Does it deal with the case of SaaS apps for customer domains? Eg. Customer example.com rocks up to my SaaS app and wants to use myapp.example.com - currently creating
Let's Encrypt: How It Works
91–100 of 123 posts
Re: Let's Encrypt: How It Works
#92Earlier quoted context omitted.
We're working on an FAQ. This thread has been really helpful in clarifying which Qs are FA :) With regard to your questions: > Will it provide wildcard certs? Not initially, but possibly in a future iteration. Note that having an automatic CA addresses some of the use cases for wildcard certs. Namely, if you're using a wildcard cert just to avoid having to manage individual certs for foo-1.example.com through foo-N.e…
Not initially, but possibly in a future iteration. OK, good to know. Ultimately, in addition to these tools, it would be great to have ACME / LE support built into web server platforms, which are already running all the time. I see, thanks, hence the emphasis on protocol not product. Great idea, let's hope it takes off, it'd be really nice to be able to just add a config for ssl_on and let the server deal with the re…
> I don't know what the story is with that site
Turns out they had the wrong certificate chain provisioned. Seems to be fixed now.
Re: Let's Encrypt: How It Works
#93Here's a question I haven't seen anyone ask: What about email servers (SMTP/IMAP)? I need a good cert for that more than I do for https, personally. I could obviously have a web server up just to succeed at the challenge/response and get a certificate, but I actually just try to avoid running webservers at all these days, to be honest. I'm also not 100% that certificate would work.
The technical overview mentions that there can be various different kinds of challenges, so presumably you could use a DNS based one or even an email based one if it's implemented.
That's correct. Also, if you've got an A/AAAA record for the domain name in question, you could run an ACME client on that box that spins up a temporary web server. That's what the node-acme demo client does.
https://github.com/letsencrypt/node-acme/blob/master/lib/acm...
Re: Let's Encrypt: How It Works
#94Can someone clarify whether LE will check if there is already a signed SSL cert for the domain, and it contains the same information? For example, via the SSL Observatory? Doing this would prevent a point in time vulnerability in DNS (temporary mitm showing a different IP for the domain) or direct mitm of the connection to the webserver. Otherwise the attacker could get a signed cert for https://peacenik.org , and th…
Yes, we plan to apply a few mitigations of this type. Part of the idea of the "Proof of Possession of a Prior Key" challenge is so that if a web server requests a cert for a domain with an existing certificate, we can ask them to prove that they hold that certificate. https://github.com/letsencrypt/acme-spec/blob/master/draft-b...
This is a horrible idea... I have numerous certs for my domain and collecting them all to prove to you I own them is not going to be fun.
Re: Let's Encrypt: How It Works
#95So is this something I can use in place of an auto-generated self-signed certificate for that headless linux box that I have running in the back of my closet and which I optimistically refer to as "my web server"?
Re: Let's Encrypt: How It Works
#96Re: Let's Encrypt: How It Works
#97Can it be used with tor to sign .onion hidden sites?
Re: Let's Encrypt: How It Works
#98Great project to smooth out the really painful process at present for acquiring certs. How about an FAQ page or a few clarifications? Things I wanted to know which were not immediately apparent: Will it be broadly accepted from day one? Yes, apparently, though see the identrust issue below. Will it generate a keypair but keep the private key on your server? Yes. Will it work without having to babysit an interactive p…
https://www.identrustssl.com/ authenticates fine for me in both Firefox and Chrome, and the certificate issuers for both that site and https://letsencrypt.org/ is in fact the same. I did notice that the IdentTrustSSL certificate has been issued yesterday , so this might be an issue of wrong clocks on your end.
They fixed it a few hours after my comment
Re: Let's Encrypt: How It Works
#99So is this something I can use in place of an auto-generated self-signed certificate for that headless linux box that I have running in the back of my closet and which I optimistically refer to as "my web server"?
You can use startssl for that right now. They provide one year free noncommercial certs. By the time that one expires letsencrypt will be live.
Re: Let's Encrypt: How It Works
#100Earlier quoted context omitted.
I don't think EV SSL certificates have been a big success (though that's just a personal opinion rather something backed with specific data) For me the differentiation in the browser presentation of EV against ordinary SSL doesn't provide much additional security. Most users don't notice the difference and even if they do, wouldn't remember which sites had an EV certificate, such that they would notice it changing ba…
I wouldn't login to my bank's website if it didn't present me with green EV url bar. Same with paypal, amazon and basically anything to do with money has to have EV for me. I might be slightly paranoid, but I thought the point of ssl was EV.
Amazon doesn't have an EV cert.