Which browsers will trust Let's Encrypt certificates out of the box? There may be a major backwards compatibility gap here.
Let's Encrypt: How It Works
11–20 of 123 posts
Re: Let's Encrypt: How It Works
#12It seems like the one thing this doesn't/can't address is the IP shortage. Does help much if example.com is virtual hosted on the same IP address as 100 other sites?
This really isn't a problem any more with SNI. With XP dying out, there's really no excuse anymore to not use it for shared hosting.
Python 2.7 (no SNI support) is the new Windows XP. Not a browser problem, but if you're building an API, it will lock people out.
(sorry to beat a dead horse, but it's burned me recently and I think people are flipping the https only switch without awareness or consideration. doesn't mean "don't switch", but be aware.)
Re: Let's Encrypt: How It Works
#13Keep track of when your certificate is going to expire, and automatically renew it.
Or, all you have to do is let this new piece of software run periodically on your secure server. What could possibly go wrong?
Re: Let's Encrypt: How It Works
#14Keep track of when your certificate is going to expire, and automatically renew it. Or, all you have to do is let this new piece of software run periodically on your secure server. What could possibly go wrong?
Why so negative? Don't you think this is much better than the very manual ways that we now have?
Automate it. Make it part of your maintenance scripts. Put it in a cron job. I think it will be a huge step forward.
Re: Let's Encrypt: How It Works
#15What kind of impact is Let's Encrypt going to have on the CA industry? I'm not that familiar with the current state of the CA companies, nor do I understand this industry well enough to know if this is going to be a major hit to them or not. Is there any reason why a company would prefer a CA other than Let's Encrypt?
Insurance, guarantees, EV certs, doing business with a big trusted company. All reasons to stay with your regular CA.
(Personally I don't care about any of those reasons - I just want my website to be SSL powered with an official cert and modern cipher configuration.)
Re: Let's Encrypt: How It Works
#16What kind of impact is Let's Encrypt going to have on the CA industry? I'm not that familiar with the current state of the CA companies, nor do I understand this industry well enough to know if this is going to be a major hit to them or not. Is there any reason why a company would prefer a CA other than Let's Encrypt?
The impact depends largely on their ability to get their root certificate into all of the browsers. It'll be interesting to see what happens with older versions of browsers as well, since if they start with a brand new root certificate then I'm not sure what happens with the older browsers.
If they can get their certificate into all of the browsers then it's possible they could achieve broad adoption for domain-verified certificates. There will still be a market for other validation types (organization validated and extended validation, for example) though.
Re: Let's Encrypt: How It Works
#17Sorry for the newbie question.... So if I have apache running http://example.com on port 80 and I follow the instructions ($ lets-encrypt example.com) Will Apache now be correctly serving encrypted traffic on port 443 with a cert for https://example.com ?
That's the idea. It assumes you are using an OS with a package manager, and letting it manage your software and (to some extent) config files.
And if you don't, or if you don't want to, it is easy to configure Apache or any web server manually.
All you really need are three things:
* the letsencrypt command line tool that will do the API dance to request the certificate
* a file in your web site root with a ownership verification token or a DNS record with said token
* a configuration file snippet for your server
I'm sure all of this will be documented very well.
Re: Let's Encrypt: How It Works
#18Which browsers will trust Let's Encrypt certificates out of the box? There may be a major backwards compatibility gap here.
I'm not sure why you've been downvoted. This is a very reasonable concern and one that should be addressed.
Re: Let's Encrypt: How It Works
#19Keep track of when your certificate is going to expire, and automatically renew it. Or, all you have to do is let this new piece of software run periodically on your secure server. What could possibly go wrong?
I take it you've read the source code of Apache and Nginx then and confirmed that they aren't doing anything malicious as well? :)
In any practical security system you are always going to have to trust that certain components are doing what they say they're doing. Fortunately, Let's Encrypt is from a reputable group, and sponsored by organizations with good reputations (Mozilla, EFF, etc.), which is about as good as you can hope for.
Re: Let's Encrypt: How It Works
#20Keep track of when your certificate is going to expire, and automatically renew it. Or, all you have to do is let this new piece of software run periodically on your secure server. What could possibly go wrong?
Why so negative? Don't you think this is much better than the very manual ways that we now have? Automate it. Make it part of your maintenance scripts. Put it in a cron job. I think it will be a huge step forward.
I think the OP was expressing concern over Let's Encrypt being installed on servers and potentially doing malicious things. Of course, if you apply this logic to Let's Encrypt you could just as well apply it to your web server or your mail server, or even your OS itself. At some point you just have to trust that the people and organizations that you're getting your software from aren't malicious... or you could write everything from scratch yourself.