You say milestone, I say hacker-noon.
Milestone: 100M Certificates Issued
101–110 of 197 posts
Re: Milestone: 100M Certificates Issued
#102Earlier quoted context omitted.
There is a nicely done 'how it works' on Let's Encrypt: https://letsencrypt.org/how-it-works/
I have read that, but it seems overly complicated. Why not just give the domain owner a private key and a script that is a few lines long. So he can sign a message from them and prove he has the key?
How do we know that the recipient of the key in your scenario (or the originator of the CSR) is in fact the domain owner? The domain contains contact information, but the exchange can't be done by email - that's not secure. Can't be done by SMS - that's not secure. We don't know them personally, so there's no obvious out-of-band technique that can be used.
We'd have to go back to physical snail mail using the address on the domain record, and/or notarization. Both of which of non-automated and very slow (relatively speaking).
Re: Milestone: 100M Certificates Issued
#103The biggest issue we've had is the short expirations. We have 51 certificates in our organization and do not want to rely on auto-renew. As our community project, we built a totally free to the public service to monitor certs and alert you when they get close to expiration or are invalid, etc: https://letsmonitor.org Feel free to use it for any certs.
LE already sends me notifications by email. What am I missing?
Let's Encrypt's renewal notifications don't cover cases where a new certificate was issued, but for some reason isn't being used by a server, perhaps because the ACME client ran into a problem, or because the server wasn't reloaded. It's useful, but it doesn't quite replace actual certificate expiration monitoring.
Re: Milestone: 100M Certificates Issued
#10499M PayPal certificates and counting...
[deleted]
Re: Milestone: 100M Certificates Issued
#105Genuine question: Are the other smaller cert-issuing services going out of business? If not, what has been their response to LetsEncrypt? Not that all of them should survive, there are a lot of crappy services that deserved this. But I'm just trying to place myself in their CEOs position and wondering how the game plan should be.
Go upmarket and sell EV certs or codesigning certificates.
There are some niches left even for DV like wildcard certs or longer validity periods.
Re: Milestone: 100M Certificates Issued
#106Earlier quoted context omitted.
In effect that is sort of what they are doing, but simpler. You claim to have domain x.com. LetsEncrypt sends you a token. Place it in a DNS record or in a pre-determined path on your domain and ask LetsEncrypt to read it back. If it matches, it is verified that you own the domain. How is the scheme you propose simpler, whilst retaining the same base guarantee (that the requester is the owner of the domain in questio…
> in a pre-determined path on your domain That would be easy and elegant. But they want you to install software on your server.
They want to make it easier, and that's the easiest way, but it's not required. You can perfectly well run it on your machine and copy the files manually to the server. You can even use a simple webpage as your local client: https://gethttpsforfree.com/
Re: Milestone: 100M Certificates Issued
#107SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…
It's even more painful when you're a web agency with lots of clients. Especially if they have hosting elsewhere and you don't have access to their emails. You have to contact your client and either get them to set up a specific email forwarder or inbox for you to access.
You then have to wait for them to respond back to you and you'll mostly get a reply with something like "I thought our emails were with you" or "We don't know who our provider is". Like, you're paying someone for some service, how can you not know who is providing you that service?
Then when they do finally set the email up, you have to go through the process which you just spoke about. It's such a pain, but with LE, it cuts all of this crap out and makes for happier businesses.
Re: Milestone: 100M Certificates Issued
#108SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…
What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?
Re: Milestone: 100M Certificates Issued
#109Nearly 20K of them for Paypal phishing sites and who knows how many for others. While a noble intention, one can't ignore the damage they've done.
[deleted]
Re: Milestone: 100M Certificates Issued
#110The biggest issue we've had is the short expirations. We have 51 certificates in our organization and do not want to rely on auto-renew. As our community project, we built a totally free to the public service to monitor certs and alert you when they get close to expiration or are invalid, etc: https://letsmonitor.org Feel free to use it for any certs.
Why would you not use the auto renew system?