Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milestone: 100M Certificates Issued

letsencrypt.org

Post reply on HN
Print view View original

141–150 of 197 posts

Re: Milestone: 100M Certificates Issued

#141

Post by hueving »

giobox wrote: post #140
cyphar wrote: post #111

Earlier quoted context omitted.

Currently their only upside is that they provide wildcard (and EV) certificates. EV certs can't be automated for obvious reasons, but LE doesn't support wildcard certs because they don't believe there's a secure way of providing an automated way of getting them. Given that traditional CA models don't actually have much more security than LE (in fact from personal experience they're far less secure), I wonder whether…

One annoying thing I've seen less technical stakeholders ask about with letsencrypt is "why the padlock isn't green" in Safari/Edge. Unlike Chrome and I think Firefox, those browsers only display a green padlock for SSL certs with EV, which of course letsencrypt doesn't (and arguably can't really) do. The "grey padlock" for an otherwise perfectly valid certificate seems to confuse a very small subset of users, especi…

What types of users have asked you about that? I'm lucky if I can get regular users not to click their way through cert errors.

Re: Milestone: 100M Certificates Issued

#142

Post by X86BSD »

koolba wrote: post #43

SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…

And this has been the same problem with pgp and crypt ion in general. Too costly in man time. To much to manage, regenerate, etc. unless it becomes transparent or setup once and forget it encryption will never get easier to deploy or manage or be more widely adopted.

Re: Milestone: 100M Certificates Issued

#144

Post by giobox »

hueving wrote: post #141
giobox wrote: post #140

Earlier quoted context omitted.

One annoying thing I've seen less technical stakeholders ask about with letsencrypt is "why the padlock isn't green" in Safari/Edge. Unlike Chrome and I think Firefox, those browsers only display a green padlock for SSL certs with EV, which of course letsencrypt doesn't (and arguably can't really) do. The "grey padlock" for an otherwise perfectly valid certificate seems to confuse a very small subset of users, especi…

What types of users have asked you about that? I'm lucky if I can get regular users not to click their way through cert errors.

Like you I've never seen a "customer" user notice, which is why I was careful to use the word "stakeholder". For me it's almost always been product management/sales types in the company.

Re: Milestone: 100M Certificates Issued

#145

Post by [deleted] »

F_r_k wrote: post #131
twothamendment wrote: post #74

Earlier quoted context omitted.

The price is nice, but what makes it a must have for me is the ability to generate a cert with 100 domains on it and have it validated by hitting the server. The "old" way required all customers/domain owners to either give us control of their domain or to answer an email every time we needed to get a new cert. Now we've automated moving around domains between certs and generate new ones as needed. Validation by emai…

With SNI, what's the advantage of having a cert with 100 domains on it ?

[deleted]

Re: Milestone: 100M Certificates Issued

#146

Post by binocarlos »

I've been using kube-lego (https://github.com/jetstack/kube-lego) to automate certs for Kubernetes ingress for the past 9 months. It is a joy to just add a domain to a manifest, kubectl apply and then hit a browser with a certificate working. Thank you LetsEncrypt for making the Internet more secure.

Re: Milestone: 100M Certificates Issued

#147

Post by twothamendment »

F_r_k wrote: post #131
twothamendment wrote: post #74

Earlier quoted context omitted.

The price is nice, but what makes it a must have for me is the ability to generate a cert with 100 domains on it and have it validated by hitting the server. The "old" way required all customers/domain owners to either give us control of their domain or to answer an email every time we needed to get a new cert. Now we've automated moving around domains between certs and generate new ones as needed. Validation by emai…

With SNI, what's the advantage of having a cert with 100 domains on it ?

With our setup, certificates are handled by Amazon elastic load balancers. A single ELB with a cert for 100 domains using SAN is easier to manage than 100 certs on a few servers using SNI.

I'm not saying you should design this way from the start, but this is what we grew into and SAN works for us. I only wish the limit of 100 per cert was higher.

Re: Milestone: 100M Certificates Issued

#148

Post by wang_li »

skybrian wrote: post #91
okket wrote: post #69

Earlier quoted context omitted.

What also may have motivated Google & Co was that ISPs and, further down, hot spots like hotels etc. started to insert/replace ads on unencrypted connections...

Security professionals tend to be motivated to work on improving security because they think it's important to protect users from the bad guys. And it's not like people have a sudden change of heart when joining Google.

For plenty of people, Google is a bad guy.

Re: Milestone: 100M Certificates Issued

#149

Post by twothamendment »

eropple wrote: post #139
F_r_k wrote: post #137

Earlier quoted context omitted.

I don't think so. I have an industrial VPN with ~300 embedded devices behind them. For some reason the user wants to access to each one of it via https. I thus set up an Apache proxy which proxies https://device_n.vpn.cust.tld to the VPN device (and some auth) LE cant issue 300 certificates and it would be very ugly.

I don't believe LE has an upper limit on its number of SANs. For systems not explicitly public, whitelists are almost always better than blacklists.

> I don't believe LE has an upper limit on its number of SANs.

The limit is 100, unless they removed that when I wasn't looking. Back in the beta I tried one domain, a handful and then, because I couldn't find a technical reason why SAN should be limited, I tried 500. It fails. I have many certs with up to 100 and would be happy if this changed.

Re: Milestone: 100M Certificates Issued

#150

Post by schoen »

id122015 wrote: post #128

I'd like to have the list with those 100 million websites, I didnt know there are so many.

It's not 100 million web sites, because Let's Encrypt certificates expire every 90 days, and you have to get a new certificate if you want to add or remove a domain name, and you can get duplicative certificates as long as they're within the rate limits.

As I said in my post at

https://www.eff.org/deeplinks/2017/06/lets-encrypt-has-issue...

it's probably between 17 million and 46 million web sites, although it could be a bit smaller than 17 million at the most restrictive notion of "web site" if you don't consider subdomains to be a separate web site even if they have different content and are operated by a different person.

You can see all of the certificates at

https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=16418

and you can also get a lot of the data from

https://scans.io/

or https://www.censys.io/ (registration required), although the people running it told me in connection with this that their Certificate Transparency data is not as current at the moment as crt.sh's data.

Post reply on HN