SSL certs sound like something that should be in a blockchain. Why isnt it?
Because block chain is still new tech. Certs have been around for decades.
Let's Encrypt makes certs for 30% of web domains
31–40 of 147 posts
Re: Let's Encrypt makes certs for 30% of web domains
#32can someone please share how they deploy/distribute Let's encrypt certificates with auto renewal on load balanced multiple EC2 servers for the same dns name. I had tried this a while but had to give up and just bought SSL certs which I then include in my EC2 image.
Have you tried using Caddy? It handles automatic HTTPS (a.k.a Let's Encrypt) renewal across a fleet. https://caddyserver.com/docs/automatic-https#fleet
I have, I set it up around 6 months ago on a couple of my own personal sites, and it seems to work pretty well. It took a while to figure out the right way to configure it for multiple site hosting, but it has been pretty trouble-free. The cert registration and renewal was really slick. If you want to see it "in action" on a single EC2 instance: https://pythoneers.org/
I used an Ansible role to provision it, antonier77/caddy-ansible and it has worked nicely.
But, as another comment mentioned: If you are in an AWS load balancer, you probably want to use the AWS certificates.
Re: Let's Encrypt makes certs for 30% of web domains
#33Earlier quoted context omitted.
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
That's due to US sanctions.
Sure, but it would be reasonable for an outfit to (seek funding for) a CA that isn't subject to US sanction rules.
Of course there's a question of where you should put such a thing. Even Russians apparently don't find the idea of a Russian CA trustworthy (they expect that Putin would have his thumb on it, and who am I to argue?), a European CA is certainly not free of American influence, so where would this alternative be based? I don't have a good answer.
Re: Let's Encrypt makes certs for 30% of web domains
#34Earlier quoted context omitted.
What problems would decentralization solve here?
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
Yes we do. On what basis did you make that statement?
We comply with U.S. sanctions by not issuing to entities on the SDN list, but that doesn't prevent us from serving the vast majority of people in those countries.
Re: Let's Encrypt makes certs for 30% of web domains
#35can someone please share how they deploy/distribute Let's encrypt certificates with auto renewal on load balanced multiple EC2 servers for the same dns name. I had tried this a while but had to give up and just bought SSL certs which I then include in my EC2 image.
For our dev/stg environment we use certbot, and haproxy has a backend configured to pass the validation requests back to certbot based on "/.well-known/acme-challenge" in the path.
For production we are only using it, currently, for the cert at the backup location, and we couldn't use certbot because of the way it is packaged for Ubuntu, it wouldn't work with Route53 DNS validation. Because it's the backup site, HTTP requests aren't normally directed at the server doing the requests. So I switched to "acme.sh" and that's been really reliable.
Re: Let's Encrypt makes certs for 30% of web domains
#36Author here. I'd figured they were big, but I had no idea that big until I did a www-wide TLS scan. Here for questions
You list the ciphersuite that got chosen for each connection, but I think this could use at least a caveat explaining that the way this works means you'd need to do a LOT more work to figure out what the servers might have agreed to do for some other client. What I mean here is that TLS up until TLS 1.2 goes like this: Client: "Hi, I know ciphersuites A, B, C, D, E, F and G" Server: "OK, let's do C" And so you can't…
> Probably all TLS 1.3 servers today are willing to do anything method not just method B, since all the methods are shiny and new. But perhaps not, and you can't tell except by failing the connection which takes more round trips.
You can have a round trip all the time, or just in the case where the client chooses an ciphersuite the server doesn't support. TLS 1.3 makes the typical cases much better without hurting the worst case much.
Re: Let's Encrypt makes certs for 30% of web domains
#37Earlier quoted context omitted.
Even if this is true, nothing prevents another provider from rolling out a similar or better offer. Existing providers could do it today, but they are too busy spreading FUD to rake in profit.
Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.
Yup, but no incentive. They are literally making millions of dollars for a fraction of a penny in CPU time to sign a cert. Why offer the same thing for free? Try to sell it as more secure and trick lots of people...
Re: Let's Encrypt makes certs for 30% of web domains
#38SSL certs sound like something that should be in a blockchain. Why isnt it?
Because where is the incentive? Why would anyone be a "miner"? What reward would there be?
Re: Let's Encrypt makes certs for 30% of web domains
#39Earlier quoted context omitted.
Even if this is true, nothing prevents another provider from rolling out a similar or better offer. Existing providers could do it today, but they are too busy spreading FUD to rake in profit.
Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.
Just so people don't get an oversimplified view of what it takes to start a CA from this comment, you will have much bigger challenges than access to application software. Your first issue will be securing millions of dollars per year for the staff that it takes to run the CA responsibly. Your next issue will be getting trusted by browsers.
Also, the open source Let's Encrypt CA software is tailored for how we do things. It's not an "off the shelf" component that you can easily run in another context and end up with a proper compliant CA.
Re: Let's Encrypt makes certs for 30% of web domains
#40SSL certs sound like something that should be in a blockchain. Why isnt it?
It kind of is. Certificate Transparency logs -- which all modern CAs log newly issued certificates to -- are stored as a Merkle tree.
https://www.certificate-transparency.org/log-proofs-work
What they aren't is coupled to other cryptocurrency nonsense like mineable/tradeable tokens.