Let's Encrypt makes certs for 30% of web domains • Hacker News Board

Re: Let's Encrypt makes certs for 30% of web domains

#101

Post by chc » Sat, Sep 07, 2019, 12:49 AM UTC

manishsharan wrote: post #10

can someone please share how they deploy/distribute Let's encrypt certificates with auto renewal on load balanced multiple EC2 servers for the same dns name. I had tried this a while but had to give up and just bought SSL certs which I then include in my EC2 image.

We use Terraform to automate the actual generation of the certificates (it checks the expiration date and does a renewal request when you're 30 days away), but the basic approach we use is to generate the certificate with DNS validation, store it in a known location in S3, and then have the machines download the certificate on startup and refresh as a cronjob.

Re: Let's Encrypt makes certs for 30% of web domains

#102

Post by gator-io » Sat, Sep 07, 2019, 12:57 AM UTC

When LetsEncrypt came out, I wrote a service (free) that monitors LetsEncrypt certs externally and sends alerts when they are close to expiring. It can be used as a backup to the automatic emails that are sent:

https://letsmonitor.org

Re: Let's Encrypt makes certs for 30% of web domains

#103

Post by beatgammit » Sat, Sep 07, 2019, 1:06 AM UTC

jedberg wrote: post #59

aquabeagle wrote: post #24

Earlier quoted context omitted.

Let's Encrypt goes down, certs can't be renewed, people can't access websites securely (or at all if HSTS was used).

Good practice says that you should be renewing your certs when they have about 10% of their lifetime left, just in case this exact thing happens with whoever your provider might be. It's unlikely they would be down for so long that certs would actually expire.

What happens if their private key gets exposed? A third of the internet being suddenly insecure is a really scary prospect. If everything is automated, a lot of smaller sites may not notice until the certificate expires, or even for some time after that.

Having more options means less fallout if a CA gets compromised.

Re: Let's Encrypt makes certs for 30% of web domains

#104

Post by walrus01 » Sat, Sep 07, 2019, 1:26 AM UTC

tialaramex wrote: post #25

lsb wrote: post #2

Author here. I'd figured they were big, but I had no idea that big until I did a www-wide TLS scan. Here for questions

You list the ciphersuite that got chosen for each connection, but I think this could use at least a caveat explaining that the way this works means you'd need to do a LOT more work to figure out what the servers might have agreed to do for some other client. What I mean here is that TLS up until TLS 1.2 goes like this: Client: "Hi, I know ciphersuites A, B, C, D, E, F and G" Server: "OK, let's do C" And so you can't…

Given that the population of browser useragents that only understand TLS1.0 and TLS1.1 is under 1% now, I've set all of my public facing apache2 httpd to only speak TLS1.2 and better. Have had things that way for about two years now and with zero reported usability issues.

Re: Let's Encrypt makes certs for 30% of web domains

#105

Post by [deleted] » Sat, Sep 07, 2019, 1:26 AM UTC

sideshowmel wrote: post #50

Certbot is awesome! It really gives you no excuse not to provide https on your website.

[deleted]

Re: Let's Encrypt makes certs for 30% of web domains

#106

Post by hanoz » Sat, Sep 07, 2019, 1:27 AM UTC

Good. Now who's going to do the same for domain names? And why hasn't this happened yet?

Re: Let's Encrypt makes certs for 30% of web domains

#107

Post by nickpsecurity » Sat, Sep 07, 2019, 2:05 AM UTC

They give away paid products for free. Products that Google penalizes you for not having. Then, many people needing or wanting that product used their free alternative.

I still don’t know if that vs version with more paying customers is a good thing in long run. Good for now, though.

Re: Let's Encrypt makes certs for 30% of web domains

#108

Post by dannyw » Sat, Sep 07, 2019, 2:34 AM UTC

briffle wrote: post #67

tpmx wrote: post #6

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's encrypt is awesome because it's instantaneous! You'd think Google would understand that aspect. Edit: GCP people: Please give us a an explicit "retry" button to press when we've set up the DNS records. (I'm talking about the Google Cloud Balancing Service here.…

For GKE, in beta, you can tell the ingress to get a TLS certificate automatically. Google will manage the whole process. The weird thing is, it uses letsencrypt. Since Google has their own Root CA, that seemed like an interesting choice. [0] https://cloud.google.com/kubernetes-engine/docs/how-to/manag...

Maybe they don’t have a publicly available issuance (challenge/response, ACME, etc) infrastructure for their Root CA.

Or maybe they just want to keep google CA, limited to Google properties. The same way you put things in googleusercontent.com and not google.com.

Re: Let's Encrypt makes certs for 30% of web domains

#109

Post by prirun » Sat, Sep 07, 2019, 2:39 AM UTC

hanoz wrote: post #106

Good. Now who's going to do the same for domain names? And why hasn't this happened yet?

The thing that irks me about domain names is that registrars hold onto expired domain names and put them in their domain auctions. ICANN needs a new rule that registrars can't hang onto expired domain names for more than 30-90 days.

From https://www.godaddy.com/help/when-can-i-register-an-expired-...:

"If the domain name is not renewed, redeemed, or purchased through an auction, it is returned to its registry. The registry determines when the domain name is released again for registration."

Re: Let's Encrypt makes certs for 30% of web domains

#110

Post by mmalone » Sat, Sep 07, 2019, 2:44 AM UTC

jaas wrote: post #39

patmorgan23 wrote: post #28

Earlier quoted context omitted.

Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.

Just so people don't get an oversimplified view of what it takes to start a CA from this comment, you will have much bigger challenges than access to application software. Your first issue will be securing millions of dollars per year for the staff that it takes to run the CA responsibly. Your next issue will be getting trusted by browsers. Also, the open source Let's Encrypt CA software is tailored for how we do thi…

What do you think is a realistic estimate to get a new CA off the ground? Just the minimal cost for hardware and audits and whatnot to create the required artifacts and get them into the three major root programs. Not including staff and ongoing operational expenses (I can estimate that myself). I’ve heard it can be done for as little as $250,000.

Also, timeline. It took Let’s Encrypt a couple years to get in root programs and have good penetration, right? Would it be faster or slower now?

If someone was willing to undergo this ordeal and could secure funding so it wouldn’t split the philanthropic community and affect LE, would LE be willing to cross-sign (once they’re in good standing) to get them off the ground, the way IdenTrust did for the ISRG roots?

Asking for a friend ;)