Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

271–280 of 361 posts

Re: 10 Years of Let's Encrypt

#271

Post by cyberax »

tptacek wrote: post #207
cyberax wrote: post #204

Earlier quoted context omitted.

I mean, these are the steps that can bring it. And with Let's Encrypt as a safe fallback, it actually is feasible this time. Long shot? Yes. But not impossible.

The first step you'd need is a reliable way to deliver DNSSEC records to browsers, which does not currently exist. So I feel like you're missing at least a step 0, if not a step -1 (of getting ~anybody to actually sign zones.)

I sign my zones :)

The reliable way is DoH/DoT that are rapidly going to become the standard. They don't suffer from fragmentation issues, so they can reliably get the DNSSEC chain.

Or maybe the next step is putting the stapled response into the certificate. Perhaps it can even be used by Let's Encrypt as a part of the challenge, providing the incentive to get it right.

The original stapled DNSSEC experiment was suffering from misaligned incentives. CAs didn't care at all about it.

Re: 10 Years of Let's Encrypt

#272

Post by dustedcodes »

jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

> The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers".

Spoken like a true dinosaur. How can a certificate based on open, public and proven secure protocols be cheap?

> So my question: has anyone actually commented to you in a negative way about using Let's Encrypt?

No, but I personally judge businesses which claim to be tech savvy if they don’t have an ACME issued certificate, because to me that instantly shows I’m not dealing with someone who has kept up with technology for the last 10 years.

Re: 10 Years of Let's Encrypt

#273

Post by cyberax »

zeagle wrote: post #251
cyberax wrote: post #187

The next steps: 1. Add support for DNS-based persistent authentication: https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist... 2. Allow the user to just publish their public key into that TXT record. 3. Cut out the middleman and do the authentication directly in the browser. 4. DANE

For someone who runs a small personal website and uses LE to secure this + some web exposed services, could you explain how this is different/better than acme-dns-certbot?

Let's Encrypt is a single point of failure.

WebPKI also suffers from an inability to properly do delegation. It's not possible for me to create an intermediary certificate valid only for *.mycompany.com

If I want to use WebPKI, I have to either expose every host inside my company to everyone (via CT transparency logs) or use a wildcard certificate. And wildcard certs allow attackers to impersonate anything within my domain, if they get access to just one host.

X.509 technically supports name constraints ( https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 ), but its implementation was inconsistent. In particular, some implementations did not apply it to the Common Name. Fortunately, Common Name is on the path to deprecation.

Re: 10 Years of Let's Encrypt

#274

Post by jwr »

jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

Modern browsers are going out of their way to hide every bit of information about the website (including even the URL) — so I don't know how these customers would actually even find out what CA issued the certificate.

In Safari, I don't even know how to find that information anymore. When I want to check expiration dates for my own sites, I start Firefox.

Re: 10 Years of Let's Encrypt

#275

Post by rswail »

The pathetic part of EVs is that they should have been issued by whatever the business register/regulator is in the country of issue.

Not some arbitrary group like D&B etc.

The US/other countries should have ensured that each state/registration area had an appropriate cert to sign with.

It should be part of my company's annual registration/reporting expenses that they issue the appropriate certificate for "*...", signed by them (and by the TLD root cert of the nation of registration).

Re: 10 Years of Let's Encrypt

#276

Post by KronisLV »

Cloudflare: "Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!"

Let's Encrypt: crickets

Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an EU based one for example. If there's a lot of domain registrars, why doesn't every single one of them have ACME compatible services?

I think there was ZeroSSL but I vaguely remember something scummy about upsells there a few years back.

Re: 10 Years of Let's Encrypt

#277

Post by roflmaostc »

elnerd wrote: post #267

One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.

This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates?

https://www.whois.com/whois/185.53.178.99

Re: 10 Years of Let's Encrypt

#278

Post by eeixlk »

callumgare wrote: post #137
Decoy1008 wrote: post #31

I am so grateful for this. Bummer that they stopped with the email reminder, anyways I was wondering how this would work without active payments. Still amazing.

Out of interest why do you care? I assume you’re using acme to automate renewals. Is it in case that fails? Or do you work with some system that can’t be automated?

Literally just got bit by this. I added a wildcard domain to a cert servicing multiple sites. Apparently the verification process for wildcards is more onerous and even when you have it working it wont renew in the same way as a normal cert. It requires specific workarounds based on your dns provider. Appreciative that we moved away from paid certs that required manual work to renew every year but this feels like a mismanaged backslide.

Re: 10 Years of Let's Encrypt

#279

Post by raxxorraxor »

jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

I only hear justified praises of letsencrypt. Also thanks to the EFF and developers of certbot, which massively improved the toolchain around certificate deployment. Not the favorite activity for admins, but this made processes like certificate renewal/revokation much more convenient.

I think the portion of users that check a certificate after the browser treated it as secure is well smaller than 1%, probably well below 0.1%. And I guess these TLS connoisseurs have a positive inclination to letsencrypt as well.

Re: 10 Years of Let's Encrypt

#280

Post by bob778 »

jwr wrote: post #274
jjice wrote: post #5

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me beca…

Modern browsers are going out of their way to hide every bit of information about the website (including even the URL) — so I don't know how these customers would actually even find out what CA issued the certificate. In Safari, I don't even know how to find that information anymore. When I want to check expiration dates for my own sites, I start Firefox.

It’s the symbol to the left of the URL > Show Certificate. They even make it available on iOS Safari (Page Info > Connection Security Details), but if it’s expired, you’ll know by the big red warning page.
Post reply on HN