Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our First Certificate Is Now Live

letsencrypt.org

Post reply on HN
Print view View original

81–90 of 263 posts

Re: Our First Certificate Is Now Live

#81

Post by schoen »

kolev wrote: post #79
nailer wrote: post #63

Earlier quoted context omitted.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

These shameless plugs are getting really annoying. We know about you, we know CloudFlare and Let's Encrypt are kinda competitors with their free certificates, but you don't have to comment on each post about them. Really, stop annoying us - it doesn't do you any good, honestly!

In this case, the previous commenter was explicitly asking for advice about how to get certificates more conveniently today, so the replies about existing services that can do so seem quite relevant.

Re: Our First Certificate Is Now Live

#82

Post by kuschku »

nailer wrote: post #63
jonknee wrote: post #35

It's amazing that it takes a free provider to make things simple: https://letsencrypt.org/howitworks/ I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

You might want to fix your webdesign: http://i.imgur.com/zQbWnUI.png

And this is in Firefox, which renders fonts more bold than other browsers.

Re: Our First Certificate Is Now Live

#83

Post by bracewel »

devit wrote: post #73
bracewel wrote: post #67

Earlier quoted context omitted.

Boulder (the CA backend) has two solutions to this problem a. if we know of an already existing certificate for the domain that is being authorized you must prove control over both the server and the key used in the existing certificate b. validation is done over multiple paths to confirm results, an attacker would need to be able to hijack connections from all of our validation servers in order to cause miss-issuanc…

What happens if the user loses the key? What happens if a certificate is requested, the domain is sold to a new owner and the new owner tries to request a certificate, but doesn't have access to the keys for the old one? Also, how can the new owner revoke all certificates delivered to previous owners?

Either wait for the certificate to expire, register a new certificate for the domain with another CA which LE will see and can then be used to prove ownership, or ask the originally issuing CA to revoke the certificate which will remove the need for the challenge completely.

Re: Our First Certificate Is Now Live

#84

Post by macspoofing »

Someone1234 wrote: post #9
[deleted] wrote: post #4

[deleted]

I don't understand what it is we should "beware" of? What's the perceived threat? In theory, even if the NSA themselves were creating these site certificates, because of how they're created (i.e. you generate the keyset yourself locally, they sign the public part), it should be secure. So as I said: What is the perceived threat condition here?

I don't know about the threat, but this solves one use case. A local server connection from a browser pointed at an online web service. For example, Plex which gives you a web-based directory of movies you own, but the movies themselves are hosted on your private server).

Re: Our First Certificate Is Now Live

#85

Post by Killswitch »

nailer wrote: post #63
jonknee wrote: post #35

It's amazing that it takes a free provider to make things simple: https://letsencrypt.org/howitworks/ I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

Yeah but still $234/yr for a certificate. While I appreciate what you're doing to make things more simple, that's pretty expensive.

I can't wait until letsencrypt is done.

Re: Our First Certificate Is Now Live

#86

Post by inopinatus »

kodablah wrote: post #43
ck2 wrote: post #23

Everyone repeat after me, wildcards, wildcards, wildcards. (just hoping they will appear next year) One more nail in the coffin of the ssl cert mafia.

While I too would like to see wildcards, doesn't the fact that you can programmatically obtain a cert for a subdomain obviate most of the wildcard needs? Sure it's a bit more difficult but if your service has some form of sorts to make a subdomain work for a specific word, surely it can request the cert at that time. Having said that, obviously keeping track of only one cert and not having to build this into your app…

Not all subdomains are known in advance - DNS has wildcards too.

Re: Our First Certificate Is Now Live

#87

Post by leesalminen »

nailer wrote: post #63
jonknee wrote: post #35

It's amazing that it takes a free provider to make things simple: https://letsencrypt.org/howitworks/ I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

I run https://certsimple.com : we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.

Is it possible to get a wildcard EV certificate?

Re: Our First Certificate Is Now Live

#88

Post by alcari »

MichaelGG wrote: post #78
IgorPartola wrote: post #26

Earlier quoted context omitted.

Looking at http://helloworld.letsencrypt.org/ I see: > Let's Encrypt hasn't yet been added as a trusted authority to the major browsers (that will be happening soon), so for now, you'll need to add the ISRG root certificate yourself. Specifics will depend on your browser. In Firefox, just click the link.

Wow the Firefox process to add a root is pretty simple! Downloading a file is more difficult. Adding an exception for a self-signed cert is scary. But adding a new root? Little popup, check a box and OK-you-go!

It's scary how easy it is to add new roots on all major platforms. You just click on the CA link and get a response with the appropriate MIME type back, then:

* Windows gives you a helpful little wizard wherein you click "next" a few times.

* Firefox gives you a dialog with 3 checkboxes; check them and click okay.

* iOS sends you to settings, and asks you if you want to trust the given CA.

* OS X hands it to Keychain Access, where you have to select 'trust' from a dropdown and maybe enter a keychain password; it's a bit less intuitive.

* Chrome uses the OS trust store, so it hands it off to the OS while claiming it's a dangerous filetype.

Re: Our First Certificate Is Now Live

#89

Post by callahad »

schoen wrote: post #70
callahad wrote: post #32

Earlier quoted context omitted.

Ah, that is a bit misleading. When it says "just click the link," it's referring to the process for installing the root certificate. It should read "specifics will depend on your browser. In Firefox, just click the link [to the .der file, and you will see a prompt allowing you to trust it.]" It looks like this: http://imgur.com/dzC89xI Without importing the root, Firefox absolutely distrusts https://helloworld.letsen…

Actually, 1204656 doesn't need to be fixed in order to get Firefox to accept this cert. As https://letsencrypt.org/certificates/ explains, > IdenTrust will cross-sign our intermediates. This will allow our end certificates to be accepted by all major browsers while we propagate our own root. The cross-signature is expected to happen before the mainstream browsers finish processing our application to be a root CA. Tha…

Touché :)

Re: Our First Certificate Is Now Live

#90

Post by pjzedalis »

notatoad wrote: post #77
mahouse wrote: post #75

I feel like these initiatives to make SSL available for everybody just lead to the same conclusion: EV will be the only viable alternative to show real trust, and EV is much, much more expensive than regular SSL ever was.

But that's nothing new. If you need real trust, you need EV. The win from LetsEncrypt and any other attempt to make SSL more mainstream is the encryption, not the trust. If you're using SSL you're protected from some government and ISP snooping, and from having the contents of your message or webpage altered in mid-stream by a nefarious third party like AT&T.

I think people are making too big of a deal of SSL. So what if my browser connection to Target or Home Depot is encrypted?
Post reply on HN