Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt in the spotlight

dancvrcek.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Let’s Encrypt in the spotlight

#31

Post by thinkMOAR »

jldugger wrote: post #6
ams6110 wrote: post #2

Like with a lot of tech trends, I seem to be one of those people who doesn't "get" the excitement about letsencrypt. I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt. In fact I think it's quite a bit easier.

It's free, and automated so you don't run into TLS outage post-mortems where the question "why does the cert expire at christmas anyways?" is "Because it expired same time last year and during the emergency repair we used the default lifetime period of one year."

Why is your LE broken? 'because 1 of the 12 automated renewals last 3 years (to compare vs 3 year paid certificate at 4 euro) failed for reason X, Y or Z'. Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. There are plenty of ways a LE renewal can go wrong, and having this 'chance' occur 4 times a year, i find bad practice.

Just because something is free, doesn't make it better. And having 12x more points in same timeframe where the automated renewal can fail, certainly doesn't make it better statistically.

Also i grew up with the notion, 'nothing in the world is free, except the sun'. So i wouldn't be surprised if they will start to monetise this LE user base at some point in time.

Re: Let’s Encrypt in the spotlight

#32

Post by IronBacon »

schoen wrote: post #26
duskwuff wrote: post #21

Earlier quoted context omitted.

This seems a little tin-foil-hatty. The only information which Let's Encrypt receives is the domain name that the certificate is for (which is public anyways for any CA implementing certificate transparency). The Certbot software is open-source and easily verifiable, and there's multiple independently developed alternatives available if you don't like it.

Certbot developer here. If you don't like Certbot, we definitely encourage you to use one of the many other implementations: https://community.letsencrypt.org/t/list-of-client-implement... Some of these are much lighter weight than Certbot and have many fewer dependencies. You can also take your pick of what language they are written in and how they are installed on your system. You're also welcome to write your own…

> I know that some people have said they don't like running a large new application as root, even when it's open source.

Certbot could be configured to run without root with little effort, at least the part exposed to the web that was my concern.

Re: Let’s Encrypt in the spotlight

#33

Post by vsviridov »

Ironic that the "https in browsers" figure uses a screenshot with a certificate MITM'd by the antivirus software. If you see "Secure" in the green bar instead of the domain name and EV attributes - your antivirus software is MITM'ing you.

Re: Let’s Encrypt in the spotlight

#34

Post by IshKebab »

vsviridov wrote: post #33

Ironic that the "https in browsers" figure uses a screenshot with a certificate MITM'd by the antivirus software. If you see "Secure" in the green bar instead of the domain name and EV attributes - your antivirus software is MITM'ing you.

That's not true. Where did you get that idea?

https://support.google.com/chrome/answer/95617?visit_id=1-63...

Re: Let’s Encrypt in the spotlight

#35

Post by wielebny »

vsviridov wrote: post #33

Ironic that the "https in browsers" figure uses a screenshot with a certificate MITM'd by the antivirus software. If you see "Secure" in the green bar instead of the domain name and EV attributes - your antivirus software is MITM'ing you.

Not true, it means that the certificate is not EV.

I see 'Secure' on my Chromium running under Debian, without any antivirus software.

Re: Let’s Encrypt in the spotlight

#37

Post by gtf21 »

tokenizerrr wrote: post #12
toomuchtodo wrote: post #10

Earlier quoted context omitted.

So that's the provisioning process at server setup/instantiation; how do you handle the 90 day renewal?

The ansible role installs my ACME client of choice ( https://github.com/lukas2511/dehydrated ), invokes it once, and adds a cronjob.

We do the same and I found it a breeze, I even have some hooks which talk to the cloudflare API to setup the txt records for verification.

Re: Let’s Encrypt in the spotlight

#38

Post by majewsky »

thinkMOAR wrote: post #31
jldugger wrote: post #6

Earlier quoted context omitted.

It's free, and automated so you don't run into TLS outage post-mortems where the question "why does the cert expire at christmas anyways?" is "Because it expired same time last year and during the emergency repair we used the default lifetime period of one year."

Why is your LE broken? 'because 1 of the 12 automated renewals last 3 years (to compare vs 3 year paid certificate at 4 euro) failed for reason X, Y or Z'. Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. There are plenty of ways a LE renewal can go wrong, and having this 'chance' occur 4 times a year, i find bad practic…

> Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos.

I have my certbot set to run once a week with --keep-until-expiring, so it will try to issue a new certificate when the old one's remaining validity is less than a month. I could also set it to run daily, because it doesn't actually do anything if the cert is still valid for long enough. But a week works on my (admittedly small) scale.

So unless you're experiencing a multi-week DNS malfunction or multi-week DDoS (in which case you're in some deep shit anyway), you should be fine.

Re: Let’s Encrypt in the spotlight

#39

Post by majewsky »

Xoros wrote: post #17
Vendan wrote: post #16

Earlier quoted context omitted.

I personally think it being a cron job is a bad idea. I do my LE cert renewal in the web server itself, so the web server would have to crash for the LE cert renewal to not run.

LE send you a mail if you have a cert going to expire. Easy to spot if something went wrong in your cron tasks (not that you can totally rely on automated task of course, but it's another layer of security)

Before someone complains that LE is going to spam you with expiry notices: If you set up your process right (i.e. certbot cronjob with --keep-until-expiring), certs will be renewed early enough that the mail reminder never triggers unless there's an actual problem.

Re: Let’s Encrypt in the spotlight

#40

Post by enigmabridge »

venning wrote: post #28

The submission URL should probably be changed to https://keychest.net/content/letsencrypt_numbers_to_know The current link is just a poor summary of the data on that page.

Funny enough, the page with a full analysis didn't get any upvotes. It seems that a short summary is more interesting.
Post reply on HN