Let's Encrypt has issued its first million certificates • Hacker News Board

Re: Let's Encrypt has issued its first million certificates

#21

Post by pingec » Tue, Mar 08, 2016, 1:46 PM UTC

Ao7bei3s wrote: post #5

pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

You're supposed to automate renewal. Since v0.4.0 all it takes is a "letsencrypt renew && apachectl graceful" in a daily cronjob (or, preferably, systemd timer), it handles the rest. Tweak as you like.

I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

Re: Let's Encrypt has issued its first million certificates

#22

Post by nly » Tue, Mar 08, 2016, 1:52 PM UTC

pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

Go get a free 3 year cert for up to 5 domains from WoSign then.

https://buy.wosign.com/free/

Re: Let's Encrypt has issued its first million certificates

#23

Post by _qhtn » Tue, Mar 08, 2016, 1:55 PM UTC

kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to.

So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification.

EDIT: I am very wrong.

Re: Let's Encrypt has issued its first million certificates

#24

Post by ptaffs » Tue, Mar 08, 2016, 1:56 PM UTC

nkuttler wrote: post #15

jqueryin wrote: post #8

Earlier quoted context omitted.

Assuming you use Apache. For many, it's simply not a fast enough web server without reverse proxies in front of it. Still crossing fingers for full nginx support soon.

I don't know, I don't want letsencrypt to touch my config files. It just works fine without that "magic" anyway if you're willing to add a few lines to a config file.

I agree, but i think the LE target audience is not you. Their whole thing is to be easy and use the "magic", to get the people who don't want to buy a certificate or deal with the config files, onto good encryption. I'm their audience and now my low-power volunteer run FM radio station website has HTTPS with a recognised CA.

Re: Let's Encrypt has issued its first million certificates

#25

Post by kcbanner » Tue, Mar 08, 2016, 1:59 PM UTC

pingec wrote: post #4

Do their certificates still expire in only 90 days? That makes them very unappealing to me :/ Edit: I understand and agree on why they made it like this. But automating it is not an option in my use case, oh well... I agree it's for the better in the grand scheme of things :).

Why?

Re: Let's Encrypt has issued its first million certificates

#26

Post by Sir_Cmpwn » Tue, Mar 08, 2016, 2:00 PM UTC

Given that LE does certificate transparency, would it be possible to find out what their millionth certificate was?

Re: Let's Encrypt has issued its first million certificates

#27

Post by XorNot » Tue, Mar 08, 2016, 2:05 PM UTC

The default LE client was kind of a pain to work with. The docker container was better but where it really helped was the Lego golang implementation. That one 'just works' and was super easy to setup behind nginx to run automatically. It also writes a nicer config dir.

Re: Let's Encrypt has issued its first million certificates

#28

Post by oliwarner » Tue, Mar 08, 2016, 2:05 PM UTC

_qhtn wrote: post #23

kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to. So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification. EDIT: I am very wrong.

This is incorrect, potentially in a few ways.

DVs are available from almost every CA. They're popular because they involve no paper checks which makes them cheap and fast. You don't need a company to get one, like you do with OV and EV.

DV should give some level of confidence that you're connecting with the owner of the domain name. CAs should make you go through a process that only a domain's controller could complete.

So I can't get a DV for paypal.com but I can get one for olipaypal.com if I own that domain. I can't get an OV or EV for either domain showing Paypal as the company unless I somehow manage to register that as a company name somewhere. Possible? Probably.

Re: Let's Encrypt has issued its first million certificates

#29

Post by nly » Tue, Mar 08, 2016, 2:06 PM UTC

StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

I personally find the hassle of installing, configuring and, crucially, testing, both LetsEncrypts scripts, and an accompanying cronjob, much more work and worry than a static nginx ssl config.

Re: Let's Encrypt has issued its first million certificates

#30

Post by kardos » Tue, Mar 08, 2016, 2:10 PM UTC

_qhtn wrote: post #23

kardos wrote: post #13

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to. So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification. EDIT: I am very wrong.

It looks [1] like some CAs depend heavily on DV certs (GoDaddy) while others do not (Digicert).

[1] http://www.netcraft.com/internet-data-mining/ssl-survey/