Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Milestone: 100M Certificates Issued

letsencrypt.org

Post reply on HN
Print view View original

51–60 of 197 posts

Re: Milestone: 100M Certificates Issued

#51

Post by tyingq »

This is an interesting situation where "public good" happened to align well with business goals of some deep pockets.

Particularly, Google and Akamai...two of the biggest LE sponsors. They both retain good visibility to user behavior (like specific urls visited) because of things like GA,MITM proxying, etc. But, ubiquitous availability of that is taken away from ISP operators.

Which is a good thing. Makes me curious if there's anything else like this that could be achieved. Are there other net public good projects that align well with deep pocket potential sponsors?

Re: Milestone: 100M Certificates Issued

#52

Post by breakingcups »

TekMol wrote: post #40
msumpter wrote: post #37

Earlier quoted context omitted.

There is a nicely done 'how it works' on Let's Encrypt: https://letsencrypt.org/how-it-works/

I have read that, but it seems overly complicated. Why not just give the domain owner a private key and a script that is a few lines long. So he can sign a message from them and prove he has the key?

In effect that is sort of what they are doing, but simpler.

You claim to have domain x.com. LetsEncrypt sends you a token. Place it in a DNS record or in a pre-determined path on your domain and ask LetsEncrypt to read it back.

If it matches, it is verified that you own the domain.

How is the scheme you propose simpler, whilst retaining the same base guarantee (that the requester is the owner of the domain in question)?

Re: Milestone: 100M Certificates Issued

#53

Post by pfg »

m12k wrote: post #14
the_common_man wrote: post #9

Earlier quoted context omitted.

> Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. This is just a cronjob, no?

If you're comfortable with said cronjob having access to your private key

ACME doesn't require that the client requesting issuance has access to the private key of the certificate. Access to a CSR (which only includes the public key) would be sufficient. Most clients support a mode where they use existing CSRs rather than requiring a private key, e.g. certbot with --csr.

Re: Milestone: 100M Certificates Issued

#54

Post by codehenge »

tskaiser wrote: post #41
m12k wrote: post #36

Earlier quoted context omitted.

If you update the certificates manually, then the private key would just reside on your local machine and not need to be exposed on the server.

Indeed, but I cannot see how this addresses my question?

because your private key never needs to be compromised, even if your server is breached, because it never needs to be on the server. That said, I agree that if the PK is only used for this single server, you have bigger problems than its loss if your server is breached.

Re: Milestone: 100M Certificates Issued

#55

Post by breakingcups »

pulse7 wrote: post #3

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

Why not? Automating it once will prevent you from scrambling in three years, which is exactly LetsEncrypt's point.

Re: Milestone: 100M Certificates Issued

#56

Post by theandrewbailey »

JshWright wrote: post #39
TekMol wrote: post #33

I still wonder how Let's Encrypt works. I understand that the problem they solve: A user wants to get the public key for a certain domain. So he knows he is talking to a server by the domain owner and not some man in the middle. So he asks a third party whos public key he already has. In this case Let's Encrypt. Ok. But how did Let's Encrypt get the public key from the domain owner? I know they make the domain owner…

They have a variety of "challenges" used to prove control of the domain. They basically boil down to: - LE makes a request to example.com, to a known URL that contains a key that LE told you to put there - LE does a DNS lookup for a specific TXT record (again, containing a key they told you to put there). The complete answer to your question can be found in the ACME spec (the protocol LE uses): https://ietf-wg-acme.g…

LE probably does that multiple times from a few places around the internet, to reduce the likelihood of something unexpected going on.

Re: Milestone: 100M Certificates Issued

#57

Post by igravious »

TekMol wrote: post #40
msumpter wrote: post #37

Earlier quoted context omitted.

There is a nicely done 'how it works' on Let's Encrypt: https://letsencrypt.org/how-it-works/

I have read that, but it seems overly complicated. Why not just give the domain owner a private key and a script that is a few lines long. So he can sign a message from them and prove he has the key?

I always balked at the hoops I had to jump through until Let’s Encrypt came along. I now have two boxes, one Gentoo, one CentOS updating every three months pretty much pain-free. I know it's not a valid counter-argument but I'd say that 100M certs issued and the general tone of user feedback says you're wrong about it being overly complicated.

Re: Milestone: 100M Certificates Issued

#58

Post by asenna »

Genuine question: Are the other smaller cert-issuing services going out of business? If not, what has been their response to LetsEncrypt?

Not that all of them should survive, there are a lot of crappy services that deserved this. But I'm just trying to place myself in their CEOs position and wondering how the game plan should be.

Re: Milestone: 100M Certificates Issued

#59

Post by imron »

jagermo wrote: post #2

I think they nail their point with "it illustrates the strong demand for our services." Letsencrypt is cheap (free) and easy to use. Even people with not a lot experience can secure their sites and apps, and it just works. Yes, you have to update it every three months, but that's worth the price and the excellent documentation. Before letsencrypt I always wanted to secure my blog with https but never got around to it…

> Yes, you have to update it every three months

I don't have to update it at all. A cronjob does that for me now.

Re: Milestone: 100M Certificates Issued

#60

Post by pfg »

TekMol wrote: post #40
msumpter wrote: post #37

Earlier quoted context omitted.

There is a nicely done 'how it works' on Let's Encrypt: https://letsencrypt.org/how-it-works/

I have read that, but it seems overly complicated. Why not just give the domain owner a private key and a script that is a few lines long. So he can sign a message from them and prove he has the key?

In the process you describe, there is no step where you confirm that you are actually the domain owner. Anyone could obtain a certificate for google.com.

Verifying domain ownership is what the challenges are responsible for.

Post reply on HN