Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Early Impacts of Let's Encrypt

tacticalsecret.com

Post reply on HN
Print view View original

61–70 of 98 posts

Re: Early Impacts of Let's Encrypt

#61

Post by awqrre »

Titanous wrote: post #33
sansidentity wrote: post #28

Hypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permi…

Yes, there are many reasons to deploy TLS everywhere, and everyone should be working towards it for these reasons: - Increased resistance to surveillance. Instead of seeing the pages/information that a client downloads from your server, state actors, ISPs, local attackers, and anyone else listening only learn that the client downloaded some bytes from your server. - Mitigation of man-in-the-middle and man-on-the-side…

I pay $5/month for my shared hosting for 100GB disk space and unlimited bandwidth but it doesn't support HTTPS...

Re: Early Impacts of Let's Encrypt

#62

Post by regecks »

heinrich5991 wrote: post #54
MCRed wrote: post #9

Does anyone know where one can get a free wildcard certificate? Need it for development and foo/bar/baz/biff.example.com change names regularly (they include the hash of the code commit) so I would like to get a *.dev.example.com wildcard cert. (one that won't give warnings that scare the business types who are testing the code, and won't understand what self-signed means.)

You could automate getting Let's Encrypt certificates, so it can automatically generate a certificate for each domain.

You will run into rate and other kind of limits if you issue many names for a single TLD+1 name. Constantly ran into this while developing a plugin for cPanel.

Re: Early Impacts of Let's Encrypt

#63

Post by obituary_latte »

ralmidani wrote: post #29

Just the other day, we finished a "dry run" deployment of our new app for small businesses on a Digital Ocean droplet running Debian and Apache (our app is Ember and Django). Let's Encrypt was the final step. We followed the instructions provided by DO[0], and aside from our mistake of leaving a previous attempt as a Virtualhost on port 443, the client just works out-of-the-box. It automatically detects which file ha…

Sorry if I'm not understanding, but so it generates an httpd.conf for you?

Re: Early Impacts of Let's Encrypt

#64

Post by schoen »

tootie wrote: post #46
diafygi wrote: post #7

Earlier quoted context omitted.

Keep in mind that Let's Encrypt publishes a searchable list of all domains issued. https://crt.sh/?Identity=%25&iCAID=7395

Why?

One way of putting it is that we want to get caught as quickly as possible if we ever misissue a certificate. We don't think it's a benefit to us or the certificate-using (relying party) public if we have the ability to secretly issue certs that are erroneous.

Re: Early Impacts of Let's Encrypt

#65

Post by schoen »

obituary_latte wrote: post #63
ralmidani wrote: post #29

Just the other day, we finished a "dry run" deployment of our new app for small businesses on a Digital Ocean droplet running Debian and Apache (our app is Ember and Django). Let's Encrypt was the final step. We followed the instructions provided by DO[0], and aside from our mistake of leaving a previous attempt as a Virtualhost on port 443, the client just works out-of-the-box. It automatically detects which file ha…

Sorry if I'm not understanding, but so it generates an httpd.conf for you?

The apache plugin for the Let's Encrypt Python client can edit apache configuration files (one of the most complex and hard-to-get-right but also one of the most convenient features of the client). There is also an nginx plugin which is significantly more experimental and which also edits nginx configuration files.

Re: Early Impacts of Let's Encrypt

#66

Post by recursive »

TazeTSchnitzel wrote: post #25
yoha wrote: post #12

For anyone struggling with creating Let's Encrypt certificates (or just as lazy as I am), try out https://gethttpsforfree.com/ .

The CLI version of the LE client is pretty simple to use. Literally one command line.

It might be enough to convince me to learn linux for real this time.

Re: Early Impacts of Let's Encrypt

#67

Post by ralmidani »

obituary_latte wrote: post #63
ralmidani wrote: post #29

Just the other day, we finished a "dry run" deployment of our new app for small businesses on a Digital Ocean droplet running Debian and Apache (our app is Ember and Django). Let's Encrypt was the final step. We followed the instructions provided by DO[0], and aside from our mistake of leaving a previous attempt as a Virtualhost on port 443, the client just works out-of-the-box. It automatically detects which file ha…

Sorry if I'm not understanding, but so it generates an httpd.conf for you?

We had our sites configured in sites-enabled (ember.conf and django.conf). The LE client copied everything over to new files with encryption enabled, and had the old port 80 Virtualhosts redirect to the port 443 Virtualhosts.

Re: Early Impacts of Let's Encrypt

#68

Post by technion »

pfg wrote: post #56
pred_ wrote: post #52

Earlier quoted context omitted.

As far as I can tell, the website can not be used to browse all certificates directly; when the number was at 500k, the site would consistently time out when trying to fetch the oldest ~250k. Is the raw data available somewhere? On a completely different and off-topic note, as someone who would normally just handle my certificate needs by piping together 10 openssl commands, your ACME client is super handy!

The raw data is publicly available on Certificate Transparency log servers[1]. There are various clients for CT log servers out there, but they all require you to essentially download the entire log to query it (there's no query API). [1]: https://www.certificate-transparency.org/known-logs

Depending on your need, one of your options is my own service, which will monitor your own registered domain for issued certificates.

https://ctadvisor.lolware.net

Re: Early Impacts of Let's Encrypt

#69

Post by cyphar »

sansidentity wrote: post #28

Hypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permi…

Absolutely. Not only is privacy important for your users (a list of what books someone has read being available to a user's ISP or a government is a violation of human rights), but TLS also secures your users from local network attacks (injecting malware into pages, or otherwise changing what information they see).

Re: Early Impacts of Let's Encrypt

#70

Post by beefhash »

_ak wrote: post #45
pfg wrote: post #21

Earlier quoted context omitted.

StartSSL and WoSign have been offering free, publicly trusted certificates with one year lifetimes (and the ability to renew for free) for quite some time. The former doesn't allow commercial usage, while the latter operates in China. That's probably why it wasn't an option for a lot of people. (That, and the terrible UX at least in StartSSL's case.)

StartSSL isn't free. They charge for certificate revocation.

Furthermore, their free certificates cannot be used for commercial purposes.
Post reply on HN