Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Years of Let's Encrypt

letsencrypt.org

Post reply on HN
Print view View original

281–290 of 361 posts

Re: 10 Years of Let's Encrypt

#281

Post by KronisLV »

crote wrote: post #174
greyface- wrote: post #32

Earlier quoted context omitted.

Their policy today is to grant certificates liberally. There is no technical guarantee that this remains the case indefinitely, only a political one. I don't doubt the sincerity of this guarantee, but I wish I didn't have to rely on it.

A big factor is that they are serving so many certs , with only a tiny amount of funding. Anything beyond the most basic pre-written list of blocked domain names is infeasible. Analyzing the content of every single domain would increase their resource needs by several orders of magnitude. That's reasonably close to a technical guarantee, if you ask me.

> That's reasonably close to a technical guarantee, if you ask me.

Until the feds show up like:

  Okay, either you block these domains, or you're going to jail:
  politician-x-did-something-bad.com
  politician-y-is-corrupt.com
  country-z-did-crimes-against-humanity.com
  political-opposition-party-w-homepage.com
  blog-that-mentions-any-of-the-above.com
  ... (rest of the list that works for 10 or 100'000 domains)
I complained about the centralization that reminds me of Cloudflare in another place, but in general the more distributed this sort of infra is, the better. Both for technical reasons, as well as political ones. In general, one can plan around potential risks like "Okay, what if I assume that this infra of mine is actually running in Russia and the govt hates me and I need to migrate."

VPSes and domains are pretty easy to move across country borders (e.g. moving from NameCheap to INWX and from something like AWS to Hetzner, at least for simple setups), less so when you don't control the CA.

Re: 10 Years of Let's Encrypt

#282

Post by KronisLV »

roflmaostc wrote: post #277
elnerd wrote: post #267

One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.

This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates? https://www.whois.com/whois/185.53.178.99

> What's the reason to issue so many SSL certificates?

Might be related to https://www.teaminternet.de/en/parkingcrew

Re: 10 Years of Let's Encrypt

#283

Post by bruce511 »

poguemahoney wrote: post #265
bruce511 wrote: post #238

Earlier quoted context omitted.

I think the best analogy for this are scams. Once a scammer finds a mark they'll pay, there's a desire to soak them for as much as they'll bear. EVs are not a scam per-se, but they also don't add any value. 80% of the world already figured that out, do by definition if you are asking you are in the bottom 20%. Now I get you were in the process of migration, but that's an edge case. In a normal case if you go around a…

I think you've left out the ecosystem of semi-scam, without that the decisions look less logical.. If you go and add a private rootCA to all your servers there are risks. You can convince yourself the risks are covered, you can convince a highly qualified security analyst. Can you convince a business intern with a checklist hired by a certification firm that underbid the one with specialists? 30K to engage with no on…

I'm not sure the alternative is sef-created RootCA. (But perhaps I don't understand the underlying case.)

To me, the alternative is just a LE cert. Can do wildcards via DNS challenge.

Re: 10 Years of Let's Encrypt

#284

Post by iso1631 »

crapple8430 wrote: post #158
mook wrote: post #91

Earlier quoted context omitted.

Yeah, I hate how it made housing things locally without a proper domain name very difficult. My router _shouldn't_ have a globally recognized certificate, because it's not on a publicly visible host. There's certainly advantages to easily available certificates, but that has enabled browsers and others to push too far; to be sure, though, that's not really a fault of Let's Encrypt, just the people who assume it's som…

A related issue is that most consumer devices (both iPhone and current Android) make it impossible or extremely difficult to trust your own root CA for signing such certs.

I don't want to trust my own root CA as I don't trust myself to keep it secure.

I want to important it only for a specific set of domains. "Allow this rootca to authenticate mydomain.com, addmanager.com, debuggingsite.com", which means even if compromised it won't be intercepting mybank.com

Re: 10 Years of Let's Encrypt

#285

Post by roflmaostc »

KronisLV wrote: post #282
roflmaostc wrote: post #277

Earlier quoted context omitted.

This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates? https://www.whois.com/whois/185.53.178.99

> What's the reason to issue so many SSL certificates? Might be related to https://www.teaminternet.de/en/parkingcrew

Interesting. Personally I find it questionable to squat so many domains for ads. But they pay for it and it is within the legal framework.

Re: 10 Years of Let's Encrypt

#286

Post by iso1631 »

KronisLV wrote: post #276

Cloudflare: "Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an…

If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway

That also gives you enough time to change to get your certs from elsewhere

As you mention zerossl exista, and I think google GCM will give you free certs too.

Globalsign has an ACME interface for paying customers, although I'm told it has issues (you have to rotate keys manually every X days / N certificates)

Re: 10 Years of Let's Encrypt

#287

Post by another-dave »

vbezhenar wrote: post #181
pedrozieg wrote: post #127

It’s easy to forget how awful TLS was before Let’s Encrypt: you’d pay per-hostname, file tickets, manually validate domains, and then babysit a 1-year cert renewal calendar. Today it’s basically “install an ACME client once and forget it” and the web quietly shifted from The impressive bit isn’t just the crypto, it’s that they attacked the operational problem: automation (ACME), good client ecosystem, and a nonprofit…

My experience was: get 3-year certificate for free, install it and forget about it. With LetsEncrypt, it's always pain, expired websites everywhere. Too bad that american IT mafia put these good CA out of business.

Literally all you have to do is configure a cronjob to renew the cert?

I've got a website I build for a friend running that I haven't touched in 5 years TLS-wise, never had any issues.

Re: 10 Years of Let's Encrypt

#288

Post by j16sdiz »

bentley wrote: post #185
letsgetreal wrote: post #172

Earlier quoted context omitted.

Nothing mentioned will help for a website with a Let's Encrypt SSL cert. How can I know with confidence that I can conduct commerce with this website that purports to be the company and it's not a typo squatter from North Korea? A google search doesn't cut it. Nothing in this thread has answered that basic question. It's a non-issue for DigiCert and Sectigo certs. I can click on the certs and see for myself that they…

Worse than typosquatting is EV’s problem that anyone can register a corporation with an identical name. https://web.archive.org/web/20171211181630/https://stripe.ia...

I think it is working as intended.

Register a corporation often meant it is linked to a real life, government issued ID.

If you do scam or fraud on that web site, they know where to find you.

... unless, of course, if the CA ain't doing the verification.....

Re: 10 Years of Let's Encrypt

#289

Post by a-l-e-c »

Gud wrote: post #256

I use Let’s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.

I only recently realized that Caddy by default uses LetsEncrypt and ZeroSSL, so seems like there already is an alternative. Haven't used it myself yet
Post reply on HN