Quoted post unavailable.
Wait - why are you downloading keys? From where? That does not sound right
A Year-End Letter from our Executive Director
21–30 of 155 posts
Re: A Year-End Letter from our Executive Director
#22Before Letsencrypt, SSL signing was cumbersome and downright scary sometimes. With cPanel + letsencrypt (or whatever their default Auto SSL provider is [0]), it's a few clicks and done. If there's a downside, I have never seen nor heard of it. Side note: I was expecting this CEO letter to end with layoffs. [0] https://docs.cpanel.net/whm/ssl-tls/manage-autossl/
I used to configure all of this manually on Apache following crappy instructions from online certificate providers. Copying .pem, .key, .csr files PRAYING Apache would start without complaining. I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
I always had issues with GoDaddy and had to get on a call with their support but at least they played cool old jazz in the wait queue. LE works great.
Re: A Year-End Letter from our Executive Director
#23Earlier quoted context omitted.
I'm not sure that's a good thing
What's a downside of that?
Downside existed before Let's Encrypt, it just got amplified with it.
General public does not differentiate between the SSL certificate validation level.
Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question.
There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would expect the financial institutions to use this kind of certificates to avoid phishing, but sadly I've seen some of them use Let's Encrypt.
Re: A Year-End Letter from our Executive Director
#24Let's Encrypt is behind that annoying memorysafety.org website? how unfortunate.
otherwise great news that LE is still doing well as an org
Re: A Year-End Letter from our Executive Director
#25Earlier quoted context omitted.
What's a downside of that?
An Ex-facebook ml engineer who doesn't know what ssl is and takes pride in not having to learn it? Not sure it's a downside/upside thing. It might shed light on the types of people who get hired at facebook.
Sorry, we're giving an ML engineer grief for not knowing much about SSL? Should we tease dentists for not knowing how to grow oranges, too?
Re: A Year-End Letter from our Executive Director
#26Before Letsencrypt, SSL signing was cumbersome and downright scary sometimes. With cPanel + letsencrypt (or whatever their default Auto SSL provider is [0]), it's a few clicks and done. If there's a downside, I have never seen nor heard of it. Side note: I was expecting this CEO letter to end with layoffs. [0] https://docs.cpanel.net/whm/ssl-tls/manage-autossl/
I used to configure all of this manually on Apache following crappy instructions from online certificate providers. Copying .pem, .key, .csr files PRAYING Apache would start without complaining. I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
Those instructions were always so clunky as was the process.
Re: Godaddy, I was using their "EV" (Extended Validation) cert which added a company name indicator in the address bar. I then learned that it's unwise to bring up security when someone isn't thinking about it because it puts them on undue alert. A couple years ago the browsers have done away with that EV badge altogether.
Re: A Year-End Letter from our Executive Director
#27Before Letsencrypt, SSL signing was cumbersome and downright scary sometimes. With cPanel + letsencrypt (or whatever their default Auto SSL provider is [0]), it's a few clicks and done. If there's a downside, I have never seen nor heard of it. Side note: I was expecting this CEO letter to end with layoffs. [0] https://docs.cpanel.net/whm/ssl-tls/manage-autossl/
I used to configure all of this manually on Apache following crappy instructions from online certificate providers. Copying .pem, .key, .csr files PRAYING Apache would start without complaining. I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me. Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
> I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me.
Actually Apache recently introduced mod_md, which allows provisioning certificates from Let's Encrypt directly (or anything else that supports ACME): https://httpd.apache.org/docs/2.4/mod/mod_md.html
Because of this, you no longer need external software like certbot for Apache (though it's good software regardless: https://certbot.eff.org/pages/about), so in that regard Apache is a bit more like Caddy (another good web server: https://caddyserver.com/), rather than like Nginx.
I wrote about it and other configurations of Apache on my blog a while back: https://blog.kronis.dev/tutorials/how-and-why-to-use-apache-... Since, I've actually moved most of my personal workloads from Nginx/Caddy over to Apache, because at my scale the web server isn't the bottleneck and if you disable .htaccess to limit disk I/O it's pretty decent, in addition to lots of different modules.
Either way, working a bit more with certificates, even with tools that simplify the process, is a nice way to understand everything a bit better, like running your own CA: https://blog.kronis.dev/tutorials/lets-run-our-own-ca I still have lots to learn, at least when I want to get pretty particular about mTLS and what some client certificates can or cannot be used for.
Of course, any software that actually helps you get things done, is user friendly and has ample (correct) tutorials available is a good option in my book, regardless of what your particular choice ends up being! Let's Encrypt as a whole is an absolute life saver, though! Edit: even if it feels like a looming massive single point of failure with few viable alternatives sometimes.
Re: A Year-End Letter from our Executive Director
#28Quoted post unavailable.
> some shady websites What are you talking about? A clever design aspect of Let’s Encrypt is the deliberately short expiry. That forces administrators to automate the issuance and renewal process. Not to mention that you’re not supposed to “download” the private key! The whole idea of PKI is to generate the private key locally and then have a CA sign only the public part. If you’re doing anything else you’ve undermin…
I know better what am I supposed to do. Type "download letsencrypt certificate online" in the Google and you'll find out what I'm talking about. You can think of forcing administrators all the day while Internet is full of expired letsencrypt websites that I regularly stumble upon. The world does not work like that. Letsencrypt should serve its users, not force them onto anything. If I think that I should generate key online, provide me this service with sane implementation on a safe website. If you won't, I'll download it from the "Russian hackers". ACME is awesome, but it's not always suitable, sometimes I want to get certificate manually and that's OK. I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had.
Re: A Year-End Letter from our Executive Director
#29Before Letsencrypt, SSL signing was cumbersome and downright scary sometimes. With cPanel + letsencrypt (or whatever their default Auto SSL provider is [0]), it's a few clicks and done. If there's a downside, I have never seen nor heard of it. Side note: I was expecting this CEO letter to end with layoffs. [0] https://docs.cpanel.net/whm/ssl-tls/manage-autossl/
>Side note: I was expecting this CEO letter to end with layoffs.
Best I can tell from their 2022 Annual Report, they operate pretty lean...22 employees and 10 board members. (see page 44)
https://www.abetterinternet.org/documents/2022-ISRG-Annual-R...
Re: A Year-End Letter from our Executive Director
#30Earlier quoted context omitted.
What's a downside of that?
Downside existed before Let's Encrypt, it just got amplified with it. General public does not differentiate between the SSL certificate validation level. Let's Encrypt provides domain validation certificates, which only validates that one owns the domain in question. There is another level - Organization Validation SSL certificates, which involves manual checking that this is the legal entity it claims to be. I would…
Browsers don't differentiate between the SSL certificate validation level. Because it has been shown that the higher validation levels aren't actually significantly more secure, so the distinction is pointless.