Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

221–230 of 263 posts

Re: Our First Certificate Is Now Live

#221

Post by willejs »

toomuchtodo wrote: post #7
Someone1234 wrote: post #2

This is a tiny bit odd. So they have issued their first certificate, but they don't have cross-signing in place yet? So between now and november 16th they'll be issuing a whole bunch of effectively broken certificates unless people manually install their root CA? Why even push this today if you don't have cross-signing available? Without that Let's Encrypt is effectively broken out of the box. PS - I actually like Le…

Baby steps. This is a huge step forward, and I'm willing to cut them some slack considering they're about to shake up an entire industry. EDIT: Kudos everyone working on Let's Encrypt. You're doing awesome work.

+1, this is a huge step in the right direction.

Re: Our First Certificate Is Now Live

#222

Post by StavrosK »

pserwylo wrote: post #129
Killswitch wrote: post #85

Earlier quoted context omitted.

Yeah but still $234/yr for a certificate. While I appreciate what you're doing to make things more simple, that's pretty expensive. I can't wait until letsencrypt is done.

While I also look forward to letsencrypt being generally available, the fact your parent comment charges $234/yr for a cert is in response to: > I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

$10/yr to $234/yr is quite the jump.

Re: Our First Certificate Is Now Live

#223

Post by realityking »

AnthonyMouse wrote: post #137
MichaelGG wrote: post #111

Earlier quoted context omitted.

The benefit is that if I get BankOfAmericaa.com and try to get an EV cert, the CA is going to verify my actual company name, which will unlikely be Bank of America or anything similar. So now when I trick someone into visiting my site, if the EV area doesn't tell them "Bank of America [US]" then they should double check. Or flip it around - if a user is unsure they can go off the EV info instead of the domain name. I…

> The benefit is that if I get BankOfAmericaa.com and try to get an EV cert, the CA is going to verify my actual company name, which will unlikely be Bank of America or anything similar. So the first question is, why not? Can't someone file papers for a shell corporation with whatever name they like? Of course "Bank of Americaa Corp" is likely to raise questions, but is it not possible to BS your way through an EV ce…

Part of the label is also the country, if it says "Bank of America [AZ]" your alarms bells should start ringing.

Re: Our First Certificate Is Now Live

#224

Post by stullig »

throwaway7767 wrote: post #214
nailer wrote: post #212

Earlier quoted context omitted.

They'll need to pass a webtrust audit, which covers how they handle their key material amongst others. Additionally the Microsoft, Apple and Android roots have their own extra requirements added.

It always seemed odd to me how strictly CACert is treated given that TrustWave got a pass when they deliberately sold a root CA certificate for man-in-the-middle purposes. It's almost as if money is more important than key management practices.

Thanks for all the informed info. I was just always weirded out when my browsers forced me to perform 2-4 clicks because of untrusted connections when visiting websites of say the CCC (who just switched to StartSSL apparently).

Or the CACert website itself.

Always seemed to me like some kind of joke.

Re: Our First Certificate Is Now Live

#225

Post by EwanToo »

leesalminen wrote: post #87
nailer wrote: post #63

Earlier quoted context omitted.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

Is it possible to get a wildcard EV certificate?

No, which is why most of Google isn't running on EV certs..

Re: Our First Certificate Is Now Live

#227

Post by technion »

jsnk wrote: post #97
jonknee wrote: post #35

It's amazing that it takes a free provider to make things simple: https://letsencrypt.org/howitworks/ I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

Looks awesome! Does anyone know if there's an undo command for `$ letsencrypt run`? I would love to try this, but too scared to do it and mess up with my nginx configs.

For this specific reason I'm a lot more comfortable running the "nosudo"[0] variant, which tells you to install the keys yourself.

A recently released Ruby gem also looks promising, in that it's a much better codebase with a tonne of tests.[1].

[0] https://github.com/diafygi/letsencrypt-nosudo [1] https://github.com/unixcharles/acme-client

Re: Our First Certificate Is Now Live

#228

Post by zhte415 »

nailer wrote: post #184
kuschku wrote: post #82

Earlier quoted context omitted.

You might want to fix your webdesign: http://i.imgur.com/zQbWnUI.png And this is in Firefox, which renders fonts more bold than other browsers.

Edit: I've made some changes to Typekit to thicken things up. Is it better? If not, can you provide details of your OS? Original: I'll investigate and fix that now. What OS are you on so I can reproduce it? It looks this this here in Firefox ( http://imgur.com/WRWYzBx ) and this in Chrome ( http://imgur.com/6dFeQhG ) on OS X, testing across multiple Macs here. I'd really like to fix it though! Thanks for the heads up…

On the updated version, want to give some actionable feedback:

Not just the weight, the size combined with the weight: 12px in a thin font is too light for a screen, especially done in grey. Going to 16px could really make a difference.

Going with a bigger size gives the scope to use a different, contrasting (perhaps thicker, perhaps thicker and smaller for double-contrast?) font for the headings currently in green.

* Getting older happens to different people at different ages, one of the effects of this means eyes get more temperamental, and this doesn't happen 50+, it happens a lot earlier for a lot of people.

Re: Our First Certificate Is Now Live

#229

Post by rjaco31 »

johnnydoebk wrote: post #176
duskwuff wrote: post #171

Earlier quoted context omitted.

Most of the reputable CAs have some practices in place to check for keywords related to big brands and auto-reject certificate requests. (So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)

Could you provide a few examples of reputable and not so reputable CAs?

Just browse the truststore of your browser, you'd be surprised.

Re: Our First Certificate Is Now Live

#230

Post by nailer »

zhte415 wrote: post #228
nailer wrote: post #184

Earlier quoted context omitted.

Edit: I've made some changes to Typekit to thicken things up. Is it better? If not, can you provide details of your OS? Original: I'll investigate and fix that now. What OS are you on so I can reproduce it? It looks this this here in Firefox ( http://imgur.com/WRWYzBx ) and this in Chrome ( http://imgur.com/6dFeQhG ) on OS X, testing across multiple Macs here. I'd really like to fix it though! Thanks for the heads up…

On the updated version, want to give some actionable feedback: Not just the weight, the size combined with the weight: 12px in a thin font is too light for a screen, especially done in grey. Going to 16px could really make a difference. Going with a bigger size gives the scope to use a different, contrasting (perhaps thicker, perhaps thicker and smaller for double-contrast?) font for the headings currently in green.…

Thanks - I'm really grateful for the feedback - and would like it if you have any more.

I'll be changing the base font to 14px and darkening the grey to #222 quite soon.

I'll also look at 16px but this needs some additional design work.

Post reply on HN