Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

21–30 of 263 posts

Re: Our First Certificate Is Now Live

#21

Post by lifeisstillgood »

tokenizerrr wrote: post #14
lifeisstillgood wrote: post #10

To be honest I had not heard of them till now, and I am a bit confused even after reading some of their site... So if the difficult part of being a CA (which I think is verifying that I, Paul Brian, own and control the rights to barlcaysbank.com and should have a certificate in that name) if that bit is either not done (!) or is reliant on donations to be able to afford it, is this going to work?

This is not what regular style certificates verify. That is what Extended Validation certificates verify and they're not issued by letsencrypt.org and generally are a lot more expensive. The only thing that regular-style certificates verify (this is what current CAs do, you can also grab a free one with automatic validation at https://www.startssl.com/ ) is that the person who controls the domain name has requested t…

Well. I missed that memo. Or rather I kinda sorta knew it was getting devalued, but a Padlock in my browser is something I trust. If it's not trust worthy or verified should we not go the whole hog, dump trusted public keys from all browsers and move to the web-of-trust / certificate pinning.

From the blog:

   just too much of a hassle. The application process can be 
   confusing. It usually costs money. It’s tricky to install 
   correctly. It’s a pain to update.
If the reason there is not enough SSL around is because it's too much hassle for webmasters, I doubt there is a solution. If you want to take payments you get SSL. if that's too much hassle PCI compliance is going to really stretch you.

Re: Our First Certificate Is Now Live

#22

Post by callahad »

IgorPartola wrote: post #20
Someone1234 wrote: post #2

This is a tiny bit odd. So they have issued their first certificate, but they don't have cross-signing in place yet? So between now and november 16th they'll be issuing a whole bunch of effectively broken certificates unless people manually install their root CA? Why even push this today if you don't have cross-signing available? Without that Let's Encrypt is effectively broken out of the box. PS - I actually like Le…

According to TFA, Firefox already trusts this cert.

Incorrect. Inclusion into the Firefox root store is being tracked in https://bugzil.la/1204656 and has not yet been resolved.

Firefox trusts the cert on TFA because letsencrypt.org itself is using a certificate signed by IdenTrust.

Re: Our First Certificate Is Now Live

#24

Post by lifeisstillgood »

toomuchtodo wrote: post #18
tokenizerrr wrote: post #14

Earlier quoted context omitted.

This is not what regular style certificates verify. That is what Extended Validation certificates verify and they're not issued by letsencrypt.org and generally are a lot more expensive. The only thing that regular-style certificates verify (this is what current CAs do, you can also grab a free one with automatic validation at https://www.startssl.com/ ) is that the person who controls the domain name has requested t…

> This is not what regular style certificates verify. That is what Extended Validation certificates verify and they're not issued by letsencrypt.org and generally are a lot more expensive. I'd like to see LetsEncrypt move into this territory though. What current private business providers are charging for this service is border-line extortion.

But the certificate is (supposed) to say we have verified that this person / organisation exists and is "allowed" this domain.

Now if we extend the idea of every business or even human having their own (sub)-domain (lots of good benefits there) then we are in the territory of ensuring the CA's track you from birth - that's what governments do, and boy are they expensive.

I think what I am saying is we either have CA we can trust or we dump the whole thing and go to web of trust

Re: Our First Certificate Is Now Live

#26

Post by IgorPartola »

callahad wrote: post #22
IgorPartola wrote: post #20

Earlier quoted context omitted.

According to TFA, Firefox already trusts this cert.

Incorrect. Inclusion into the Firefox root store is being tracked in https://bugzil.la/1204656 and has not yet been resolved. Firefox trusts the cert on TFA because letsencrypt.org itself is using a certificate signed by IdenTrust.

Looking at http://helloworld.letsencrypt.org/ I see:

> Let's Encrypt hasn't yet been added as a trusted authority to the major browsers (that will be happening soon), so for now, you'll need to add the ISRG root certificate yourself. Specifics will depend on your browser. In Firefox, just click the link.

Re: Our First Certificate Is Now Live

#27

Post by hazz »

IgorPartola wrote: post #20
Someone1234 wrote: post #2

This is a tiny bit odd. So they have issued their first certificate, but they don't have cross-signing in place yet? So between now and november 16th they'll be issuing a whole bunch of effectively broken certificates unless people manually install their root CA? Why even push this today if you don't have cross-signing available? Without that Let's Encrypt is effectively broken out of the box. PS - I actually like Le…

According to TFA, Firefox already trusts this cert.

Firefox doesn't trust the cert yet. The application to be added to the root store is here https://bugzilla.mozilla.org/show_bug.cgi?id=1204656

Re: Our First Certificate Is Now Live

#29

Post by eloy »

callahad wrote: post #22
IgorPartola wrote: post #20

Earlier quoted context omitted.

According to TFA, Firefox already trusts this cert.

Incorrect. Inclusion into the Firefox root store is being tracked in https://bugzil.la/1204656 and has not yet been resolved. Firefox trusts the cert on TFA because letsencrypt.org itself is using a certificate signed by IdenTrust.

Hmm, that's taking a long time assuming Mozilla itself is involved in the project.

Re: Our First Certificate Is Now Live

#30

Post by hueving »

lifeisstillgood wrote: post #21
tokenizerrr wrote: post #14

Earlier quoted context omitted.

This is not what regular style certificates verify. That is what Extended Validation certificates verify and they're not issued by letsencrypt.org and generally are a lot more expensive. The only thing that regular-style certificates verify (this is what current CAs do, you can also grab a free one with automatic validation at https://www.startssl.com/ ) is that the person who controls the domain name has requested t…

Well. I missed that memo. Or rather I kinda sorta knew it was getting devalued, but a Padlock in my browser is something I trust . If it's not trust worthy or verified should we not go the whole hog, dump trusted public keys from all browsers and move to the web-of-trust / certificate pinning. From the blog: just too much of a hassle. The application process can be confusing. It usually costs money. It’s tricky to in…

The padlock means you are connecting to the owner of that domain. That's a very valuable guarantee.

EV validation and whatnot is essentially a nice way to burn a ton of money on borderline extortion.

Post reply on HN