Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt issues 35 certs every second

twitter.com

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Let's Encrypt issues 35 certs every second

#21

Post by jiggawatts »

x86a wrote: post #18
jiggawatts wrote: post #17

To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free. A Raspberry Pi could serve this. Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually. The reality…

To be fair, I doubt bandwidth has ever been a significant cost driver for CAs

Greed has been the cost driver, which is why plugging "*.domain.com" into the subject field instead of "domain.com" costs 10x more money.

DigiCert for example is owned by private venture capitalists.

They expect as much rent-seeking as possible to get a return on their investment.

Re: Let's Encrypt issues 35 certs every second

#22

Post by fsmv »

eatsyourtacos wrote: post #14
thisgoodlife wrote: post #11

Earlier quoted context omitted.

You can automate the process. Try certbot.

I know it can be automated even more, but in my situation it's just not practical even having to release to a lot of (disconnected) machines.

You should use a reverse proxy server so you only have the cert on one machine.

I actually made one for myself in go that's been pretty fun. You can try it if you want (https://github.com/fsmv/daemon) but you should be able to set it up with apache or nginx as well.

Re: Let's Encrypt issues 35 certs every second

#24

Post by ehPReth »

jiggawatts wrote: post #17

To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free. A Raspberry Pi could serve this. Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually. The reality…

Cool. But what do the HSMs, auditing, etc, etc, etc that the BRs (https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...) and root store policies require cost on top of “just some bytes”?

FreeFreeFreeCerts (https://bugzilla.mozilla.org/show_bug.cgi?id=233458) or Honest Achmed’s certificate authority (https://bugzilla.mozilla.org/show_bug.cgi?id=647959) won’t make it in today’s world, nor yesterday’s.

Let’s Encrypt’s financials are public and they aren’t running it off a singular Raspberry PI, nor anything like it - because they can’t; nor would it responsible to, at least on, say, a HSM or key seperation level.

Not to say, though, that traditional CAs aren’t rent seeking bloated greedy pieces of shit - because they absolutely are. I’m happy Let’s Encrypt found the funding and will (and the all important cross-sign) to take off and curb stomp the incumbent CAs around a bit. I still cringe every time I see an OV certificate in the wild.

Re: Let's Encrypt issues 35 certs every second

#26

Post by danShumway »

Pannoniae wrote: post #19
danShumway wrote: post #13

Earlier quoted context omitted.

> And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP This is largely because putting a huge red alert in front of plaintext HTTP pages would provoke a huge backlash from anti-HTTPS factions on the Internet. HTTP pages should have a big red alert on them, and browsers are very slowly but surely moving in a direction of being HTTPS by default and HTTPS-only in the limite…

Why does everything need to be secure? A random blog doesn't need to be secure. Or a random personal website. In fact, regular HTTP is preferable there because it's faster, so it consumes less power and it can run on lower-spec machines. (No need to decrypt anything.)

Case in point.

This comment is the reason why browsers don't currently display giant warnings in front of HTTP pages even though they do arguably imply even less security than self-signed certificates. It has nothing to do with a browser conspiracy or narrative about "trusted" certs; browsers have largely been moving in a positive direction on that front.

Re: Let's Encrypt issues 35 certs every second

#27

Post by tracker1 »

eatsyourtacos wrote: post #10

As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?

It really comes down to automation... I've mostly used Caddy as a host and reverse-proxy for personal stuff, as well as in a couple workplace projects, the support for named domains is well baked in, and there are extensions for plugging into various dns providers if you want broader wildcard options.

Re: Let's Encrypt issues 35 certs every second

#28

Post by BrandoElFollito »

Kraftwurm wrote: post #6
tracker1 wrote: post #2

Let's Encrypt has definitely been a net positive to the internet as a whole. I do wish more services/tools had cleaner integration. I've switched to mostly using Caddy for personal web and reverse proxy chores as it's just much easier to deal with imo.

Caddy ist just awesome. I regularly wonder why most online tutorials don't use it. Because it just works and is so much easier to work with than all the alternatives.

Fully agree. The community is usually very nice to work with (especially mholt).

Re: Let's Encrypt issues 35 certs every second

#29

Post by BrandoElFollito »

jiggawatts wrote: post #17

To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free. A Raspberry Pi could serve this. Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually. The reality…

You can have wildcard certificates from LE too.

Re: Let's Encrypt issues 35 certs every second

#30

Post by BrandoElFollito »

eatsyourtacos wrote: post #10

As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?

You should give it a try to Caddy. You won't have anything to manage, everything is done for you behind the scenes.

Use it as a reverse proxy to your services

Post reply on HN