Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt makes certs for 30% of web domains

leebutterman.com

Post reply on HN
Print view View original

51–60 of 147 posts

Re: Let's Encrypt makes certs for 30% of web domains

#51

Post by zamadatix »

hannob wrote: post #9

A few of these things, while not necessarily wrong, should be put into context. E.g. "Hundreds of thousands of domains' certs expire after 2099". Yeah, but no publicly trusted certs. They're capped at a bit more than 2 years and there's a discussion to cap them even more. The certs they're seeing are almost certainly mostly: "let's create a test selfsigned cert for this host. how long should it last? let's type in a…

> Yeah, but no publicly trusted certs.

> (Over 1.5M expire in the 2040s alone!)

I doubt ~75% of the self signed certs expire in this dataset expire 21-30 years from now. Surely the author is correct that there are a good number of public certs with a very long expiration. Would need to download and filter the dataset to know for sure though.

Re: Let's Encrypt makes certs for 30% of web domains

#52

Post by jaas »

henryfjordan wrote: post #42
jaas wrote: post #34

Earlier quoted context omitted.

Yes we do. On what basis did you make that statement? We comply with U.S. sanctions by not issuing to entities on the SDN list, but that doesn't prevent us from serving the vast majority of people in those countries.

How do you know if someone is on the list? When I registered my domain I got WHOIS protection and then LE just made sure I owned the domain. There was no asking about who I am or where I reside or what lists I might be on.

You can search the list here:

https://www.treasury.gov/resource-center/sanctions/sdn-list/...

Some entries have specific domains associated with them, but we are obligated to not serve any domain directly associated with (i.e. controlled by) an SDN entity, not just those listed.

If we become aware that we may be serving an entity on the SDN list (often via someone emailing us) we have to conduct an investigation which may result in termination of service.

Re: Let's Encrypt makes certs for 30% of web domains

#53

Post by tpmx »

sieabahlpark wrote: post #15
tpmx wrote: post #6

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's encrypt is awesome because it's instantaneous! You'd think Google would understand that aspect. Edit: GCP people: Please give us a an explicit "retry" button to press when we've set up the DNS records. (I'm talking about the Google Cloud Balancing Service here.…

If you use Google cloud enough you'll soon realize they're not very fast at anything. Better hope you don't get your account automatically banned because one of your employees does sketchy things on their own personal account

I think you probably have an unrelated grudge here, at least judging from the contents of your comment before you edited it to make it less offensive.

Re: Let's Encrypt makes certs for 30% of web domains

#54

Post by the8472 »

FDSGSG wrote: post #16
sschueller wrote: post #7

This kind of centralization is not good. Even thought let's encrypt is non profit and has a very good service record. We desperately need more like it spread around the globe.

What problems would decentralization solve here?

They could pull a cloudflare and stop granting certificates to people that are out of moral alignment with them.

Or the government could lean in on them require them to not grant certificates to some foreign institutions. Even worse, they could be forced by NSLs to issue fraudulent certs (CT log verification isn't mandatory yet, is it?)

Re: Let's Encrypt makes certs for 30% of web domains

#55

Post by henryfjordan »

dheera wrote: post #44
manderley wrote: post #26

Earlier quoted context omitted.

That's due to US sanctions.

Start a LetTheRestOfUsEncrypt.org based in a different country whose government isn't so full of themselves? Or better yet, is there a way to start a decentralized organization itself so that no jurisdiction has absolute power over it?

How are you going to trust that decentralized org? Is it just voting? Can we all vote to revoke anyone's cert at any time for no reason? What happens when someone performs a 51% attack and takes over google.com's cert?

CAs exist solely because you CAN trust them, otherwise what's the point? We'd just have every site self-sign and let the users choose who to trust.

Re: Let's Encrypt makes certs for 30% of web domains

#56

Post by Spivak »

FreeHugs wrote: post #46

One thing I don't understand about Let's Encrypt: Why do the certificates expire after 90 days? What would be the downside of giving them a longer expiration time?

Nobody actually checks certificate revocation lists so a compromised cert that’s valid for 5 years can be used maliciously for the full duration.

90 days was what they decided the best compromise for usability and security.

Taken to the extreme ‘immediate’ certificate expiration starts to look a lot like Kerberos which is maybe what we always wanted.

Re: Let's Encrypt makes certs for 30% of web domains

#57

Post by owenmarshall »

markstos wrote: post #21
manishsharan wrote: post #10

can someone please share how they deploy/distribute Let's encrypt certificates with auto renewal on load balanced multiple EC2 servers for the same dns name. I had tried this a while but had to give up and just bought SSL certs which I then include in my EC2 image.

If your load balancers are AWS load balancers, you are doing it wrong. AWS provides their own free certificates that work the load balancer and they handle renewal as well. Let's Encrypt would be an unnecessary additional dependency and complexity. (At least if you are comfortable terminating your SSL at the load balancer. If you plan to use SSL between the AWS LBs and your EC2 instances, then AWS certs don't work th…

> (At least if you are comfortable terminating your SSL at the load balancer. If you plan to use SSL between the AWS LBs and your EC2 instances, then AWS certs don't work there and you'll need to provision them yourself using something like LE).

Interesting note - ALBs/ELBs (NLBs with SSL termination as well, I would assume, but I am not sure) do not perform validation of your backend certificate. You can terminate at the load balancer and use an expired self signed SHA1 cert for all AWS cares.

Re: Let's Encrypt makes certs for 30% of web domains

#58

Post by progval »

mmalone wrote: post #22
FDSGSG wrote: post #16

Earlier quoted context omitted.

What problems would decentralization solve here?

Competition is always good. For one, a completely decoupled and separately managed system on a different stack would improve availability of ACME-based certificates. It would also reduce the concentration of trust in one entity. While LE is awesome, the target on their back is only getting bigger. For what it's worth, I'm pretty sure even Let's Encrypt wants to see competitors to Let's Encrypt.

> It would also reduce the concentration of trust in one entity.

No it wouldn't. If there are 9999 CAs, you need to trust every single one of them.

A better argument for having multiple CAs is that it would increase resilience (against takedowns, bugs, money running out, etc.)

Re: Let's Encrypt makes certs for 30% of web domains

#59

Post by jedberg »

aquabeagle wrote: post #24
FDSGSG wrote: post #16

Earlier quoted context omitted.

What problems would decentralization solve here?

Let's Encrypt goes down, certs can't be renewed, people can't access websites securely (or at all if HSTS was used).

Good practice says that you should be renewing your certs when they have about 10% of their lifetime left, just in case this exact thing happens with whoever your provider might be.

It's unlikely they would be down for so long that certs would actually expire.

Re: Let's Encrypt makes certs for 30% of web domains

#60

Post by ZeroCool2u »

tpmx wrote: post #6

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's encrypt is awesome because it's instantaneous! You'd think Google would understand that aspect. Edit: GCP people: Please give us a an explicit "retry" button to press when we've set up the DNS records. (I'm talking about the Google Cloud Balancing Service here.…

Huh, I've had the opposite experience when setting up DNS on GCP App Engine. Things seemed to be quite snappy to me.
Post reply on HN