5 ms·

See a Let's Encrypt cert in action: https://helloworld.letsencrypt.org/ https://helloworld.letsencrypt.org/ Nice work team!

by joshmoz 11y ago

Animats 11y ago
"This website does not supply ownership information."
- joshmoz 11y ago
  We only issue DV (Domain Validation) certs. DV certs don't include ownership information.
- dangrossman 11y ago
  Neither does https://news.ycombinator.com https://news.ycombinator.com. That's the kind of certificate most websites have now.
- MrOwen 11y ago
  I thought only EV certs (where you have to turn in some sort of financial and other types of documents to prove you're a real institution) were granted that info in certs. And EV certs are the only certs that turn most browser's address bars green.
nitrogen 11y ago
I was unable to connect using a vendor-specific browser on an old Android 4 device. Is this a limitation of the LE cert, or a cipher suite issue with older browsers, or something else? Really looking forward to spreading HTTPS far and wide.
- joshmoz 11y ago
  Checked with a sysadmin. I'm pretty sure it's a ciper suite mismatch. The helloworld site is configured with "modern" settings from this page: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
- pugtor 11y ago
  Taking a guess from the SSL Labs report[1], that site appears to be using the modern config from Mozilla's toolkit[2], which limits it to browsers from the last few years. 1: https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.letsencrypt.org https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le... 2: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
  - newman314 11y ago
    It's also throwing a OSCP error as well as no HSTS/HPKP headers to get to A+ grade.
    - pugtor 11y ago
      But hey, it's got OCSP stapling!
- deleted 11y ago
  [deleted]
mtgx 11y ago
So, Let's Encrypt doesn't support Certificate Transparency?! If there's one place where CT should be adopted, it's probably here.
- Natanael_L 11y ago
  I'm sure they're not opposed to it. It's a work in progress!
  - schoen 11y ago
    It's up and running now -- J. C. Jones gave a reference to search the log via a web interface. https://crt.sh/?caid=7395 https://crt.sh/?caid=7395 If you want to dive in more, you can get this data in other formats too.
    - tokenizerrr 11y ago
      So does this make the existence of my https site public, even if I'm not linked to from anywhere?
      - schoen 11y ago
        Yes.
- vtlynch 11y ago
  Let's Encrypt's DV certs will be validated the same way that any other CA's DV certs are, so im not sure why this should be the "one place" where its adopted. They are also planning on support CT.

See a Let's Encrypt cert in action: https://helloworld.letsencrypt.org/ https://helloworld.letsencrypt.org/ Nice work team!

by joshmoz 11y ago

See a Let's Encrypt cert in action: https://helloworld.letsencrypt.org/ https://helloworld.letsencrypt.org/ Nice work team!

Animats 11y ago

"This website does not supply ownership information."

joshmoz 11y ago
We only issue DV (Domain Validation) certs. DV certs don't include ownership information.
dangrossman 11y ago
Neither does https://news.ycombinator.com https://news.ycombinator.com. That's the kind of certificate most websites have now.
MrOwen 11y ago
I thought only EV certs (where you have to turn in some sort of financial and other types of documents to prove you're a real institution) were granted that info in certs. And EV certs are the only certs that turn most browser's address bars green.

nitrogen 11y ago

I was unable to connect using a vendor-specific browser on an old Android 4 device. Is this a limitation of the LE cert, or a cipher suite issue with older browsers, or something else? Really looking forward to spreading HTTPS far and wide.

joshmoz 11y ago
Checked with a sysadmin. I'm pretty sure it's a ciper suite mismatch. The helloworld site is configured with "modern" settings from this page: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
pugtor 11y ago
Taking a guess from the SSL Labs report[1], that site appears to be using the modern config from Mozilla's toolkit[2], which limits it to browsers from the last few years. 1: https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.letsencrypt.org https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le... 2: https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
- newman314 11y ago
  It's also throwing a OSCP error as well as no HSTS/HPKP headers to get to A+ grade.
  - pugtor 11y ago
    But hey, it's got OCSP stapling!
deleted 11y ago
[deleted]

mtgx 11y ago

So, Let's Encrypt doesn't support Certificate Transparency?! If there's one place where CT should be adopted, it's probably here.

Natanael_L 11y ago
I'm sure they're not opposed to it. It's a work in progress!
- schoen 11y ago
  It's up and running now -- J. C. Jones gave a reference to search the log via a web interface. https://crt.sh/?caid=7395 https://crt.sh/?caid=7395 If you want to dive in more, you can get this data in other formats too.
  - tokenizerrr 11y ago
    So does this make the existence of my https site public, even if I'm not linked to from anywhere?
    - schoen 11y ago
      Yes.
vtlynch 11y ago
Let's Encrypt's DV certs will be validated the same way that any other CA's DV certs are, so im not sure why this should be the "one place" where its adopted. They are also planning on support CT.