Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt has issued its first million certificates

eff.org

Post reply on HN
Print view View original

131–140 of 156 posts

Re: Let's Encrypt has issued its first million certificates

#131

Post by warrenm »

tallanvor wrote: post #36
kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

I doubt it. CAs still have EV, wildcard, email, and code signing certificates that are often twice as expensive (or more) than their DV offerings. And some people will choose to pay for a DV cert just so they don't have to swap them out every 3 months anyway.

What does updating every 3 months matter when you can cron the renewal?

Re: Let's Encrypt has issued its first million certificates

#132

Post by warrenm »

pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

>"automating it is not an option in my use case"

Then you're doing it wrong - there is no reason you shouldn't be able to automate it that I can envision

Re: Let's Encrypt has issued its first million certificates

#134

Post by frutiger »

nly wrote: post #37
tokenizerrr wrote: post #31

Earlier quoted context omitted.

What are you talking about? My nginx ssl config is static as well. It looks at a specific path for my certs, which just happens to be a symlink managed my by letsencrypt tooling. You're going to have to renew anyway. Previously you would have to remember to do that once a year, or maybe once every two years. Now let's ignore the security implications of having certificates that are valid for a year for a moment, and…

"Once" assuming nothing randomly breaks while you're not looking. What if your cronjob doesn't fire? What if LEs script has a bug and you're not up to date? What if one of the (Python?) dependencies has a bug or breaks? What if LEs servers are being DDoS'd? Can you enumerate and account for all the failure scenarios? I've already botched things with acme-tiny&LE in several different ways. I'm not claiming these risks…

> What if your cronjob doesn't fire? What if LEs script has a bug and you're not up to date? What if one of the (Python?) dependencies has a bug or breaks? What if LEs servers are being DDoS'd? Can you enumerate and account for all the failure scenarios?

I run my cron job[1] every hour. It checks for the expiry of my existing set of certificates and has a configurable parameter as to how soon before expiry to renew them.

[1] https://github.com/frutiger/concorde

Re: Let's Encrypt has issued its first million certificates

#135

Post by nickblah »

ultramancool wrote: post #103
nly wrote: post #29

Earlier quoted context omitted.

I personally find the hassle of installing, configuring and, crucially, testing , both LetsEncrypts scripts, and an accompanying cronjob, much more work and worry than a static nginx ssl config.

I'm in the same boat - especially because I need wildcard certificates (or just lots of certs). I'm thinking the only thing that would really fix this is an nginx module that would automatically fetch certificates for domains when they're first requested via SNI. First hit takes some time, then it's cached and refreshed once a month or something... it would effectively mean 0 configuration SSL for all new domains.

If you can use OpenResty (nginx+Lua), then that's exactly the approach I've taken for a plugin I've been developing recently (SNI, on-demand, and caching): https://github.com/GUI/lua-resty-auto-ssl There's still a couple loose ends to tie up, but we've been using it on production for a few weeks now, and it's been refreshingly nice to not worry about SSL for new domains.

Regarding the 5 requests per week, I believe that's only for repeated re-issuances of the same domain. As long as you cache the certs, then this shouldn't be an issue. Registering new certificates for new domains is limited to 500 per 3 hours: https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

Re: Let's Encrypt has issued its first million certificates

#136

Post by awqrre »

mholt wrote: post #75
awqrre wrote: post #72

Earlier quoted context omitted.

How is a binary simpler then a script?

True Go binaries like lego[1] are statically compiled (zero external dependencies). No need to fuss about versions of installed dependencies, updates, package management, etc. You just run the binary and it just works. [1]: https://github.com/xenolf/lego

Can't you package a script with all required dependencies, including the interpreter?

Re: Let's Encrypt has issued its first million certificates

#137

Post by icebraining »

siquick wrote: post #133

What are the benefits of using LE over Cloudflares HTTPS?

End-to-end security - even if the path between the client and CF itself is secure & authenticated, you need a valid cert (like from LE) to secure & authenticate the path between CF and your server - what they call "Full SSL (strict)."

Re: Let's Encrypt has issued its first million certificates

#138

Post by vincentleeuwen »

mholt wrote: post #71
StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

> I'd gladly pay 10% more for my cert if it meant my server could renew automatically without me touching it at all. I wrote a server that does this. Would be happy to have your feedback sometime: https://caddyserver.com - here's how it works with regards to Let's Encrypt certs: https://www.youtube.com/watch?v=OE5UhQGg_Fo&t=32m

Found this tutorial yesterday about how to do it with letsencrypt https://www.digitalocean.com/community/tutorials/how-to-secu...

Re: Let's Encrypt has issued its first million certificates

#139

Post by techload »

thinkcontext wrote: post #127
ohitsdom wrote: post #85

I host many small sites on a $10/month shared server with a typical LAMP stack host. Unfortunately, SSH access is limited so I keep running into issues getting Let's Encrypt running. Has anyone else run into any issues? Not looking for step-by-step help, just wondering if I'm alone. I have seen paid software promising to solve this [0], but I'd rather not pay to get a free certificate. [0] https://letsencrypt-for-cpa…

Get a shared host that supports Lets Encrypt, there are many. https://github.com/letsencrypt/letsencrypt/wiki/Web-Hosting-...

Crocweb is missing from this list.

Re: Let's Encrypt has issued its first million certificates

#140

Post by vincentleeuwen »

antouank wrote: post #122
tokenizerrr wrote: post #31

Earlier quoted context omitted.

What are you talking about? My nginx ssl config is static as well. It looks at a specific path for my certs, which just happens to be a symlink managed my by letsencrypt tooling. You're going to have to renew anyway. Previously you would have to remember to do that once a year, or maybe once every two years. Now let's ignore the security implications of having certificates that are valid for a year for a moment, and…

Can you update the certificate without taking down your nginx server? I assume you need port 443 for LE to verify your domain, right? Can you use a different port?

https://www.digitalocean.com/community/tutorials/how-to-secu...
Post reply on HN