251–260 of 361 posts
The next steps: 1. Add support for DNS-based persistent authentication: https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist... 2. Allow the user to just publish their public key into that TXT record. 3. Cut out the middleman and do the authentication directly in the browser. 4. DANE
Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?
We’re in progress of adopting Vitess to shard into a handful of smaller instances, as our single big database is getting unwieldy.
As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.
Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?
https://github.com/letsencrypt/boulder You can find a docker-compose.yml file to get some idea. Appears to be using MariaDB. They shut down OCSP responders and expiry email reminders, so there really is no need to have a database apart from rate limits, auth data, and caching. For Certificate Transparency, they are submitted to Google and CloudFlare run trees but I don't think LetsEncrypt run their own logs.
Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?
Let’s Encrypt currently has a single primary with a handful of replicas, split across a primary and backup DC. We’re in progress of adopting Vitess to shard into a handful of smaller instances, as our single big database is getting unwieldy.
However, it is time for a second source of free certificates. It is not good that we rely on one supplier.
Earlier quoted context omitted.
> It would be a huge price-fixing scandal if Congress had any idea of how technology works. It's shady, but technically not price-fixing unless they are a monopoly. You are free to take your business to somewhere else.
If you read into Web.Com, yes, they are quickly becoming a monopoly on host companies. They do not disclose many of the hosting companies they now own. If you can find a company that allows clients to install Let's Encrypt Certs on shared hosting, please let me know.
I used DreamHost in the past and they had a configuration option in their control panel to automatically install and maintain a Let's Encrypt certificate on your behalf [1]. If you are stuck with Web.com you may consider using a reverse proxy/CDN such as CloudFlare.
[1] https://help.dreamhost.com/hc/en-us/articles/216539548-Addin...
Earlier quoted context omitted.
My experience was: get 3-year certificate for free, install it and forget about it. With LetsEncrypt, it's always pain, expired websites everywhere. Too bad that american IT mafia put these good CA out of business.
American IT Mafia? That provides free certificates? You'd think setting up renewal would be less of a hassle than dealing and paying CAs even if it's once every 3 years, so that would be a rather benevolent mafia. Which of those CAs went out of business by the way? Do you think Let's encrypt is less popular outside the US?
I think that the rest of the world does not have much choice, because US uses their IT superiority to force political decisions to the rest of the world. I experienced that first-hand. When my country wanted to implement MITM to improve Internet usability for their citizens, US companies blacklisted government root certificate which disrupted this scheme and forced my country to roll back this plan. Now I have lots of websites completely blocked, instead of more careful and precise per-page blocking that would only be possible with MITM.
Hopefully, over time, China and Russia will destroy this superiority and will provide viable alternatives.
Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.
They're a nonprofit - so they can't be acquired like a typical for-profit company. They could in theory sell some assets but it'd be very convoluted if they were the core assets -- per US tax law, nonprofit assets must remain in the nonprofit world, so there's no risk of any tech company ruining them.