheap (free) and easy to use. Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. Before letsencrypt I always wanted to secure my blog with https but never got around to it…

> Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. This is just a cronjob, no?

I now just run all of my sites behind Caddy which takes care of cert renewals for me. Can't recommend it enough!

Re: Milestone: 100M Certificates Issued

#96

Post by Klathmon »

dom0 wrote: post #88
frutiger wrote: post #85

Earlier quoted context omitted.

That's not a part of the ACME protocol (which is what Let's Encrypt implements), it's a policy decision of Let's Encrypt. Grandparent's comment is about other CAs offering EV certs over ACME.

??? EV guidelines have nothing to do with Let's Encrypt or ACME. They state that even for renewal all checks have to be done again, which cannot be automated .

Maybe not fully automated, but at least the provider could "start" the process, only requiring the company they are validating to answer some questions, reply to mail, reply to whatever kind of extra authentication/verification is needed, then the technical portion can happen automatically after that.

Re: Milestone: 100M Certificates Issued

#97

Post by doublerebel »

Shameless open-source plug: if you need a automatic LetsEncrypt module that works with your containerized environment, try ten-ply-crest [0]. Works best with Consul where it automatically registers based on service tag, and can securely store certs in Vault, which makes it a great match for Fabio [1].

This way you can run multiple load-balancers and keep your existing infrastructure while still enjoying all the benefits of LE. Written in JavaScript but works with any stack.

Based on the great rawacme, and we'll keep this updated as ACME hits 2.0! [2]

[0]: https://github.com/nextorigin/ten-ply-crest

[1]: https://github.com/nextorigin/ten-ply-crest/issues/27

[2]: https://github.com/AngryBytes/rawacme-node/issues/2

Re: Milestone: 100M Certificates Issued

#98

Post by [deleted] »

m12k wrote: post #36
tskaiser wrote: post #25

Earlier quoted context omitted.

If the private key is only used for this purpose, and the cronjob as well as the key only reside on the server, is the security of the key then not a moot point if the server is breached? Genuinely curious.

If you update the certificates manually, then the private key would just reside on your local machine and not need to be exposed on the server.

[deleted]

Re: Milestone: 100M Certificates Issued

#99

Post by TekMol »

breakingcups wrote: post #52
TekMol wrote: post #40

Earlier quoted context omitted.

I have read that, but it seems overly complicated. Why not just give the domain owner a private key and a script that is a few lines long. So he can sign a message from them and prove he has the key?

In effect that is sort of what they are doing, but simpler. You claim to have domain x.com. LetsEncrypt sends you a token. Place it in a DNS record or in a pre-determined path on your domain and ask LetsEncrypt to read it back. If it matches, it is verified that you own the domain. How is the scheme you propose simpler, whilst retaining the same base guarantee (that the requester is the owner of the domain in questio…

> in a pre-determined path on your domain

That would be easy and elegant. But they want you to install software on your server.

Re: Milestone: 100M Certificates Issued

#100

Post by mirko22 »

skybrian wrote: post #91
okket wrote: post #69

Earlier quoted context omitted.

What also may have motivated Google & Co was that ISPs and, further down, hot spots like hotels etc. started to insert/replace ads on unencrypted connections...

Security professionals tend to be motivated to work on improving security because they think it's important to protect users from the bad guys. And it's not like people have a sudden change of heart when joining Google.

But it is also not like you get to do what you want in big corporations. Rather you do what you have been told, and usually you might not even know the real reason.

Also security professional is a person that know a lot about security, his intentions are not necessarily "good" for him to be considered a security professional in my opinion.

Very good black hat hacker are also professionals.

Post reply on HN