Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt has issued its first million certificates

eff.org

Post reply on HN
Print view View original

91–100 of 156 posts

Re: Let's Encrypt has issued its first million certificates

#91

Post by lucb1e »

kristofferR wrote: post #18
StavrosK wrote: post #2

> It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol I never realized this so clearly, but it's true. The biggest hindrance to security until LE was that certs were expensive and hard to install. I don't think it was so much the former as the latter. I'd gladly pay 10% more for my cert if it meant my server could renew automaticall…

Yeah. I was really against SPDY/HTTP2 only supporting encrypted websites until Let's Encrypt came along, as it would have "forced" all the small sites to keep using HTTP 1.1 forever. Now I don't mind the requirement at all. https://news.ycombinator.com/item?id=6724292

From what I got, it forces opportunistic encryption only. If there is no special signed cert available, it just generates one randomly and uses that. Unsafe against people who can modify your connection, but it protects against passive eavesdropping.

Re: Let's Encrypt has issued its first million certificates

#92

Post by lucb1e »

bpicolo wrote: post #82

Set up my first let's encrypt just a couple days ago. Was incredibly painless to then go add some subdomain certs. Here's hoping for wildcards some day : )

Just to be sure, are you aware you can supply an infinite amount* of subdomains to be signed? If you need a finite and determined set of subdomains, that's totally possible.

* Well, I'm sure there's a limit, I just heard it's more or less unlimited.

Edit: A bit further in the thread I read a limit of 100 per cert, except you can only register or renew a few per day. Never mind that being unlimited, then.

Re: Let's Encrypt has issued its first million certificates

#93

Post by pfg »

lucb1e wrote: post #91
kristofferR wrote: post #18

Earlier quoted context omitted.

Yeah. I was really against SPDY/HTTP2 only supporting encrypted websites until Let's Encrypt came along, as it would have "forced" all the small sites to keep using HTTP 1.1 forever. Now I don't mind the requirement at all. https://news.ycombinator.com/item?id=6724292

From what I got, it forces opportunistic encryption only. If there is no special signed cert available, it just generates one randomly and uses that. Unsafe against people who can modify your connection, but it protects against passive eavesdropping.

All major browser vendors decided not to implement opportunistic encryption in HTTP/2.

Re: Let's Encrypt has issued its first million certificates

#94

Post by lucb1e »

Buge wrote: post #58
pkaye wrote: post #44

How useful is this for a home server where there is no domain name registered? Can it be configured for my local secure web server?

You need a domain name registered. Otherwise what would they issue the certificate for? You could buy a domain though, then have a local dns resolve it to your own machine. Alternatively you could use a self signed cert and sign it to localhost or whatever, then configure all your browsers to trust this certificate.

> Otherwise what would they issue the certificate for?

A subdomain of something like DynDNS or just your IP address. I know you can't for good reasons, but I'm just saying, it would make sense if you never heard it's for domains only.

Re: Let's Encrypt has issued its first million certificates

#95

Post by lucb1e »

singlow wrote: post #74
pkaye wrote: post #61

Earlier quoted context omitted.

Is it possible to do without Chrome complaining about the validity of the self signed cert?

If you have a registered domain and get a DV cert from LE or anywhere else, chrome will not complain about the cert. If you self-sign it, chrome, or any other browser, will complain, unless you add your own CA to the trusted list on each device.

> If you self-sign it, chrome, or any other browser, will complain, unless you add your own CA to the trusted list on each device.

You say it like "any browser will complain unless you modify the device", but in Firefox you can just add it to the local trust store. They manage their own so that works just fine.

Many applications actually allow you to permanently accept a certificate (heck, SSH) which then alerts you if it changes. It is actually reasonably secure if you aren't on an insecure network the first time around. Just Chrome keeps complaining annoyingly.

Re: Let's Encrypt has issued its first million certificates

#96

Post by lucb1e »

pfg wrote: post #93
lucb1e wrote: post #91

Earlier quoted context omitted.

From what I got, it forces opportunistic encryption only. If there is no special signed cert available, it just generates one randomly and uses that. Unsafe against people who can modify your connection, but it protects against passive eavesdropping.

All major browser vendors decided not to implement opportunistic encryption in HTTP/2.

So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome.

Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?

Re: Let's Encrypt has issued its first million certificates

#97

Post by pfg »

lucb1e wrote: post #94
Buge wrote: post #58

Earlier quoted context omitted.

You need a domain name registered. Otherwise what would they issue the certificate for? You could buy a domain though, then have a local dns resolve it to your own machine. Alternatively you could use a self signed cert and sign it to localhost or whatever, then configure all your browsers to trust this certificate.

> Otherwise what would they issue the certificate for? A subdomain of something like DynDNS or just your IP address. I know you can't for good reasons, but I'm just saying, it would make sense if you never heard it's for domains only.

DynDNS works fine. CA/B Baseline Requirements (which all trusted CAs have to follow) forbid issuance of certificates that include internal names. Whether you actually bought the domain or just have control over a subdomain (as with DynDNS) doesn't matter.

As long as the domain is on the Public Suffix List (which should be best practice for DynDNS providers), you don't even have to worry about rate limits.

AFAIK, certificates for non-reserved IPs would be allowed. Let's Encrypt doesn't support that, however. I imagine proof of ownership would be harder to demonstrate for an IP address (compared to a DNS name).

Re: Let's Encrypt has issued its first million certificates

#98

Post by Kadin »

kardos wrote: post #30
_qhtn wrote: post #23

Earlier quoted context omitted.

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to. So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification. EDIT: I am very wrong.

It looks [1] like some CAs depend heavily on DV certs (GoDaddy) while others do not (Digicert). [1] http://www.netcraft.com/internet-data-mining/ssl-survey/

Interesting. I wonder how critical to GoDaddy's business the certificate sales are, or if they're really just a sideline to their core hosting business.

Re: Let's Encrypt has issued its first million certificates

#99

Post by pfg »

lucb1e wrote: post #96
pfg wrote: post #93

Earlier quoted context omitted.

All major browser vendors decided not to implement opportunistic encryption in HTTP/2.

So they force either a valid cert or nothing? Not even unencrypted http/2? Because that would be quite awesome. Edit: are there statements where they say they don't intend to implement it ever, or is it just not supported yet and e.g. Microsoft might still implement it later to please some enterprise stakeholder?

According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// as unsafe in the UI, I don't think that decision is going to change.

[1]: https://daniel.haxx.se/blog/2015/03/06/tls-in-http2/

Re: Let's Encrypt has issued its first million certificates

#100

Post by Kadin »

dingaling wrote: post #64
Ao7bei3s wrote: post #5

Earlier quoted context omitted.

You're supposed to automate renewal. Since v0.4.0 all it takes is a "letsencrypt renew && apachectl graceful" in a daily cronjob (or, preferably, systemd timer), it handles the rest. Tweak as you like.

Be sure to have a script that checks the results of your cronjobs, though: "It is possible to hit the rate limit using letsencrypt renew and have it fail or partially fail for that reason." https://community.letsencrypt.org/t/help-us-test-renewal-wit... They launched with 90-day expiry but without a robust renewal process.

True. Although if you run it daily, you'll have multiple opportunities for the renewal to go through before it actually expires. It'll survive a couple of unsuccessful tries in the default/recommended configuration, at least if I'm understanding everything correctly.
Post reply on HN