Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
They won’t ever issue EV certs.
ACME v2 and Wildcard Certificate Support is Live
101–110 of 321 posts
Re: ACME v2 and Wildcard Certificate Support is Live
#102Earlier quoted context omitted.
> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…
What about hosting HTTP content because you verify GPG signatures upon download? These content would then be super easy to cache on the local network. HTTPS defeats this and makes it uncachable. I hardly ever see people talk about this use case and how to solve it with https everywhere. AND it's super widely used: e.g. debian repositories.
Clients for this aren’t web browsers. Making browsers warn about them doesn’t break anything.
Re: ACME v2 and Wildcard Certificate Support is Live
#103Earlier quoted context omitted.
Dynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK [1] https://www.dtdns.com/dtsite/faq#hostdomains
LE requires setting DNS TXT records to get wildcard certs - do dynamic DNS providers ever let you do that? My assumption is they don't.
Yeah that's a fair assumption. So no wildcards for subdomains at dynamic dns providers -- probably not an important use-case anyhow.
Re: ACME v2 and Wildcard Certificate Support is Live
#104Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
The one that always sticks out is the certs’ extremely short expiration period. The IMHO weak rationale for this was mentioned in another thread here (See jjeaff‘s response upthread).
It would be nice if they simply offered two choices:
1. I love automation! Give me a 90 day certificate.
2. I understand the security trade-offs. Give me a 3 year certificate.
Re: ACME v2 and Wildcard Certificate Support is Live
#105One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA. i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's autom…
You could do this before too, without wildcards.
Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.
Re: ACME v2 and Wildcard Certificate Support is Live
#106Can this be used for multi-level subdomains? Like *.subdomain.example.org?
No, but that limitation is due to wildcard certificates specifications - not LE.
Re: ACME v2 and Wildcard Certificate Support is Live
#107Earlier quoted context omitted.
> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. > You have not been paying attention to the hundreds of tools available to make HTTPS painless. I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What…
> Oh, so you know better than me what kind of content is on my site? So a static site with my resume needs SSL then to protect the other users? Without TLS how do YOU know that the user is receiving your static resume. Any MitM can tamper with the connection and replace your content with something malicious. With properly configured TLS that's simply not possible (with the exception you describe in corporate settings…
And web servers can even detect TLS MITM: https://caddyserver.com/docs/mitm-detection
Re: ACME v2 and Wildcard Certificate Support is Live
#108Earlier quoted context omitted.
The only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model. My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for ma…
>I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model. single point of failure as in, getting hacked and misiussing certificates?
That's one scenario. Or maybe they run out of funding and need to shut down. Maybe they end up needing to shut down an old API before everyone is ready. Maybe they have a bug and issue a bunch of subtly broken certs (say, not enough entropy).
It's a concern whenever a large portion of decentralized infrastructure has a single centralized dependency. Even if that dependency is awesome and doing great work right now.
Ideally, there would be several free CAs that all used the ACME protocol. But somebody's got to pay for that and somebody's got to go through the effort of setting it up when Let's Encrypt already works really well.
Re: ACME v2 and Wildcard Certificate Support is Live
#109Earlier quoted context omitted.
I never understood why DNS providers are so reluctant to offer standards-based access, like nsupdate(1). It's easy to set up, it can do everything, it's secure, requires no custom anything and it just works.
One option is to run your own BIND instance configured however you like, and pay for one or more secondary DNS services to sync off it. You can even hide your own BIND instance from everyone outside your network and just point your NS records at the secondaries, if you’re worried about misconfiguration/DoS attacks/etc.
A perfectly viable option that is called 'shadow mastering'. dns.he.net lets you do it for free.