Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt to transition to ISRG root

scotthelme.co.uk

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Let’s Encrypt to transition to ISRG root

#101

Post by panarky »

nacs wrote: post #98
panarky wrote: post #96

Earlier quoted context omitted.

I built an app that's used on thousands of Android devices in an industrial setting. Most of the devices were acquired last year. Just tested with the new LE root cert and it doesn't work. LE says "it's CA problem, not a Let's Encrypt problem", but that's disingenuous. Let's Encrypt chose to get cross-signed by a root that expires in a couple years. For example, HN's root doesn't expire until 2038. This is definitely…

> I built an app that's used on thousands of Android devices in an industrial setting If its that important to you or if its a commercial offering in an 'industrial setting', you should have no problems acquiring a cheap SSL certificate from another source. You can literally get them as low as $6 a year right now. LE provides a great service and continues to do so. If you want to nitpick, then jump to a 'competitor'.

> If you want to nitpick, then jump to a 'competitor'

Sure, I can solve the problem by switching to a different CA, or by adding the ISRG root cert to each device.

But this is a problem that didn't need to happen. I blame myself for not anticipating it when I selected LE.

And I blame LE for cross-signing with a root cert that expires so soon. Not a good choice for a new CA that will take many years to be trusted on most devices.

Re: Let’s Encrypt to transition to ISRG root

#102

Post by AnssiH »

Interesting that the referenced Let's Encrypt post from 2018 (https://letsencrypt.org/2018/08/06/trusted-by-all-major-root...) said

"Some will not, and we’ll need to wait for the vast majority of those to cycle out of the Web ecosystem. We expect this will take at least five more years, so we plan to use a cross signature until then."

So half a year ago they expected to continue cross-signing for 5+ years. What changed?

Re: Let’s Encrypt to transition to ISRG root

#103

Post by Ajedi32 »

AnssiH wrote: post #102

Interesting that the referenced Let's Encrypt post from 2018 ( https://letsencrypt.org/2018/08/06/trusted-by-all-major-root... ) said "Some will not, and we’ll need to wait for the vast majority of those to cycle out of the Web ecosystem. We expect this will take at least five more years, so we plan to use a cross signature until then." So half a year ago they expected to continue cross-signing for 5+ years. What cha…

For what it's worth, you'll still be able to use the old roots for another two and a half years (until September 29, 2021), which is not quite five years from the date of that old post, but also way longer than half a year.

Re: Let’s Encrypt to transition to ISRG root

#104

Post by AnssiH »

Ajedi32 wrote: post #103
AnssiH wrote: post #102

Interesting that the referenced Let's Encrypt post from 2018 ( https://letsencrypt.org/2018/08/06/trusted-by-all-major-root... ) said "Some will not, and we’ll need to wait for the vast majority of those to cycle out of the Web ecosystem. We expect this will take at least five more years, so we plan to use a cross signature until then." So half a year ago they expected to continue cross-signing for 5+ years. What cha…

For what it's worth, you'll still be able to use the old roots for another two and a half years (until September 29, 2021), which is not quite five years from the date of that old post, but also way longer than half a year.

I wonder what Google will do with their Cloud Platform Google-managed SSL certificates that have used Let's Encrypt so far...

But I guess in the worst case I can just buy traditional certificates for a couple of years.

Re: Let’s Encrypt to transition to ISRG root

#105

Post by randombit »

nacs wrote: post #99
randombit wrote: post #76

Earlier quoted context omitted.

Tried the test site on a Nexus 7 running Android 6.0.1, Firefox was ok (seems it ships with its own list of roots), but latest Chrome rejected it. My wife runs a blog which generates substantial income and uses certs from Let's Encrypt. It's a non-tech blog with primarily US readership. Checking stats for this month, 7% of all visitors were using Android 4/5/6 (20% of all Android users). The percentage of users on ol…

> a blog which generates substantial income An SSL cert can be purchased for as low as $6 a year; if this is important to you, try buying one of those.

Isn't that what I said?

Edit: fortunately it looks like certbot plans to support using the old intermediate https://github.com/certbot/certbot/issues/6971 so this should not prove necessary.

Re: Let’s Encrypt to transition to ISRG root

#106

Post by tialaramex »

ilaksh wrote: post #95

How exactly would I set up my files or nginx config to use the old root?

You don't need to "use" the old root, you want to configure the chain of certificates provided so that it links back from your leaf cert to Identrust's "DST Root CA X3" not "ISRG Root X1". Specifically the chain will be just one cert, an "intermediate" which you want to ensure is the one cross-signed not the new one.

This provides a hint to the client that it should trust this certificate because it can follow the trust back down the chain to DST Root CA X3 (which it trusts) not to ISRG Root X1 which is too new-fangled for it to have heard of.

This page has both flavours of intermediate:

https://letsencrypt.org/certificates/

You want the one labelled: Let’s Encrypt Authority X3 (IdenTrust cross-signed)

In nginx you need to concatenate the leaf certificate from Let's Encrypt (often a file named "cert.pem") with the file you downloaded from that site, to produce a chain, which you could call mychain.pem, and then tell nginx that's your certificate chain with a config line like:

ssl_certificate /some/path/to/mychain.pem

where right now you may see

ssl_certificate /where/letsencrypt/puts/fullchain.pem

Re: Let’s Encrypt to transition to ISRG root

#107

Post by londons_explore »

panarky wrote: post #94
pcnix wrote: post #49

Earlier quoted context omitted.

This is because the IdenTrust root is expiring though, it's not something LetsEncrypt can do anything about.

> it's not something LetsEncrypt can do anything about This is going to cause a lot of stuff to break, and it's 100% LE's responsibility. HN's root cert is valid through 2038. LE could have gotten cross-signed by a cert that didn't expire so soon, but they didn't.

> LE could have gotten cross-signed by a cert that didn't expire so soon, but they didn't.

And they still could.

Re: Let’s Encrypt to transition to ISRG root

#108

Post by londons_explore »

tomschlick wrote: post #85
pard68 wrote: post #67

Earlier quoted context omitted.

Work for a university. We have a number of students in Africa, southeast Asia, and eastern Europe taking online courses. We do not support Windows XP or Vista, except for in the case of these students. Some of these guys don't have the resources for anything else. I also know that we get a number of students connecting with Android v3 or earlier from these same locales.

Something like Ubuntu sounds like a great fit then.

Modern ubuntu is getting pretty heavyweight. Gone are the days it'll run on any old laptop.

Re: Let’s Encrypt to transition to ISRG root

#109

Post by profmonocle »

pcnix wrote: post #49
londons_explore wrote: post #42

Earlier quoted context omitted.

The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…

This is because the IdenTrust root is expiring though, it's not something LetsEncrypt can do anything about.

They could get a new cross-signed intermediate from a root with broader compatibility.

Though I imagine that's extremely expensive. I expect that has something to do with this decision - they are a non-profit after all.

Re: Let’s Encrypt to transition to ISRG root

#110

Post by blattimwind »

AnssiH wrote: post #104
Ajedi32 wrote: post #103

Earlier quoted context omitted.

For what it's worth, you'll still be able to use the old roots for another two and a half years (until September 29, 2021), which is not quite five years from the date of that old post, but also way longer than half a year.

I wonder what Google will do with their Cloud Platform Google-managed SSL certificates that have used Let's Encrypt so far... But I guess in the worst case I can just buy traditional certificates for a couple of years.

You can literally exchange the certificates manually in the chain delivered by your webserver using a text editor.
Post reply on HN