Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

111–120 of 263 posts

Re: Our First Certificate Is Now Live

#111

Post by MichaelGG »

AnthonyMouse wrote: post #103
mahouse wrote: post #75

I feel like these initiatives to make SSL available for everybody just lead to the same conclusion: EV will be the only viable alternative to show real trust, and EV is much, much more expensive than regular SSL ever was.

As far as I can tell EV certificates are completely worthless. You know the TLS certificate you got from bankofamerica.com is legitimately from bankofamerica.com because of domain validation. What EV tells you on top of that is only that bankofamerica.com belongs to Bank of America Corporation. But you already have that information . Their website is written on the walls of all their bank branches and all the documen…

The benefit is that if I get BankOfAmericaa.com and try to get an EV cert, the CA is going to verify my actual company name, which will unlikely be Bank of America or anything similar. So now when I trick someone into visiting my site, if the EV area doesn't tell them "Bank of America [US]" then they should double check. Or flip it around - if a user is unsure they can go off the EV info instead of the domain name.

In practise, since EV certs aren't used all over (say, WellsFargo doesn't use them), then the value is fairly diminished since lack of EV doesn't mean much.

Re: Our First Certificate Is Now Live

#112

Post by MrRadar »

charonn0 wrote: post #100

I checked the https demo using libcurl, and it failed unexpectedly with error code 35 (Unknown SSL connect error). I was expecting curl error 60 (untrusted certificate).

The test site requires SNI and only accepts TLS 1.1 and 1.2 with ECDHE/DHE+AES-GCM/AES-CBC ciphers[0]. I'm guessing whatever SSL library your libcurl is linked against only supports TLS 1.0, doesn't support SNI, or doesn't support any of those cipher suites (OpenSSL 0.9.x won't work with this site, for example).

[0]: https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le...

Re: Our First Certificate Is Now Live

#113

Post by Gregordinary »

ck2 wrote: post #23

Everyone repeat after me, wildcards, wildcards, wildcards. (just hoping they will appear next year) One more nail in the coffin of the ssl cert mafia.

Not sure if they'll amend their certificate policy or not. My guess is because their process is automated, they want to confine their certificate issuance to specific domains/sub-domains and not wildcards. It mitigates some repercussions in the event of a compromised cert.

Pg. 24 of the Certificate Policy:

For DV-SSL The Issuer DN of a DV-SSL Certificate shall be its Issuer’s subject DN. CAs shall include FQDNs or IP Addresses of the Device in the subject Alternative Name extension. The Subject Alternative Name extension may contain more than one instance of the name form. CAs may include a FQDN or IP Address in the subject DN for backwards compatibility, but this name shall be also included in the Subject Alternative Name extension. Wildcard names are not permitted

https://letsencrypt.org/documents/ISRG-CP-May-5-2015.pdf

Re: Our First Certificate Is Now Live

#114

Post by pjzedalis »

gboss wrote: post #107
pjzedalis wrote: post #90

Earlier quoted context omitted.

I think people are making too big of a deal of SSL. So what if my browser connection to Target or Home Depot is encrypted?

Well it's possible and reasonable that you don't want to have what products your browsing to be snooped on by some sort of MITM attack. While probably not from MITM snooping, Target found out a teenage girl was pregnant before her own parents, and sent her parent's address Diaper and Baby advertisements: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...

My point is all this work and it's only a small part of the equation.

Re: Our First Certificate Is Now Live

#115

Post by jessedhillon »

Killswitch wrote: post #85
nailer wrote: post #63

Earlier quoted context omitted.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

Yeah but still $234/yr for a certificate. While I appreciate what you're doing to make things more simple, that's pretty expensive. I can't wait until letsencrypt is done.

They offer EV certs, so there's some cost involved in doing the identity verification. I don't think it's $234 dollars a year, forever, but it costs something. And that's actually a pretty competitive price for an EV certificate.

Re: Our First Certificate Is Now Live

#116

Post by danellis »

bracewel wrote: post #36
ck2 wrote: post #23

Everyone repeat after me, wildcards, wildcards, wildcards. (just hoping they will appear next year) One more nail in the coffin of the ssl cert mafia.

The major problem with this is that the IETF validation working group hasn't come up with a definite procedure for deciding what the apex of a domain is, and how to validate control over all subdomains above it yet.

No? I thought I'd seen a list of them somewhere authoritative. Anyone know what I'm talking about?

Re: Our First Certificate Is Now Live

#118

Post by readme »

kolev wrote: post #79
nailer wrote: post #63

Earlier quoted context omitted.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

These shameless plugs are getting really annoying. We know about you, we know CloudFlare and Let's Encrypt are kinda competitors with their free certificates, but you don't have to comment on each post about them. Really, stop annoying us - it doesn't do you any good, honestly!

Who's us? I didn't know you represented me.

I actually had never heard of this and think it's pretty cool.

Re: Our First Certificate Is Now Live

#119

Post by stevewilhelm »

dragonwriter wrote: post #42
Someone1234 wrote: post #2

This is a tiny bit odd. So they have issued their first certificate, but they don't have cross-signing in place yet? So between now and november 16th they'll be issuing a whole bunch of effectively broken certificates unless people manually install their root CA? Why even push this today if you don't have cross-signing available? Without that Let's Encrypt is effectively broken out of the box. PS - I actually like Le…

You keep saying the word "broken" when nothing is broken at all, just the certificates are only useful in limited contexts.

Even a "useful in limited contexts" clock is right twice a day.

Re: Our First Certificate Is Now Live

#120

Post by wtetzner »

mahouse wrote: post #93
notatoad wrote: post #77

Earlier quoted context omitted.

But that's nothing new. If you need real trust, you need EV. The win from LetsEncrypt and any other attempt to make SSL more mainstream is the encryption, not the trust. If you're using SSL you're protected from some government and ISP snooping, and from having the contents of your message or webpage altered in mid-stream by a nefarious third party like AT&T.

Of course it's new. It's new since there are free certificates. Before, you had to pay, always. The amount was irrelevant, but you had to show your credit card. You had to prove your identity. That's a whole new felony there: stolen ID, carding, etc.

I don't see how it's a whole new felony. You could use your own credit card, and still convince the CA you own a domain that you don't.
Post reply on HN