Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standing on our own two feet

letsencrypt.org

Post reply on HN
Print view View original

121–130 of 200 posts

Re: Standing on our own two feet

#121

Post by CameronNemo »

vhiremath4 wrote: post #103

The company I work at is in a high-growth phase and we are going to be expanding our global audience this coming year through various channels (SEO, performance marketing, sales, etc.). A 1-5% hit in potential customer traffic is not going to fly. Is my only option here to get off LetsEncrypt? A bit of a vent, but I would 100% had paid for a version of LetsEncrypt that supported their costs for the x-signature with I…

Is there any way you can measure how many of your users are on an unsupported Android version?

Re: Standing on our own two feet

#122

Post by andyp-kw »

miohtama wrote: post #73

Somewhat related, but in other thread two weeks ago people complain Google has too much power over Android ecosystem: https://news.ycombinator.com/item?id=24917918 Now, here people are suggesting Google should somehow update the old Androids. Be damned one way or the other.

True,

But we need Google to step up because we know that the manufacturers and carriers won't.

Re: Standing on our own two feet

#124

Post by javajosh »

My vote is for trusting Let's Encrypt, because SSL protects my users (and myself, and each other) from MITM attacks! However, it is interesting to ask what "trust" means in this context, since I don't know the people behind Let's Encrypt, so I don't trust them in that way. What are we trusting the organizations associated with those certs to do, or not to do?

Re: Standing on our own two feet

#125

Post by mholt »

yjftsjthsd-h wrote: post #80
mholt wrote: post #68

Earlier quoted context omitted.

ACMEz* ;) Seconding regecks' comment. We're gradually making ZeroSSL a default CA for Caddy. (I am currently implementing multi-CA support into Caddy and CertMagic, so that Caddy will be able to use both Let's Encrypt and ZeroSSL for redundancy. It's the first server to support this!) This is a good thing for the ecosystem.

> We're gradually making ZeroSSL a default CA for Caddy. As in, replacing LE as the default, or supplementing it? (And if the former, why?)

Note how I mentioned that Caddy will be the first server to support redundant ACME CAs, so we'll use both ZeroSSL, and Let's Encrypt for redundancy.

Re: Standing on our own two feet

#126

Post by ed25519FUUU »

sbierwagen wrote: post #94
gpff wrote: post #2

Let’s Encrypt cross-signature with IdenTrust "DST Root X3" is ending on September 1, 2021 but 33.8% of Android devices are running versions under 7.1 which don't trust Let’s Encrypt new root certificate "ISRG Root X1"

Good. Those devices are unsafe, and should not be used.

I think you might be ignorant with regards to how the rest of the world uses the internet.

Re: Standing on our own two feet

#127

Post by mholt »

mehrdadn wrote: post #98
mholt wrote: post #68

Earlier quoted context omitted.

ACMEz* ;) Seconding regecks' comment. We're gradually making ZeroSSL a default CA for Caddy. (I am currently implementing multi-CA support into Caddy and CertMagic, so that Caddy will be able to use both Let's Encrypt and ZeroSSL for redundancy. It's the first server to support this!) This is a good thing for the ecosystem.

Hi! Could I ask a somewhat unrelated question about using Let's Encrypt with Caddy? I've been trying to help some folks (in education) get wildcard subdomain certificates to work on their Google Cloud machines via lego_deprecated's purported gcloud support in Caddy v2 (we've tried to follow the instructions and all), but we've been running into issues and it's been incredibly frustrating to figure out how to resolve…

To avoid Let's Encrypt rate limits, please use the staging endpoint, as documented:

- https://letsencrypt.org/docs/staging-environment/ - https://caddyserver.com/docs/automatic-https#testing

For more help, please ask on our forums! I don't use Google Cloud but it is more likely that somebody there does: https://caddy.community -- otherwise, time to roll up your sleeves and get to work, forge the answer for others, I suppose!

Re: Standing on our own two feet

#128

Post by mehrdadn »

mholt wrote: post #127
mehrdadn wrote: post #98

Earlier quoted context omitted.

Hi! Could I ask a somewhat unrelated question about using Let's Encrypt with Caddy? I've been trying to help some folks (in education) get wildcard subdomain certificates to work on their Google Cloud machines via lego_deprecated's purported gcloud support in Caddy v2 (we've tried to follow the instructions and all), but we've been running into issues and it's been incredibly frustrating to figure out how to resolve…

To avoid Let's Encrypt rate limits, please use the staging endpoint, as documented: - https://letsencrypt.org/docs/staging-environment/ - https://caddyserver.com/docs/automatic-https#testing For more help, please ask on our forums! I don't use Google Cloud but it is more likely that somebody there does: https://caddy.community -- otherwise, time to roll up your sleeves and get to work, forge the answer for others, I…

Okay thanks!

Re: Standing on our own two feet

#129

Post by zinekeller »

1over137 wrote: post #117
wdb wrote: post #113

What about iOS? No word about it in this article.

Or macOS, or Windows, or the BSDs. Would be nice to see a table of which versions will have issues or not.

At least for Windows: if browser support is being considered, Firefox is the last browser that somewhat works (both IE and Chtome fails because of TLS 1.2) and it includes the ISRG root (because duh), and if an application still updates on XP there is a good chance that it uses OpenSSL or derivatives (which uses a different root set, likely Mozilla's).

Natively? Windows 7, assuming you have installed all updates before January. Microsoft can update the roots as they please (and historically issued updates up unto Windows 2000, so root updates are a demonstrable solved problem).

BSDs and Linuxes: (Usually) Uses Mozilla's trust list. Also updates separately from system updates, so unless you stick somehow with unsupported systems you already have this (and can be manually included into the trusted roots if you insist on using that outdated version).

macOS: bundled with the system updates (see caveat with Firefox independently managing roots). Here, I don't know what version is the oldest one with ISRG root certs.

Post reply on HN