For anyone struggling with creating Let's Encrypt certificates (or just as lazy as I am), try out https://gethttpsforfree.com/ .
Can I use that for renewal as well?
Early Impacts of Let's Encrypt
81–90 of 98 posts
Re: Early Impacts of Let's Encrypt
#82Earlier quoted context omitted.
Not if you have more than five subdomains, you have to wait for a week, like me.
... if you need a different certificate for each subdomain. You are limited to 5 certificates per domain per week, each of which can be valid for many subdomains. Bad if you want to be able to add them dynamically every time a new name comes up, but if it is a static set...
I used SubjectAltNames on my setup. One domain/one cert, though I only did 2 subdomains.
Re: Early Impacts of Let's Encrypt
#83It doesnt support browsers in Windows XP and it is the only annoying thing which forced me to rollback letsencrypt. I know it is 2016 but complaining clients is not what you want anyway. I still have no idea if they are able to fix this in future.
I installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.
Firefox uses its own certificate store, that's why it works on Windows XP. Chrome and Internet Explorer will likely not work, because they use Windows XP's certificates, which don't include trust for Let's Encrypt.
Re: Early Impacts of Let's Encrypt
#84Earlier quoted context omitted.
I installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.
Firefox uses its own certificate store, that's why it works on Windows XP. Chrome and Internet Explorer will likely not work, because they use Windows XP's certificates, which don't include trust for Let's Encrypt.
Their root certificate is currently not trusted by any browser vendor. They have a cross-sign from IdenTrust, which is trusted even by XP. However, their intermediate certificate uses a name constraint in a way that causes schannel (Microsoft's TLS stack) on XP to think they're not allowed to issue certificates for any domain name. Chrome and IE use schannel, while Firefox ships its own TLS stack. This bug was fixed in newer versions of Windows. This might get fixed if someone finds a way to generate an intermediate cert that doesn't trigger this bug (while still including the *.mil constraint).
Re: Early Impacts of Let's Encrypt
#85I used StartSSL and WoSign certificates for all websites I had to setup, but I welcome that initiative and my next website will certainly use LE certificate. While it was technically possible to issue free certificates before, LE looks much safer option. After all StartSSL and WoSign are both commercial entities and they can do what they want.
Re: Early Impacts of Let's Encrypt
#86Earlier quoted context omitted.
Agreed a thousand percent, but there are services that offer easy installs onto cloud providers that do know your private key - that's how they get it onto your ELB or Heroku.
If you can restrict the service to a subdomain, there are alternatives like the SAN extension that allow those third parties to avoid handling your private key at a small extra cost.
I'm having trouble understanding your comment. SANs are mandatory (current browsers don't even use CNs), how would SANs specifically prevent this? The endpoint where your terminating your traffic obviously must have the private key to decrypt it.
Re: Early Impacts of Let's Encrypt
#87Earlier quoted context omitted.
Furthermore, their free certificates cannot be used for commercial purposes.
I don't know why your comment is downvoted -- this is acutally a legitimate issue mentioned in their terms of service.
StartSSL generally don't mention their terms, so a lot of the use of 'StartSSL Free' is commercial. People don't like to hear they've been misled (and shoot the messenger).
Re: Early Impacts of Let's Encrypt
#88Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.
Another interesting stat is that it's mostly domains that didn't have https before.
Might be interesting to look in a year's time - I don't think people will replace commercial certs before their expiration by a free offer in beta. Ones those expire it becomes interesting.
Re: Early Impacts of Let's Encrypt
#89For anyone struggling with creating Let's Encrypt certificates (or just as lazy as I am), try out https://gethttpsforfree.com/ .
Used it today. Great experience!
Re: Early Impacts of Let's Encrypt
#90Is this a typical workflow for statistical analysis? The choice of go and mariadb seemed unique to me and I was wondering what others were using.
MariaDB probably because the data he had was already in mysql/maria format or he had a meaty mariadb server set up. Go: it's easy to hack stuff together. Generally speaking, statistical analysis of stuff boils down to whatever you're comfortable with and what your goals are.