Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt is Trusted

letsencrypt.org

Post reply on HN
Print view View original

171–180 of 318 posts

Re: Let's Encrypt is Trusted

#171

Post by sschueller »

mehrdada wrote: post #66
sarciszewski wrote: post #51

Earlier quoted context omitted.

Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl * StartSSL https://startssl.com * WoSign https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept…

They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction…

What would be the difference in using WoSign vs any other? If you use a CSR and not let them generate the private key I would think their certificates are identical to any other providers.

Re: Let's Encrypt is Trusted

#172

Post by EwanToo »

throwaway7767 wrote: post #168

Can someone who's tried the client confirm if it's possible to get a key/cert out of it without having it mess with my configuration files? I'd like a manual mode, as years of sysadmin work have made me extremely skeptical of tools that try to automatically modify config files.

There's various simple clients springing up already which do that

https://github.com/mail-in-a-box/letsencrypt_simpleclient

Re: Let's Encrypt is Trusted

#173

Post by vog »

throwaway7767 wrote: post #168

Can someone who's tried the client confirm if it's possible to get a key/cert out of it without having it mess with my configuration files? I'd like a manual mode, as years of sysadmin work have made me extremely skeptical of tools that try to automatically modify config files.

That was my initial impression, too.

However, as far as I understood, there is an API that will just hand out the certificate.

I guess they don't want it to be accessed by a web browser because they want us to regenerate and include a newer cert automatically.

So you have a somewhat higher setup cost (setup automatic cert update rather than one-time download of your cert), but then you can't forget to update your cert over the years.

I believe they also want this is be a fast desaster recovery. So if their main intermediate certficate is compromised, they can revoke it and hand out new certificates (using the backup intermediate cert) for all domains within a very short amount of time.

Nevertheless, I would have preferred a good explaination about how to setup this process manually, rather then depending solely on their tool.

(In case this process it too cumbersome without their tool, they should simplify it rather than hiding this in their tool.)

Re: Let's Encrypt is Trusted

#174

Post by robin_reala »

lorddoig wrote: post #81

Being told that you now trust someone with your secrets via a news website is a pleasingly succinct display of everything that's wrong with the CA model.

An encrypted communication channel specifically doesn’t say that you trust the person at the other end with your secrets. It means that you both agree that the secrets being transferred are safe from 3rd parties.

Re: Let's Encrypt is Trusted

#175

Post by RyanZAG »

flashman wrote: post #43
ubernostrum wrote: post #29

Earlier quoted context omitted.

Look at the tech overview: https://letsencrypt.org/howitworks/technology/ You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake…

> You can only obtain a certificate for a domain if you can validate that you control the domain. Technically, you only have to make their systems think you control the domain. If their servers or 'establish proof of ownership' process are hacked, wouldn't this allow an attacker to do the same thing that happened in the DigiNotar hack? https://en.wikipedia.org/wiki/DigiNotar

I asked this question the last time LetsEncrypt came up, and got a very good answer:

  M2Ys4U 35 days ago

  According to their 31C3 talk, they will use multiple 
  connections from multiple locations (possibly including 
  Tor?) to mitigate against these attacks.
So they validate it fairly extensively to make sure it really is the domain.

Re: Let's Encrypt is Trusted

#176

Post by technion »

throwaway7767 wrote: post #168

Can someone who's tried the client confirm if it's possible to get a key/cert out of it without having it mess with my configuration files? I'd like a manual mode, as years of sysadmin work have made me extremely skeptical of tools that try to automatically modify config files.

I have the same issue. I'm particularly partial to this edition:

https://github.com/unixcharles/acme-client

Re: Let's Encrypt is Trusted

#177

Post by ghshephard »

huskyr wrote: post #149
b3lvedere wrote: post #146

Earlier quoted context omitted.

I'm quite pleased with StartSSL. Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL. You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want. Only drawback is that the certificates a…

> it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.

"You can get certificates for $10/year nowadays."

As a service to the community, could you name some places where you can do that?

Re: Let's Encrypt is Trusted

#178

Post by vincentkriek »

huskyr wrote: post #149
b3lvedere wrote: post #146

Earlier quoted context omitted.

I'm quite pleased with StartSSL. Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL. You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want. Only drawback is that the certificates a…

> it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.

For example from: https://www.gogetssl.com/. Their site is pretty easy to work with and a lot better than startssl. It's worth the 7 bucks to me.

Re: Let's Encrypt is Trusted

#179

Post by nailer »

itistoday2 wrote: post #75
alfredxing wrote: post #22

Earlier quoted context omitted.

Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").

EV certs are a total waste of money. Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar.

Firefox, Safari and Edge also use a grey lock for domain validation certificates.

Re: Let's Encrypt is Trusted

#180

Post by scrollaway »

ghshephard wrote: post #177
huskyr wrote: post #149

Earlier quoted context omitted.

> it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.

"You can get certificates for $10/year nowadays." As a service to the community, could you name some places where you can do that?

https://www.namecheap.com/security/ssl-certificates.aspx
Post reply on HN