7 ms·

Public Beta: December 3, 2015

182 points by arash_milani 11y ago

0x0 11y ago
So a slight delay then, previously they announced general availability for November 16th: https://letsencrypt.org/2015/08/07/updated-lets-encrypt-launch-schedule.html https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun...
- conorgil145 11y ago
  Given the scope of what they are trying to accomplish and the fact that I've never worked on a project which was delivered on time and with all features complete, I'm pretty happy that the delay isn't longer! :)
- CzarSpider 11y ago
  And before that it was announced that general availability was going to be September 14th: https://letsencrypt.org/2015/06/16/lets-encrypt-launch-schedule.html https://letsencrypt.org/2015/06/16/lets-encrypt-launch-sched... It's a shame they've pushed it back twice so far.
fenesiistvan 11y ago
I am still unable to run the tool to get the certificates on Windows OS. I know that there are some development in progress, but still far to be finished. Windows OS is running around 30% of the web servers. Please don't neglect it.
- sarciszewski 11y ago
  They won't. :|
- gluejar 11y ago
  Don't feel so bad, it doesn't run on Mac OSX or even RHEL. Use the Docker container, it worked for me.
  - rascul 11y ago
    Works fine on FreeBSD, also is in ports. https://svnweb.freebsd.org/ports/head/security/py-letsencrypt/ https://svnweb.freebsd.org/ports/head/security/py-letsencryp...
- technion 11y ago
  I'd be interested in whether my script[0] works on Windows, aside from the obvious fact most Windows servers don't have Ruby. You could also just put a gets on line 43 to pause it before the verify, and copy the generated verify files onto said Windows server from any Linux box anywhere. [0] https://lolware.net/2015/10/27/letsencrypt_go_live.html https://lolware.net/2015/10/27/letsencrypt_go_live.html
- voltagex_ 11y ago
  Anyone want to help write a Powershell version? Edit: https://github.com/natemrice/letsencrypt-powershell https://github.com/natemrice/letsencrypt-powershell could use a hand. I can't afford to spin up too many Windows servers on AWS but I'd like to have a look at this.
flyingmutant 11y ago
Is there finally a way to renew the certificate without taking down the web server listening on :443? This was the major thing missing from being able to deploy it in production.
- the_angry_angel 11y ago
  There are multiple modes to the letscrypt client. The [webroot mode](https://github.com/letsencrypt/letsencrypt/issues/1370 https://github.com/letsencrypt/letsencrypt/issues/1370) allows you to use an existing web server.
- SuperKlaus 11y ago
  There's no downtime when using the webroot method, see here for details: https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7 https://community.letsencrypt.org/t/using-the-webroot-domain...
  - ge0rg 11y ago
    The downtime happens when you restart the server so it loads the new certificate. This must probably be addressed in the server implementation.
- mholt 11y ago
  If you're willing to use an alternative web server, this is possible: https://caddyserver.com/blog/lets-encrypt-progress-report https://caddyserver.com/blog/lets-encrypt-progress-report Caddy (currently in beta) will issue and renew SSL certificates automatically with no downtime (on Linux; Windows has very brief downtime during restarts).
  - bketelsen 11y ago
    I can confirm that Caddy + Let's Encrypt is the most seamless and awesome way to run TLS. I did this last night for one of my LE beta whitelisted domains and it took MAYBE 4 minutes. Caddy did all the work. Kudos to the Caddy team for such a great admin experience.
discreditable 11y ago
I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) shell access.
- atmosx 11y ago
  A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.
  - Diamons 11y ago
    Side question, does anyone actually enjoy running a VPS? Between managing the sites on it, you have to maintain the VPS, keep it up to date, its prone to security bugs and flaws, etc. Am I missing something here? I remember setting up multiple VPSes on Linode / DO and it was always a painful process of installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. On top of that, whereas on a shared host i click a button and host a second domain, with a VPS I have to SSH in and manually edit server files. But everyone always recommends running a VPS so I can't help but imagine I've either missed some magical tool that makes running a VPS a snap or it's just not a realistic solution for most people.
    - xienze 11y ago
      I don't think it's a question of "enjoy" versus "need". If you just doing some static hosting with perhaps PHP, sure, go with shared hosting. The second you need to run your own Java server, Go server, etc. you're in VPS territory.
    - aianus 11y ago
      > installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. > SSH in and manually edit server files. Docker solves almost all those problems. Comes with its own complexities, though.
tombrossman 11y ago
I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it took much more work than I expected. Then I noticed the certs will only ever be good for 90 days, and I'll have to do this multiple times a year! Bottom line for me is that with DV certs so inexpensive and simple to get, I'd rather pay a few dollars a year for normal commercial certificates. I can do things like use CloudFront at a custom subdomain with HTTPS without needing to point DNS somewhere every few months to get a cert reissued. I simply can't justify the extra work involved to get 'free' certificates, and I'm happy to continue buying regular DV certs. Maybe these are temporary limitations and if so I will definitely try again in the future. [0]https://github.com/diafygi/letsencrypt-nosudo https://github.com/diafygi/letsencrypt-nosudo [1]https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html
- kevinreedy 11y ago
  I actually love the idea of 90 day (or less) certificates! Once you automate the process of replacing your certificate (which let's encrypt will greatly help with), it won't matter how short the period is. Also, if a key gets compromised, it'll be valid for a shorter time. Give https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html a read! If you want to get more in-depth about certificate revocation, http://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html http://news.netcraft.com/archives/2013/05/13/how-certificate... is also a great/depressing read.
  - deleted 11y ago
    [deleted]
  - ars 11y ago
    If someone compromised the key they also compromised the system used to automatically generate more keys, so a short expiration is not as helpful as it looks. It's even worse than that: A smart attacker will copy the method used to generate keys, and leave the server. Then they can keep generating keys and you will probably never notice. I feel that automation is a mistake, something security sensitive like this should be on a completely different machine.
flavmartins 11y ago
Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?
- foldor 11y ago
  What benefit would a phishing site have with https that they didn't have without it?
  - GavinMcG 11y ago
    The green padlock that casual users might misinterpret as meaning "to be trusted".
    - flavmartins 11y ago
      If you look at Chrome's change to https indicators, they give these sites with auto issued certs the lock so users will interpret it as "secure". Seems easy to create fraud sites and give them a legitimate site look.
      - schoen 11y ago
        Also discussed at https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/2409 https://community.letsencrypt.org/t/the-cas-role-in-fighting... which is the official discussion thread for Josh's article on this topic.
- Bedon292 11y ago
  These certs are to verify you control the domain name, not that you are who you say you are. Those certificates are much more complicated and expensive. See https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html for more information
  - cpeterso 11y ago
Absentinsomniac 11y ago
Hopefully some kind of OpenBSD support comes along. Pretty much letsencrypt-nosudo until then. The standard letsencrypt program doesn't appear to work on Debian 7 due to outdated openssl and what not.
plnii 11y ago
The beta was good timing for me. I installed an LE cert on Ubuntu running Apache and it's working fine. The instructions were a bit unclear about whether the "auto" option works yet for that setup (it doesn't). Also, I had an issue with permissions on the cert directory - I use a group for my server permissions (instead of running at root), so had to add that group to the cert directory. But the process is still better than what I've experienced implementing a comodo cert.
Aissen 11y ago
I tried the beta: it was fast, easy and boring. How it should be.
BrandoElFollito 11y ago
This is a fantastic solution for public web sites. Kudos to the team. It is hardly usable for internal (non-Internet facing) ones because you have to expose either the site or internal DNS for a check to go though.

182 points by arash_milani 11y ago

0x0 11y ago

So a slight delay then, previously they announced general availability for November 16th: https://letsencrypt.org/2015/08/07/updated-lets-encrypt-launch-schedule.html https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun...

conorgil145 11y ago
Given the scope of what they are trying to accomplish and the fact that I've never worked on a project which was delivered on time and with all features complete, I'm pretty happy that the delay isn't longer! :)
CzarSpider 11y ago
And before that it was announced that general availability was going to be September 14th: https://letsencrypt.org/2015/06/16/lets-encrypt-launch-schedule.html https://letsencrypt.org/2015/06/16/lets-encrypt-launch-sched... It's a shame they've pushed it back twice so far.

fenesiistvan 11y ago

I am still unable to run the tool to get the certificates on Windows OS. I know that there are some development in progress, but still far to be finished. Windows OS is running around 30% of the web servers. Please don't neglect it.

sarciszewski 11y ago
They won't. :|
gluejar 11y ago
Don't feel so bad, it doesn't run on Mac OSX or even RHEL. Use the Docker container, it worked for me.
- rascul 11y ago
  Works fine on FreeBSD, also is in ports. https://svnweb.freebsd.org/ports/head/security/py-letsencrypt/ https://svnweb.freebsd.org/ports/head/security/py-letsencryp...
technion 11y ago
I'd be interested in whether my script[0] works on Windows, aside from the obvious fact most Windows servers don't have Ruby. You could also just put a gets on line 43 to pause it before the verify, and copy the generated verify files onto said Windows server from any Linux box anywhere. [0] https://lolware.net/2015/10/27/letsencrypt_go_live.html https://lolware.net/2015/10/27/letsencrypt_go_live.html
voltagex_ 11y ago
Anyone want to help write a Powershell version? Edit: https://github.com/natemrice/letsencrypt-powershell https://github.com/natemrice/letsencrypt-powershell could use a hand. I can't afford to spin up too many Windows servers on AWS but I'd like to have a look at this.

flyingmutant 11y ago

Is there finally a way to renew the certificate without taking down the web server listening on :443? This was the major thing missing from being able to deploy it in production.

the_angry_angel 11y ago
There are multiple modes to the letscrypt client. The [webroot mode](https://github.com/letsencrypt/letsencrypt/issues/1370 https://github.com/letsencrypt/letsencrypt/issues/1370) allows you to use an existing web server.
SuperKlaus 11y ago
There's no downtime when using the webroot method, see here for details: https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7 https://community.letsencrypt.org/t/using-the-webroot-domain...
- ge0rg 11y ago
  The downtime happens when you restart the server so it loads the new certificate. This must probably be addressed in the server implementation.
mholt 11y ago
If you're willing to use an alternative web server, this is possible: https://caddyserver.com/blog/lets-encrypt-progress-report https://caddyserver.com/blog/lets-encrypt-progress-report Caddy (currently in beta) will issue and renew SSL certificates automatically with no downtime (on Linux; Windows has very brief downtime during restarts).
- bketelsen 11y ago
  I can confirm that Caddy + Let's Encrypt is the most seamless and awesome way to run TLS. I did this last night for one of my LE beta whitelisted domains and it took MAYBE 4 minutes. Caddy did all the work. Kudos to the Caddy team for such a great admin experience.

discreditable 11y ago

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) shell access.

atmosx 11y ago
A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.
- Diamons 11y ago
  Side question, does anyone actually enjoy running a VPS? Between managing the sites on it, you have to maintain the VPS, keep it up to date, its prone to security bugs and flaws, etc. Am I missing something here? I remember setting up multiple VPSes on Linode / DO and it was always a painful process of installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. On top of that, whereas on a shared host i click a button and host a second domain, with a VPS I have to SSH in and manually edit server files. But everyone always recommends running a VPS so I can't help but imagine I've either missed some magical tool that makes running a VPS a snap or it's just not a realistic solution for most people.
  - xienze 11y ago
    I don't think it's a question of "enjoy" versus "need". If you just doing some static hosting with perhaps PHP, sure, go with shared hosting. The second you need to run your own Java server, Go server, etc. you're in VPS territory.
  - aianus 11y ago
    > installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. > SSH in and manually edit server files. Docker solves almost all those problems. Comes with its own complexities, though.

tombrossman 11y ago

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it took much more work than I expected. Then I noticed the certs will only ever be good for 90 days, and I'll have to do this multiple times a year! Bottom line for me is that with DV certs so inexpensive and simple to get, I'd rather pay a few dollars a year for normal commercial certificates. I can do things like use CloudFront at a custom subdomain with HTTPS without needing to point DNS somewhere every few months to get a cert reissued. I simply can't justify the extra work involved to get 'free' certificates, and I'm happy to continue buying regular DV certs. Maybe these are temporary limitations and if so I will definitely try again in the future. [0]https://github.com/diafygi/letsencrypt-nosudo https://github.com/diafygi/letsencrypt-nosudo [1]https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html

kevinreedy 11y ago
I actually love the idea of 90 day (or less) certificates! Once you automate the process of replacing your certificate (which let's encrypt will greatly help with), it won't matter how short the period is. Also, if a key gets compromised, it'll be valid for a shorter time. Give https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html a read! If you want to get more in-depth about certificate revocation, http://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html http://news.netcraft.com/archives/2013/05/13/how-certificate... is also a great/depressing read.
- deleted 11y ago
  [deleted]
- ars 11y ago
  If someone compromised the key they also compromised the system used to automatically generate more keys, so a short expiration is not as helpful as it looks. It's even worse than that: A smart attacker will copy the method used to generate keys, and leave the server. Then they can keep generating keys and you will probably never notice. I feel that automation is a mistake, something security sensitive like this should be on a completely different machine.

flavmartins 11y ago

Anyone concerned with the amount of fraud that will come from this? Won't bad actors utilize this to https all of their phishing sites?

foldor 11y ago
What benefit would a phishing site have with https that they didn't have without it?
- GavinMcG 11y ago
  The green padlock that casual users might misinterpret as meaning "to be trusted".
  - flavmartins 11y ago
    If you look at Chrome's change to https indicators, they give these sites with auto issued certs the lock so users will interpret it as "secure". Seems easy to create fraud sites and give them a legitimate site look.
    - schoen 11y ago
      Also discussed at https://community.letsencrypt.org/t/the-cas-role-in-fighting-phishing-and-malware/2409 https://community.letsencrypt.org/t/the-cas-role-in-fighting... which is the official discussion thread for Josh's article on this topic.
Bedon292 11y ago
These certs are to verify you control the domain name, not that you are who you say you are. Those certificates are much more complicated and expensive. See https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html for more information
- cpeterso 11y ago

Absentinsomniac 11y ago

Hopefully some kind of OpenBSD support comes along. Pretty much letsencrypt-nosudo until then. The standard letsencrypt program doesn't appear to work on Debian 7 due to outdated openssl and what not.

plnii 11y ago

The beta was good timing for me. I installed an LE cert on Ubuntu running Apache and it's working fine. The instructions were a bit unclear about whether the "auto" option works yet for that setup (it doesn't). Also, I had an issue with permissions on the cert directory - I use a group for my server permissions (instead of running at root), so had to add that group to the cert directory. But the process is still better than what I've experienced implementing a comodo cert.

Aissen 11y ago

I tried the beta: it was fast, easy and boring. How it should be.

BrandoElFollito 11y ago

This is a fantastic solution for public web sites. Kudos to the team. It is hardly usable for internal (non-Internet facing) ones because you have to expose either the site or internal DNS for a check to go though.