Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milestone: 100M Certificates Issued

letsencrypt.org

Post reply on HN
Print view View original

161–170 of 197 posts

Re: Milestone: 100M Certificates Issued

#161

Post by omribahumi »

F_r_k wrote: post #131
twothamendment wrote: post #74

Earlier quoted context omitted.

The price is nice, but what makes it a must have for me is the ability to generate a cert with 100 domains on it and have it validated by hitting the server. The "old" way required all customers/domain owners to either give us control of their domain or to answer an email every time we needed to get a new cert. Now we've automated moving around domains between certs and generate new ones as needed. Validation by emai…

With SNI, what's the advantage of having a cert with 100 domains on it ?

Also, HTTP/2 can reuse the same TCP connection for multiple domains with SAN

Re: Milestone: 100M Certificates Issued

#162

Post by tokenizerrr »

eropple wrote: post #159
tokenizerrr wrote: post #158

Earlier quoted context omitted.

SNI is not yet always an option if you have to support older clients. It's not about if I'm using SANs anyway. It's that LE is fine with that, but not with wildcard certs. > However, I would also point out that wildcards allow people who aren't you to create domains that you didn't create and represent them as being from you, which is an attack vector that even SAN enumeration doesn't allow. We're talking whitelists…

If you have to support older clients--definitely, SAN is your only option if you have to run on the same host. (And I sympathize, because that sucks.) At that point, though, my inclination becomes to attach a bunch more public IPs and wire up my DNS correctly to match. > Can you elaborate what you mean here? Me saying "this cert is valid for example.com, foo.example.com, and bar.example.com" is an incrementally bette…

IPv4 addresses are relatively expensive. I encounter it quite often where a wildcard gets pointed to a single server (with single IP) which hosts multiple services. There are no security issues compared to a large SAN that I can see in such a situation.

Re: Milestone: 100M Certificates Issued

#163

Post by cyphar »

tokenizerrr wrote: post #156
cyphar wrote: post #136

Earlier quoted context omitted.

Yes, many services "seem to do it". The problem is how do you safely verify that a wildcard certificate is actually being given to the owner of that domain space? It's "trivial" to provide a certificate for a particular domain is owned by someone, but the same techniques don't work for wildcard certificates because now you're verifying only a single domain and providing certificates for an entire class of domains. If…

That SO post makes no sense to me. It claims: > The authentication test can't merely back down one level to mysub.example.com because that isn't covered by the cert requested, and may not be under the control of the requesting agent either. This just seems wrong. Performing the check like that seems to be a sane way to do it. If people can't control the base domain they have no business requesting a wildcard cert.

But *.a.com doesn't cover a.com, so it's not very clear that the inverse ownership relationship should hold. Yes, it's true on a DNS level but that's one argument I would imagine against doing it that way.

Re: Milestone: 100M Certificates Issued

#164

Post by perlgeek »

gator-io wrote: post #89

The biggest issue we've had is the short expirations. We have 51 certificates in our organization and do not want to rely on auto-renew. As our community project, we built a totally free to the public service to monitor certs and alert you when they get close to expiration or are invalid, etc: https://letsmonitor.org Feel free to use it for any certs.

Thanks for providing that!

I've been using another free certificate monitor, but it assumes 1 year validity and the lowest possible warning threshold is 30 days, which isn't all that useful when working with Let's Encrypt.

So, you have another happy user now :-)

Re: Milestone: 100M Certificates Issued

#165

Post by MertsA »

josephjrobison wrote: post #160
Asdfbla wrote: post #108

Earlier quoted context omitted.

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

Is this total BS then?: "Why pay for something that’s free, you ask? When a user visits a website that is secured with a self-signed, or free SSL certificate, most web browsers will post an error message. While some people will click “I understand the risks” and proceed to your site, it’s likely that many people will click the “Get me out of here!” button and never return. The real problem lies in the fact that self-…

Sort of, that's conflating all free SSL certs with self signed certs. The whole point of an SSL cert is to provide authentication that the server you're talking to is really the server you were trying to reach at www.example.com . They are talking about self signed certificates which is basically the remote server saying "I'm www.example.com, you can trust me because I said so". Let's Encrypt is the same as other CAs out there in terms of authentication. In fact, if you see a certificate that's signed by Symantec, it's more likely to be mississued than a certificate signed by Let's Encrypt.

Re: Milestone: 100M Certificates Issued

#166

Post by tokenizerrr »

cyphar wrote: post #163
tokenizerrr wrote: post #156

Earlier quoted context omitted.

That SO post makes no sense to me. It claims: > The authentication test can't merely back down one level to mysub.example.com because that isn't covered by the cert requested, and may not be under the control of the requesting agent either. This just seems wrong. Performing the check like that seems to be a sane way to do it. If people can't control the base domain they have no business requesting a wildcard cert.

But *.a.com doesn't cover a.com, so it's not very clear that the inverse ownership relationship should hold. Yes, it's true on a DNS level but that's one argument I would imagine against doing it that way.

No, but ownership of a.com heavily implies ownership of (wildcard).a.com (HN is being weird with the asterisk)

Alternatively they could just do a DNS check. If you can configure DNS for a.com, you control *.a.com.

Re: Milestone: 100M Certificates Issued

#167

Post by Ajedi32 »

josephjrobison wrote: post #160
Asdfbla wrote: post #108

Earlier quoted context omitted.

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

Is this total BS then?: "Why pay for something that’s free, you ask? When a user visits a website that is secured with a self-signed, or free SSL certificate, most web browsers will post an error message. While some people will click “I understand the risks” and proceed to your site, it’s likely that many people will click the “Get me out of here!” button and never return. The real problem lies in the fact that self-…

The certificates Let's Encrypt issues are _not_ self-signed. They are signed by a trusted certificate authority which Let's Encrypt manages, and are no different from domain validated certs signed by any other CA.

That article makes the mistake of assuming that if a certificate is free then it _must_ be self-signed, which is obviously false.

Re: Milestone: 100M Certificates Issued

#168

Post by dylz »

j_s wrote: post #135
theandrewbailey wrote: post #56

Earlier quoted context omitted.

LE probably does that multiple times from a few places around the internet, to reduce the likelihood of something unexpected going on.

Ain't nobody got time for that! They might have " a few places around the internet " to verify from, but I doubt it is very diverse location-wise. And there's no way they're going to bother with doing it multiple times, for free.

> they're going to bother with doing it multiple times, for free

You are aware you are talking about the cost of a single HTTP GET?

Re: Milestone: 100M Certificates Issued

#169

Post by AceJohnny2 »

skybrian wrote: post #91
okket wrote: post #69

Earlier quoted context omitted.

What also may have motivated Google & Co was that ISPs and, further down, hot spots like hotels etc. started to insert/replace ads on unencrypted connections...

Security professionals tend to be motivated to work on improving security because they think it's important to protect users from the bad guys. And it's not like people have a sudden change of heart when joining Google.

But there needs to be investment to pay said security professionals to develop the tools, publish them, polish them to be user-friendly (otherwise no-one uses them, see GPG), to pay for the datacenter hosting...

It doesn't happen in a vacuum.

Re: Milestone: 100M Certificates Issued

#170

Post by eropple »

tokenizerrr wrote: post #162
eropple wrote: post #159

Earlier quoted context omitted.

If you have to support older clients--definitely, SAN is your only option if you have to run on the same host. (And I sympathize, because that sucks.) At that point, though, my inclination becomes to attach a bunch more public IPs and wire up my DNS correctly to match. > Can you elaborate what you mean here? Me saying "this cert is valid for example.com, foo.example.com, and bar.example.com" is an incrementally bette…

IPv4 addresses are relatively expensive. I encounter it quite often where a wildcard gets pointed to a single server (with single IP) which hosts multiple services. There are no security issues compared to a large SAN that I can see in such a situation.

I would submit, respectfully, that you're not being creative enough.

When it comes to security, including phishing, it behooves all of us to not assume that permissiveness is a de facto positive.

Post reply on HN