Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
ACME v2 and Wildcard Certificate Support is Live
21–30 of 321 posts
Re: ACME v2 and Wildcard Certificate Support is Live
#22DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
I never understood why DNS providers are so reluctant to offer standards-based access, like nsupdate(1). It's easy to set up, it can do everything, it's secure, requires no custom anything and it just works.
Re: ACME v2 and Wildcard Certificate Support is Live
#23Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?
Yes. Wildcard certificates are useful primarily as an alternative to manually managing many certificates. But in the age of automation (now), LE wildcard certificates are only really useful to avoid rate limits, which is 20 certificates per week per set of names. Key compromise for a single site is much less disruptive than losing control of a key that protects hundreds or thousands of sites. Generally you want to ke…
A particularly desired case is Sandstorm.io, which randomly generates a subdomain every time you open a document.
Re: ACME v2 and Wildcard Certificate Support is Live
#24Earlier quoted context omitted.
Yeah, I think that if someone hacked your DNS provider, they could add secure-payments.yourbusiness.com and start spamming people with "late payment! enter your credit card!" notices or something. So I guess, make sure you trust your DNS provider if you're using wildcards. Or is there another exploit I'm missing?
Not sure how the availability of wildcard certs changes that scenario, if I can set the DNS record for secure-payments.yourbusiness.com then I can get a non-wildcard cert for it and get on with the spamming straight away
I think it's somewhat difficult to get a valid (CA-valid) certificate for a domain you don't own, though. At least, that's what the job of the CAs is: to verify that the certs they're issuing are for the actual owner of yourbusiness.com.
Re: ACME v2 and Wildcard Certificate Support is Live
#25DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
Take a look at https://github.com/AnalogJ/lexicon. It's a python library that provides standardized, programmatic access to DNS entries for a bunch of major providers.
Re: ACME v2 and Wildcard Certificate Support is Live
#26On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved
Dynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK
Re: ACME v2 and Wildcard Certificate Support is Live
#27First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lo…
When you run the Let's Encrypt official client (certbot), it updates itself.
Re: ACME v2 and Wildcard Certificate Support is Live
#28I do hope GitHub employs this for rolling out https for Pages sites using custom domains too.
Re: ACME v2 and Wildcard Certificate Support is Live
#29Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
The only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model.
My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for many reasons.
Re: ACME v2 and Wildcard Certificate Support is Live
#30Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
The service is great, but they're really the only free SSL cert game in town. As more sites start using their certs, they'll wind up becoming a single point of failure.