Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

91–100 of 361 posts

Re: 10 Years of Let's Encrypt

#91

Post by mook »

Analemma_ wrote: post #19
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; th…

Yeah, I hate how it made housing things locally without a proper domain name very difficult. My router _shouldn't_ have a globally recognized certificate, because it's not on a publicly visible host.

There's certainly advantages to easily available certificates, but that has enabled browsers and others to push too far; to be sure, though, that's not really a fault of Let's Encrypt, just the people who assume it's somehow globally applicable.

Re: 10 Years of Let's Encrypt

#92

Post by bifurcation »

p2detar wrote: post #41
hulitu wrote: post #18

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45

Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?

Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the broken state of revocation in the Web PKI. That latter point especially is what I understand to be driving the Web PKI toward ever-shorter lifetimes.

I actually remember the discussion we had in ~2014 about what the default certificate lifetime should be. My opening bid was two weeks -- roughly the lifetime of an OCSP response. The choice to issue certificates with 90 day lifetimes was still quite aggressive in 2015, but it was a compromise with an even more aggressive position.

Re: 10 Years of Let's Encrypt

#93

Post by charlesbarbier »

jsheard wrote: post #46
sam_lowry_ wrote: post #34

[flagged]

It's not like Let's Encrypt is the only game in town, Actalis in Italy provides free ACME certs too if you'd prefer to keep things in Europe.

Not sure if there is a point to "keep things in Europe" when it come to certificate authority.

- LetsEncrypt don't have the private key tied to your certificate - Any of the Certificate Authorities could potentially emit unauthorized certificate

Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter.

That said, it's pretty nice that LetsEncrypt forced the ACME protocol on this industry. Not only it create redundancy with mostly interchangeable alternatives but before ACME, there was no way to fully automate certificate provisioning cleanly.

Re: 10 Years of Let's Encrypt

#94

Post by matrss »

tadfisher wrote: post #84
unethical_ban wrote: post #51

Earlier quoted context omitted.

EV validated not only that a domain was under control of the server requesting the cert, but that the domain was under control of the entity claiming it. I kind of wish they still had it, and I kind of wish browsers indicated that a cert was signed by a global CA (real cert store trusted by the browsers) or an aftermarket CA, so people can see that their stuff is being decrypted by their company.

Problem is, I can easily set up a company and get an EV cert for "FooBar Technologies, LLC" and phish customers looking for "FooBar Incorporated" or "International FooBar Corp.". Approximately zero users know the actual entity name of the real FooBar.

Even if the users knew exactly what the name of the entity whose website they wanted to visit was: that name is not unique, as is shown by the "Stripe, Inc" example in the parents linked blog post.

Re: 10 Years of Let's Encrypt

#95

Post by bifurcation »

nvader wrote: post #65
hulitu wrote: post #18

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45

Wow, this might be the push I needed to automate certificate renewal on my personal website [0]. Manually clicking `make renew-cert` was barely tolerable every quarter, but if I have to do it twice as frequently I may as well ask an LLM to figure it out on my behalf. [0]: https://danverbraganza.com

Heh, as I was saying about shorter lifetimes encouraging automation...

https://news.ycombinator.com/item?id=46210786

Re: 10 Years of Let's Encrypt

#97

Post by dylan604 »

nvader wrote: post #65
hulitu wrote: post #18

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45

Wow, this might be the push I needed to automate certificate renewal on my personal website [0]. Manually clicking `make renew-cert` was barely tolerable every quarter, but if I have to do it twice as frequently I may as well ask an LLM to figure it out on my behalf. [0]: https://danverbraganza.com

And that is the very point of the short life span. One year certs had the potential of the person responsible for the cert no longer being the same person at time of renewal. Making it easy to automate so that it was just a cron task meant it didn't matter how often the person responsible changed.

Your pain and intolerance to that button push proves their intent.

Re: 10 Years of Let's Encrypt

#98

Post by tptacek »

ok123456 wrote: post #85
tptacek wrote: post #73

Earlier quoted context omitted.

This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how…

Yes. And I remember sniffing Facebook traffic in clear text in 2011. The fact remains that it was considered a significant engineering problem for them to deploy it. It was a "best practice" that most people rolled their eyes at. Most users and system owners didn't care unless money was being transacted. Between Snowden and ISPs injecting content into pages, the consensus changed.

The consensus obviously changed. It's just that it changed years before the Snowden leaks.

Re: 10 Years of Let's Encrypt

#99

Post by mikeyouse »

t1234s wrote: post #87

Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.

They're a nonprofit - so they can't be acquired like a typical for-profit company. They could in theory sell some assets but it'd be very convoluted if they were the core assets -- per US tax law, nonprofit assets must remain in the nonprofit world, so there's no risk of any tech company ruining them.

Re: 10 Years of Let's Encrypt

#100

Post by 8organicbits »

tptacek wrote: post #73
ok123456 wrote: post #66

Snowden was the other big reason that TLS became the de facto standard for every site. Prior to that, the consensus was that you only really needed TLS if you were dealing with money and wasn't worth the hassle otherwise. You could sniff traffic from Facebook and Twitter easily. I remember listening to a talk given by an IRS investigator in around 2008 about how they were able to do a sting and shutdown illegal inter…

This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how…

I'm not sure that refutes the idea that encryption was uncommon. A couple tech giants with challenging threat models will be ahead of the curve.

Google started tracking adoption of TLS in 2015, with adoption below 50% and some regions below 30%.

https://transparencyreport.google.com/https/overview?hl=en

Post reply on HN