Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Early Impacts of Let's Encrypt

tacticalsecret.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Early Impacts of Let's Encrypt

#91

Post by everfree »

awqrre wrote: post #61
Titanous wrote: post #33

Earlier quoted context omitted.

Yes, there are many reasons to deploy TLS everywhere, and everyone should be working towards it for these reasons: - Increased resistance to surveillance. Instead of seeing the pages/information that a client downloads from your server, state actors, ISPs, local attackers, and anyone else listening only learn that the client downloaded some bytes from your server. - Mitigation of man-in-the-middle and man-on-the-side…

I pay $5/month for my shared hosting for 100GB disk space and unlimited bandwidth but it doesn't support HTTPS...

Sorry to hear that. HTTPS (via SNI and user-uploaded certificate) doesn't cost the hosting provider anything to support, so it seems like yours is just behind the times.

Re: Early Impacts of Let's Encrypt

#92

Post by mapunk »

wildpeaks wrote: post #27
comex wrote: post #3

Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.

Another interesting stat is that it's mostly domains that didn't have https before.

Why is that interesting? I have quite a few sites where I'd rather keep my commercial cert (which expires every 12 months), as opposed to a beta cert that expires every 3 months.

Re: Early Impacts of Let's Encrypt

#93

Post by hwdsl2 »

onuras wrote: post #80
forlorn wrote: post #77

It doesnt support browsers in Windows XP and it is the only annoying thing which forced me to rollback letsencrypt. I know it is 2016 but complaining clients is not what you want anyway. I still have no idea if they are able to fix this in future.

I installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.

No, Let's Encrypt does not work in either Chrome or IE on Windows XP [1]. This is a known bug with their intermediate certificate [2].

[1] https://github.com/letsencrypt/letsencrypt/issues/1660

[2] https://community.letsencrypt.org/t/help-needed-windows-xp-s...

Re: Early Impacts of Let's Encrypt

#94

Post by vsl »

nailer wrote: post #87
mehrdada wrote: post #79

Earlier quoted context omitted.

I don't know why your comment is downvoted -- this is acutally a legitimate issue mentioned in their terms of service.

StartSSL generally don't mention their terms, so a lot of the use of 'StartSSL Free' is commercial. People don't like to hear they've been misled (and shoot the messenger).

They actually started policing this and refuse to renew a certificate if they decide it's a commercial use. Happened to me and rather than argue with them (it wasn't), I bought a $5 one at ssls.com...

Re: Early Impacts of Let's Encrypt

#95

Post by dk8996 »

I got to say AWS Certificate Manager is a game changer -- it took me 5 min to secure two domains. Last time I did it, buying a certificate and converting to work with AWS took about four hrs.

Re: Early Impacts of Let's Encrypt

#96

Post by duaneb »

nailer wrote: post #86
duaneb wrote: post #58

Earlier quoted context omitted.

If you can restrict the service to a subdomain, there are alternatives like the SAN extension that allow those third parties to avoid handling your private key at a small extra cost.

I'm having trouble understanding your comment. SANs are mandatory (current browsers don't even use CNs), how would SANs specifically prevent this? The endpoint where your terminating your traffic obviously must have the private key to decrypt it.

You need one cert (or at least only a handful of certs)—SAN entries do not need to be subdomains of the CN. Greatly reduces headache of ssl-terminating for e.g. client domains.

Re: Early Impacts of Let's Encrypt

#97

Post by vgt »

pfg wrote: post #38

Slightly OT: It would be great if CT logs were available as part of Amazon's or Google's public data sets. Being able to access that data via BigQuery (or similar) would make generating something like this way easier. It would also be immensely useful when implementing CT log monitors.

ping me and we can help you get this going with BigQuery :)

Re: Early Impacts of Let's Encrypt

#98

Post by pfg »

vgt wrote: post #97
pfg wrote: post #38

Slightly OT: It would be great if CT logs were available as part of Amazon's or Google's public data sets. Being able to access that data via BigQuery (or similar) would make generating something like this way easier. It would also be immensely useful when implementing CT log monitors.

ping me and we can help you get this going with BigQuery :)

Would be happy to help! Email on my profile (sorry, didn't find yours).
Post reply on HN