Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

51–60 of 361 posts

Re: 10 Years of Let's Encrypt

#51

Post by unethical_ban »

btown wrote: post #24
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-ar...

EV validated not only that a domain was under control of the server requesting the cert, but that the domain was under control of the entity claiming it.

I kind of wish they still had it, and I kind of wish browsers indicated that a cert was signed by a global CA (real cert store trusted by the browsers) or an aftermarket CA, so people can see that their stuff is being decrypted by their company.

Re: 10 Years of Let's Encrypt

#52

Post by wnevets »

yabones wrote: post #38
btown wrote: post #24

Earlier quoted context omitted.

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-ar...

Call me old-school, but I really liked how EV certs looked in the browser. Same with the big green lock icon Firefox used to have. I know it's all theatrics at best and a scam at worst, but I really feel like it's a bit of a downgrade.

> Call me old-school, but I really liked how EV certs looked in the browser.

I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

Re: 10 Years of Let's Encrypt

#53

Post by [deleted] »

traceroute66 wrote: post #23
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

> has anyone actually commented to you in a negative way about using Let's Encrypt? A friend of mine has had a negative experience insofar as they are working for a small company, using maybe only 15–20 certs and one day they started getting hounded by Let's Encrypt multiple times on the email address they used for ACME registration. Let's Encrcypt were chasing donations and were promptly told where to stick it with…

[deleted]

Re: 10 Years of Let's Encrypt

#54

Post by chippiewill »

p2detar wrote: post #41
hulitu wrote: post #18

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45

Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?

Lets Encrypt are doing is because of the decision that CAs and browser makers made that it needs to be reduced (browsers have been reducing the length of certs that they trust).

The why is because it's safer: it reduces the validity period of private keys that could be used in a MITM attack if they're leaked. It also encourages automation of cert renewal which is also more secure. It also makes responding to incidents at certificate authorities more practical.

Re: 10 Years of Let's Encrypt

#55

Post by arccy »

unethical_ban wrote: post #51
btown wrote: post #24

Earlier quoted context omitted.

To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-ar...

EV validated not only that a domain was under control of the server requesting the cert, but that the domain was under control of the entity claiming it. I kind of wish they still had it, and I kind of wish browsers indicated that a cert was signed by a global CA (real cert store trusted by the browsers) or an aftermarket CA, so people can see that their stuff is being decrypted by their company.

you can find quite of few examples online that the entity check wasn't all that strict...

Re: 10 Years of Let's Encrypt

#56

Post by arccy »

wnevets wrote: post #52
yabones wrote: post #38

Earlier quoted context omitted.

Call me old-school, but I really liked how EV certs looked in the browser. Same with the big green lock icon Firefox used to have. I know it's all theatrics at best and a scam at worst, but I really feel like it's a bit of a downgrade.

> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

i think the point was that EV didn't actually mean anything because the checks were too loose. it's a feel good false sense of security

Re: 10 Years of Let's Encrypt

#57

Post by quesera »

bostik wrote: post #45
quesera wrote: post #33

Earlier quoted context omitted.

I've never seen (noticed) an OV cert in real life, and no business I've ever been responsible for pushed for OV over DV. It was always EV or "huh?"

I think I've seen one or two, and only because I noticed them as a weird callout in a $LARGE_FINANCE_INSTITUTION infosec bingo sheet. Of course I had to check that they really were running with OV certs. Some of the outfits in that space will be heavily hit by the shortening certificate max-lifetimes, and I do hope that the insurance companies at some point also stop demanding a cert rotation before 90 days to expiry…

> when their standard requirements are 15 years out of date

I swear half of my "compensating control" responses are just extended versions of "policy requirement is outdated or was always bad".

Re: 10 Years of Let's Encrypt

#58

Post by unethical_ban »

greyface- wrote: post #17

New baseline expectation that web traffic will be encrypted on the wire: very good! New de-facto requirement that you need to receive the blessing of a CA to make use of basic web platform features... not so good.

Kinda hear you, but DNS is a defacto requirement as well. Neither DNS (common TLDs) nor any of the major cert vendors I'm aware of ask you your site's business before issuing.

Re: 10 Years of Let's Encrypt

#59

Post by RonanSoleste »

wnevets wrote: post #52
yabones wrote: post #38

Earlier quoted context omitted.

Call me old-school, but I really liked how EV certs looked in the browser. Same with the big green lock icon Firefox used to have. I know it's all theatrics at best and a scam at worst, but I really feel like it's a bit of a downgrade.

> Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.

When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.
Post reply on HN