Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

71–80 of 345 posts

Re: Still Why No HTTPS?

#71

Post by benjojo12 »

founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

There is a 2nd ACME free CA these days based in Norway: https://www.buypass.com/ssl/products/acme

I used it on a pervious post to test it out and it seemed to be fine: https://github.com/benjojo/you-cant-curl-under-pressure/comm...

Re: Still Why No HTTPS?

#72

Post by founderling »

benjojo12 wrote: post #71
founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

There is a 2nd ACME free CA these days based in Norway: https://www.buypass.com/ssl/products/acme I used it on a pervious post to test it out and it seemed to be fine: https://github.com/benjojo/you-cant-curl-under-pressure/comm...

Did you miss the "free" in my comment or am I missing something?

Re: Still Why No HTTPS?

#73

Post by dijit »

cassianoleal wrote: post #3

I mostly have port 80 egress traffic blocked on Little Snitch. The web is painful to use like that but gives you an idea of the sorry state of websites. A lot of websites just don't serve over HTTPS, or serve them with domains whose CN or SAN don't match the host. Many that do support https have links that downgrade you back to http on the same domain.

How do you use public Wi-Fi with captive portals?

Re: Still Why No HTTPS?

#74

Post by benjojo12 »

founderling wrote: post #72
benjojo12 wrote: post #71

Earlier quoted context omitted.

There is a 2nd ACME free CA these days based in Norway: https://www.buypass.com/ssl/products/acme I used it on a pervious post to test it out and it seemed to be fine: https://github.com/benjojo/you-cant-curl-under-pressure/comm...

Did you miss the "free" in my comment or am I missing something?

To quote the link in my reply to you:

> Buypass Go SSL

> It is free! Issued in Scandinavia based on the industry standard ACME.

I posted a diff showing the patch you can use to switch go's crypto/acme/autocert to use it.

The CA does sell paid SSL product, but they also have a free ACME endpoint that issues 6 month certs.

Here is an example of what one of the certs look like: https://crt.sh/?id=2075589060

Re: Still Why No HTTPS?

#75

Post by dijit »

I have a reason not to use https.

I host a single site on a host (so, no login, subject name or path information to leak), which only contains details how to connect to my irc server at the same address.

If the message is altered then the most pain anyone will have is connecting somewhere else for the first time. (They won’t be automatically logging in if they’re using this page).

Why does everything need to be TLS? It feels like a cargo cult. A requirement: “because!”

In other scenarios it’s worth modelling threats and I agree that it’s good to err on the side of caution but aside from the modification of my connection information there’s no good tangible reason to incur an overhead in administration.

Although it should be noted; part of the reason that web server even exists is to do letsencrypt for a globally geobalanced irc network.

Re: Still Why No HTTPS?

#76

Post by pricechild »

founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

I run https://github.com/joohoi/acme-dns to solve the wildcard domain problem.

You can run it yourself locally, or trust (why?) the upstream's service.

Re: Still Why No HTTPS?

#77

Post by contravariant »

chungy wrote: post #9
onion-soup wrote: post #6

Earlier quoted context omitted.

Nope, it is not straight-forward and still a confusing process.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

I'd appreciate it if the instructions explained why they need sudo, rather than explain what sudo is...

Re: Still Why No HTTPS?

#78

Post by majewsky »

regecks wrote: post #18
onion-soup wrote: post #11

Earlier quoted context omitted.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

Certbot, and most other standalone ACME clients, are just stop-gaps. The end game is first-party support for automatic HTTPS in all web (and other) servers. It is happening (e.g. mod_md), it's just going to take time. For example, to get it packaged for all distributions. For shared hosting, if you ignore the few providers at the top who are either CAs (e.g. GoDaddy) or are in contracts with CAs (e.g. Namecheap), the…

> The end game is first-party support for automatic HTTPS in all web (and other) servers.

There's still a need for certbot et al when you have multiple services (e.g. web and mail and XMPP) running on a single domain name. In fact, I actively avoid servers that insist on doing ACME themselves because it breaks my unified ACME process.

Re: Still Why No HTTPS?

#79

Post by thrower123 »

EnderMB wrote: post #29
arkitaip wrote: post #14

Earlier quoted context omitted.

So true. Even on hosting that fully supports let's encrypt thru an web based admin like cpanel or directadmin, the process can be confusing and error prone.

If we're purely talking about Let's Encrypt, it's not straightforward to set up on Azure either. It's easy to set up a standard cert through Azure, but if you want to use Let's Encrypt there's a whole dance you have to go through to get there, and for many people it's not worth the time and they'll happily pay a bit of money to make it a few-clicks thing.

When I looked at doing it, I'd have to bump up my hosting plan for my vanity blog to somewhere in the neighborhood of $100/month to apply an SSL cert for my custom domain, which is just stupid for a site that gets a couple thousand visits a month and maybe earns me $5 in referral fees.

Re: Still Why No HTTPS?

#80

Post by maple3142 »

chungy wrote: post #9
onion-soup wrote: post #6

Earlier quoted context omitted.

Nope, it is not straight-forward and still a confusing process.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

Maybe not everyone host website on a platform where you can easily install these things.

For example, I have a simple web app hosted on Heroku free plan, and I have to use CloudFlare SSL to get it served over https on my custom domain. But it actually is half encrypted as the connection between CloudFlare and Heroku is plain http.

Post reply on HN