Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

161–170 of 263 posts

Re: Our First Certificate Is Now Live

#161

Post by kojoru »

alcari wrote: post #88
MichaelGG wrote: post #78

Earlier quoted context omitted.

Wow the Firefox process to add a root is pretty simple! Downloading a file is more difficult. Adding an exception for a self-signed cert is scary. But adding a new root? Little popup, check a box and OK-you-go!

It's scary how easy it is to add new roots on all major platforms. You just click on the CA link and get a response with the appropriate MIME type back, then: * Windows gives you a helpful little wizard wherein you click "next" a few times. * Firefox gives you a dialog with 3 checkboxes; check them and click okay. * iOS sends you to settings, and asks you if you want to trust the given CA. * OS X hands it to Keychain…

You're incorrect about Windows. If you just click next several times the cert will not be added to trusted. To do that you'll have to override default settings in a non trivial way (deselect "Choose cert store automatically" and select the correct cert store) on one of the steps

I'm sure that's intentional design

Re: Our First Certificate Is Now Live

#164

Post by simula67 »

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

Re: Our First Certificate Is Now Live

#165

Post by nathan7 »

jonknee wrote: post #35

It's amazing that it takes a free provider to make things simple: https://letsencrypt.org/howitworks/ I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

SSLmate (https://sslmate.com/) actually makes things similarly simple — I've been using them for a few months now.

Re: Our First Certificate Is Now Live

#166

Post by superuser2 »

simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

We don't have humans in the loop for issuing certificate; this can and has been exploited for fun and profit, with fun attacks like getting a cert for "citibank.com\0.mydomain.com" which used to trick the C strcmp in most browser certificate checking routines. Moxie has an entertaining talk: https://www.youtube.com/watch?v=MFol6IMbZ7Y

Your problem would be getting people to "thecitibank.com." Chrome, Firefox, and GMail would all eventually figure out it was a phishing site and warn users about clicking through to it.

Re: Our First Certificate Is Now Live

#167

Post by cbg0 »

simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

Actually it's automated in most places, simply requiring you to confirm a request via an e-mail address associated with the domain you're getting an SSL for (typically admin@ hostmaster@ webmaster@, though it varies between certificate providers).

Re: Our First Certificate Is Now Live

#168

Post by pakitan »

simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

A valid certificate only allows you to have a secure connection without errors and warnings popping up all over. It does nothing to guarantee that the domain is "legit". You can already set up thecitibank.com and get an SSL certificate for it without any problem. What you can't do is get the EV (green bar) certificate where indeed you need to go through a human. But I'm pretty sure Let's Encrypt won't be giving away EV certificates.

Re: Our First Certificate Is Now Live

#169

Post by Russell91 »

simula67 wrote: post #164

Sorry for asking a potentially dumb question : but is it possible for me to set up a domain name thecitibank.com and ask letsencrypt to issue me a certificate ? I can then create a login page to steal IPINs. Isn't that why we have humans in the loop for issuing certificates ?

This comment is the exact perception about HTTPS that we need to change. It's not the job of HTTPS to say whether a website is safe or unsafe, good or bad. HTTPS should be the default communication protocol for every website, and lets encrypt move us a major step towards that by making SSL certificates free and trivial to set up.

Re: Our First Certificate Is Now Live

#170

Post by danellis »

cel wrote: post #152
danellis wrote: post #116

Earlier quoted context omitted.

No? I thought I'd seen a list of them somewhere authoritative. Anyone know what I'm talking about?

Yes, the Public Suffix List: https://publicsuffix.org/

That's definitely what I was thinking of, but it's not entirely suitable as a list of domains not to issue certificates for, unless you're happy to accept you won't be issuing certificates for domains like blogspot.com or flynn.io.
Post reply on HN