Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milestone: 100M Certificates Issued

letsencrypt.org

Post reply on HN
Print view View original

111–120 of 197 posts

Re: Milestone: 100M Certificates Issued

#111

Post by cyphar »

Asdfbla wrote: post #108
koolba wrote: post #43

SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

Currently their only upside is that they provide wildcard (and EV) certificates. EV certs can't be automated for obvious reasons, but LE doesn't support wildcard certs because they don't believe there's a secure way of providing an automated way of getting them.

Given that traditional CA models don't actually have much more security than LE (in fact from personal experience they're far less secure), I wonder whether they should be in the business of providing wildcard certificates at all.

Re: Milestone: 100M Certificates Issued

#113

Post by corford »

TekMol wrote: post #99
breakingcups wrote: post #52

Earlier quoted context omitted.

In effect that is sort of what they are doing, but simpler. You claim to have domain x.com. LetsEncrypt sends you a token. Place it in a DNS record or in a pre-determined path on your domain and ask LetsEncrypt to read it back. If it matches, it is verified that you own the domain. How is the scheme you propose simpler, whilst retaining the same base guarantee (that the requester is the owner of the domain in questio…

> in a pre-determined path on your domain That would be easy and elegant. But they want you to install software on your server.

The only software you need is something that can speak the ACME protocol, which is what letsencrypt uses to receive your CSR (which you can generate yourself with openssl), issue challenge tokens and then (subject to you successfully passing the challenge) give you a certificate.

You don't necessarily have to do any of the above on the server for which you want the certificate. You can do it somewhere else and then transfer the resulting certificate to the intended host (either manually or with a shell script/ansible/puppet whatever).

Re: Milestone: 100M Certificates Issued

#114

Post by orf »

Asdfbla wrote: post #108
koolba wrote: post #43

SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

> What's the justification of traditional providers to charge for the certificates

They could, so they did.

Re: Milestone: 100M Certificates Issued

#115

Post by skybrian »

mirko22 wrote: post #100
skybrian wrote: post #91

Earlier quoted context omitted.

Security professionals tend to be motivated to work on improving security because they think it's important to protect users from the bad guys. And it's not like people have a sudden change of heart when joining Google.

But it is also not like you get to do what you want in big corporations. Rather you do what you have been told, and usually you might not even know the real reason. Also security professional is a person that know a lot about security, his intentions are not necessarily "good" for him to be considered a security professional in my opinion. Very good black hat hacker are also professionals.

That's rather more top-down than I've seen. There are large corporate initiatives, but many projects happen because someone thought it was a good idea and sold it to management.

Re: Milestone: 100M Certificates Issued

#116

Post by louiz »

TekMol wrote: post #99
breakingcups wrote: post #52

Earlier quoted context omitted.

In effect that is sort of what they are doing, but simpler. You claim to have domain x.com. LetsEncrypt sends you a token. Place it in a DNS record or in a pre-determined path on your domain and ask LetsEncrypt to read it back. If it matches, it is verified that you own the domain. How is the scheme you propose simpler, whilst retaining the same base guarantee (that the requester is the owner of the domain in questio…

> in a pre-determined path on your domain That would be easy and elegant. But they want you to install software on your server.

The software just negociates the token and such things, and communicates with EL to say “I want to have a certificate for such and such domains”.

But you can place these tokens on your webserver by hand if you want, in a pre-determined path.

Re: Milestone: 100M Certificates Issued

#117

Post by rmc »

Asdfbla wrote: post #108
koolba wrote: post #43

SSL certificate from a traditional provider valid for a year: $10. SSL certificate from a traditional provider valid for two years: $20. Automated SSL certificate generation and deployment via LetsEncrypt with zero human intervention and more importantly zero human intervention to renew it going forward - priceless . --- That's the real value for me. At $10/cert, that's not even a rounding error. But manually generat…

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

No-one did free which works in all browsers before.

Re: Milestone: 100M Certificates Issued

#118

Post by rmc »

Wasn't the Snowden releases part of the motivation for Let's Encrypt? If the web is "encryption for everything by default", then dragnet survellance from the NSA (etc) is much harder.

Re: Milestone: 100M Certificates Issued

#119

Post by eropple »

pfg wrote: post #103
the_common_man wrote: post #92

Earlier quoted context omitted.

LE already sends me notifications by email. What am I missing?

Let's Encrypt's renewal notifications don't cover cases where a new certificate was issued, but for some reason isn't being used by a server, perhaps because the ACME client ran into a problem, or because the server wasn't reloaded. It's useful, but it doesn't quite replace actual certificate expiration monitoring.

This smells like a problem in your server configuration management tooling, yeah?

Re: Milestone: 100M Certificates Issued

#120

Post by philliphaydon »

cyphar wrote: post #111
Asdfbla wrote: post #108

Earlier quoted context omitted.

What's the justification of traditional providers to charge for the certificates? Do they offer services or extended certificates that "Let's encrypt" doesn't or is it just a matter of "no one tried to offer it for free before"?

Currently their only upside is that they provide wildcard (and EV) certificates. EV certs can't be automated for obvious reasons, but LE doesn't support wildcard certs because they don't believe there's a secure way of providing an automated way of getting them. Given that traditional CA models don't actually have much more security than LE (in fact from personal experience they're far less secure), I wonder whether…

Why is providing wildcard certs not secure???? Amazon seems to do it?
Post reply on HN