17 ms·

Entering Public Beta

1249 points by sinak 11y ago

MarkMc 11y ago
I know this late, but FYI: it seems that certificates issued by Lets Encrypt are not as widely accepted as other commercial providers. For example, my trial and error I found that the webhook api for both Mandrill and SendGrid did not recognise the Let's Enrypt certificate (although Google Chrome did recognise it). When I switched to a certificate issued by Name Cheap both Mandrill and SendGrid worked.
- pfg 11y ago
  Make sure you're serving the full chain to the root CA, that might be the issue. LE certs might have that issue with Java apps, since the cross-signed CA isn't currently included in the Oracle root store (they're working on that).
SunDwarf 11y ago
Works flawlessly on my site. SSLLabs recognises the cert. Super easy to setup.
- ultramancool 11y ago
  > Super easy to setup. Yes, thank god I don't have to manually contact anyone like StartSSL or even provide real contact information for this. It's just what it says - domain validation, nothing more. Interestingly, StartSSL did far more verification for their free certificates than other providers I used for paid certificates, Comodo, GlobalSign, AlphaSSL, etc.
  - Stranglethorn 11y ago
    StartSSL's offering of free domain certs were ahead of their time and LE is taking it a step further. Having said that, there's no cost attached w/ LE in cases where revoking a cert is required (ex: security vuln). If managing a sizable portfolio of doms w/ StartSSL Class 1 Certs, missed their fee structure, you're in for a surprise.
diafygi 11y ago
FYI, if you don't want to install anything to try it out, you can use https://gethttpsforfree.com https://gethttpsforfree.com which is a browser-based ACME client. It doesn't ask for private keys, so you don't need to trust it.
- aw3c2 11y ago
  Nice, thank you so much! Please use example.com instead of foo.com though! Edit: 20 minutes later I am online with a cert thanks to your site. Awesome!
- necessity 11y ago
  I'm a layman when it comes to secure websites and certificates. I remember reading that the "free https" provided by Cloudflare meant Cloudflare owned the private keys to something and was able to see all traffic. Is that the case with Let's Encrypt? Because if it is I don't see as an improvement at all.
  - atonse 11y ago
    No, you never send your private key to anyone, with any HTTPS certificate generating scheme. All they do is sign your public key.
    - ge0rg 11y ago
      At least you should not. StartSSL (and probably other CAs) has a prominent feature to create your key pair for you, which you need to skip to use a signing request. Always use the latter!
  - pfg 11y ago
    You create your own private key (or rather, the client does that for you, if you use the official one) and send them a Certificate Signing Request (CSR) which only includes your public key. The private key stays on your server.
  - ianlevesque 11y ago
FPSDavid 11y ago
Can't wait to start using this on nginx.
- finnn 11y ago
  Just use the webroot authenticator + manually configure nginx with help from https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
- kangman 11y ago
  why don't you give caddy a try which has let's encrypt baked in. https://caddyserver.com/ https://caddyserver.com/
  - Touche 11y ago
    This looks pretty cool, it doesn't explain how to use Let's Encrypt as far as I can find in the docs, have an example? EDIT: Looks like it's available in the latest prerelease. https://github.com/mholt/caddy/releases https://github.com/mholt/caddy/releases
    - mholt 11y ago
      Yep, check back tomorrow. Meanwhile here's a 28-second teaser video of it working: https://www.youtube.com/watch?v=nk4EWHvvZtI https://www.youtube.com/watch?v=nk4EWHvvZtI
davexunit 11y ago
The official lets-encrypt client has an extremely large dependency graph, and using the client requires server downtime since it takes over port 80. Can either of these things be improved?
- ultramancool 11y ago
  Yes, this greatly annoyed me too especially given the 3 month expiry time. https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny is a tiny alternative client without any dependencies (except python itself), and you can use any web server including your usual running one to serve the challenge responses up.
  - davexunit 11y ago
    Awesome. Exactly what I was hoping to hear. Thanks!
  - wbond 11y ago
    It also requires the openssl executable in your path.
    - diafygi 11y ago
      Luckily, it's less than 200 lines and open source! Please feel free to fork it and modify for your needs :)
      - wbond 11y ago
        I was just clarifying for other readers. I looked through it because I've been working on some Python crypto stuff for a while, so I was curious what it used since the statement above was that it only required Python.
- scrollaway 11y ago
  The client supports being plugged into your running instance of nginx/apache as long as it can provide the appropriate .well-known paths.
mholt 11y ago
Here's a Go client that has no dependencies and runs everywhere: https://github.com/xenolf/lego https://github.com/xenolf/lego
- tshannon 11y ago
  I just used it, and it works beautifully. Much easier and less impact than the official client. Thanks,
sinak 11y ago
EFF's post on the beta, including details on the roadmap: https://www.eff.org/deeplinks/2015/12/lets-encrypt-enters-public-beta https://www.eff.org/deeplinks/2015/12/lets-encrypt-enters-pu...
- mtgx 11y ago
  Looks like Certificate Transparency isn't on the roadmap? What's the holdup on that? Seems like a perfect match for something automated like Let's Encrypt.
  - pfg 11y ago
    Certificates are already being pushed to CT log servers.
    - deleted 11y ago
      [deleted]
    - rockdoe 11y ago
      SSL Labs claims there's no CT support, but I must admit I'm at a loss if this is a server configuration issue or not.
pfg 11y ago
Happy to see this project hit public beta! I've deployed Let's Encrypt on a couple of side projects during the last month or so, and my experience has been mostly positive. The official client still needs some work, especially in terms of auto-configuration on apache, nginx and others, but it's getting there. Some say it's become a bit bloated, which is true to a certain degree, but probably necessary to achieve the goals they have set for it. Luckily, Let's Encrypt is based on an open specification (ACME) and it's really easy to implement a custom client. There are already more than 10 client implementations out there[1], all created with different goals in mind - anything from a Ruby gem to a simple scripts to get your own CSR signed. If you're not running your typical LAMP or LEMP stack, and don't want to run the official client which is more of a certificate manager requiring root access, that's definitely something to look into. Note that if Windows XP support is relevant for your use-case, you might want to hold off. There's currently a problem with how XP deals with name constraints, which means any application using Windows XP's SSL API (I believe it's called schannel?) won't work - for example Internet Explorer and Chrome. This might get fixed in the future[2]. Hopefully, that's not relevant to you. :) [1]: https://community.letsencrypt.org/t/list-of-client-implementations/2103?u=pfg https://community.letsencrypt.org/t/list-of-client-implement... [2]: https://github.com/letsencrypt/letsencrypt/issues/1660 https://github.com/letsencrypt/letsencrypt/issues/1660
- StavrosK 11y ago
  I love this one in particular: https://github.com/diafygi/acme-tiny/ https://github.com/diafygi/acme-tiny/
  - _asciiker_ 11y ago
    Very good indeed!
jstalin 11y ago
Hoping for automation for Nginx...
- jbverschoor 11y ago
  git clone https://github.com/letsencrypt/letsencrypt https://github.com/letsencrypt/letsencrypt cd letsencrypt/ ./letsencrypt-auto (ignore the 'error'. It's because you don't run apache) /root/.local/share/letsencrypt/bin/letsencrypt certonly --webroot -w /var/www/example.com/public -d www.example.com -d example.com (uses the public directory for ownership check, and creates a cert for www.example.com + example.com) Then in your /etc/nginx/sites-enabled/example.com: /etc/letsencrypt/live/www.example.com/fullchain.pem; /etc/letsencrypt/live/www.example.com/privkey.pem; Sorry.. you're asking for automation
deleted 11y ago
[deleted]
denisu 11y ago
I have seen many howtos recommending to add a monthly cronjob for the certificate renewal on the first day of the month at 12am (0 0 1 * * or @monthly). It is probably better to renew the certificate on a random day/time (30 4 5 * *) to prevent excessive load on their servers.
- mrw34 11y ago
  A RANDOM_DELAY is actually built into @monthly, at least on RHEL/CentOS 6+.
mei0Iesh 11y ago
They keep trying to push the idea that letsencrypt should be ran as root. If you disagree with that, I ran it as a normal user using: letsencrypt -t --work-dir /tmp --logs-dir /tmp \ certonly --webroot /www/public -d example.com Except on my system the letsencrypt command did not work. It failed with an "Operation not permitted". So I edited the webroot.py file, and commented out line 108 that said: # Remove execution bit (not needed for this file) os.chmod(path, filemode & ~stat.S_IEXEC) It ran fine without root, sudo, or su. Then I added this to nginx.conf: listen 443 ssl http2; ssl_certificate /usr/local/etc/letsencrypt/live/example.com/fullchain.pem ssl_certificate_key /usr/local/etc/letsencrypt/live/example.com/privkey.pem It gets an A+ on ssllabs.com, and it works fine in the browser. When I click the lock it says "Let's Encrypt".
- simoncion 11y ago
  > They keep trying to push the idea that letsencrypt should be ran as root. When you say it that way, it sounds like there's something untoward going on. ;) From what I understand, the official client can bind to port 80 to do Basic HTTP verification. This requires root privs. The official client can also update many HTTP server config files. I guess you don't need to be root to do this, but it does remove a command line flag. LE is designed to be stupidly simple, but -as you've discovered- it does let more technical users run it in safer modes of operation. > Except on my system the letsencrypt command did not work. It failed with an "Operation not permitted". Odd. If I'm reading the code correctly, it looks like you have to have write and create privs to 'path', so it's odd that you wouldn't also be able to remove the execute bit. Regardless, would you file a bug about this or -at least- bring it up on the mailing list? It's possible that this is user error, but if it's not, I expect that it's something the LE guys would like to hear about.
  - skydev0h 11y ago
    Actually... its chown that is failing, which is very logical: only root can do chown.
slavik81 11y ago
I'm having trouble finding where it specifies what permissions I need to use Let's Encrypt. Can I get a certificate for my subdomain even if I don't control the full domain?
- pfg 11y ago
  Yes, as long as you're able to host content at subdomain.example.com/.well-known/acme-challenge/{random_token}, you're good to go!
- blablablaat 11y ago
  Yes this is possible. The only verification is that you are able to react to certain HTTP requests sent to port 80 on your domain. https://community.letsencrypt.org/t/possible-to-issue-certificates-for-customers-subdomains/1504 https://community.letsencrypt.org/t/possible-to-issue-certif...
mei0Iesh 11y ago
Now that it's public, and I verified it works... https://letsencrypt.org/donate/ https://letsencrypt.org/donate/
tokenizerrr 11y ago
Does anyone know if their server supports DNS validation yet?
- pfg 11y ago
  Not yet, but soon[1]! [1]: https://community.letsencrypt.org/t/on-the-state-of-the-dns-01-challenge/4805/2?u=pfg https://community.letsencrypt.org/t/on-the-state-of-the-dns-...
  - Perceptes 11y ago
    Is there a GitHub issue to track?
Savagedlight 11y ago
If you're using FreeBSD and NGINX you may like the guide I wrote the other day. :) http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-nginx-reverse-proxy/ http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-... PS: I also made a cron-callable script which checks the expirity time of the cert before telling letsencrypt to renew. It checks if the cert was renewed afterwards, and echos to stderr if renewal didn't take.
kubaw 11y ago
You may also want to try alternative client from https://github.com/kuba/simp_le https://github.com/kuba/simp_le. It can be easily dropped into crontab and renew certificates when necessary. Disclaimer: I'm the author of simp_le and developer of the official client :)
- biomcgary 11y ago
  What are the constraints on the official client that motivated you to author simp_le?
  - kubaw 11y ago
    The primary difference is in the underlying philosophy. I encourage everyone to read the manifest from the main project site [0]. Most of the points are counteracting bad design decisions (IMO) made in the official client. In general, official client tries to do too many things at once. In the result, the code base is huge -- too big to be easily audited; it's also proven that it's likely to have a lot more bugs. On a similar note, letsencrypt-auto, the default installation method, pulls in Apache plugin with all of its dependencies. And so on, and so forth... At the same time standard modes of operation are well hidden and/or difficult to configure. For instance, running the official client without root is technically possible, but let me know how much time it took you to figure this out ;). Likewise, scripting is pretty much impossible, because the CLI tends to ask interactive questions... "webroot" plugin is probably the only plugin that could be made into non-interactive mode, and again you have to be knowledgeable enough to figure out all necessary flags. simp_le tries to takes the best from the official client ("webroot" plugin -- not stealing, I authored that plugin myself) and adds some missing features that IMO should be the standard. E.g. you can just just put `simp_le --some --flags && this_command_will_be_run_only_if_cert_was_renewed_eg_restart_nginx` into your crontab -- this mode of operation is simply not possible with the official client. NB You can also turn simp_le into a standalone binary (~8MB) using built-in PyInstaller setup [1] and distribute to your machines without having to install any dependencies (even Python) :) I hope that answers your question. You can also catch me on #letsencrypt, or better yet #simp_le (both at Freenode). [0] https://github.com/kuba/simp_le#manifest https://github.com/kuba/simp_le#manifest [1] https://github.com/kuba/simp_le/tree/master/pyi https://github.com/kuba/simp_le/tree/master/pyi
r1ch 11y ago
Problems with a reverse proxy? "There were too many requests of a given type :: Error creating new registration :: Too many registrations from this IP" First time trying to sign up and only for a single domain.
- NikLP 11y ago
  I got this too. No idea why.
pjbrunet 11y ago
"We want to see HTTPS become the default." Sounds fine for shopping, online banking, user authorizations. But for every website? If I'm a blogger/publisher or have a brochure type of website, I don't see point of the extra overhead. Update: Thanks to those who answered my question. You pointed out some things I hadn't considered. Blocking the injection of invisible trackers and javascripts and ads, if that's what this is about for websites without user logins, then it would help to explicitly spell that out in marketing communications to promote adoption of this technology. The free speech angle argument is not as compelling to me though, but that's just my opinion.
- jrowley 11y ago
  Well if you're blogging about something important, you don't want the government to MITM your page and edit it without your permission. Imagine if the government did that for a major news site - lots of control.
  - pjbrunet 11y ago
    Do you have any examples of that happening in real life where posts, archives and RSS feeds where simultaneously altered by a government? Sounds like a rare fridge case. Not a "DEFAULT" scenario. If you disagree, you sound really paranoid.
    - jrowley 11y ago
      Nope, but there is no reason to think that a sufficiently motivated and well funded party wouldn't be able to pull it off. If governments can build things like stuxnet then a project like this should be relatively straightforward.
      - pjbrunet 11y ago
        Absolutely, certain people and websites should use https or GPG or whatever technology. I'm only asking why it should be the "default" for the entire Internet? This is not a good argument to make it the default. I'm not against https at all.
wereHamster 11y ago
How do I use it with Google Cloud HTTP Load Balancer?
nulltype 11y ago
Does renewing a certificate require completing a challenge, or is that only for the initial certificate?
- abricot 11y ago
  Also for renewing. Otherwise they can't be sure you still actually control the domain.
esher 11y ago
everyone interested in conspiracy, please read the comments over here: https://www.schneier.com/blog/archives/2014/11/a_new_free_ca.html#comments https://www.schneier.com/blog/archives/2014/11/a_new_free_ca... when bruce schneier wrote about let's encrypt.
- aw3c2 11y ago
  That's very overblown. Any CA in any place on the globe is in danger of being taking on their balls by some shady state agency. That's the CA problem. Doing this at huge scale is not possible though without people noticing. Also one can pin certificates in some situations. Let's Encrypt makes it easy for us people to put an end to mass surveillance.
  - chias 11y ago
    Unless I'm mistaken they're also fundamentally misunderstanding SSL/TLS. As far as I can tell, LE never sees your private keys. A Certificate Authority signs your public key, so no, the NSA can't coerce LE to give up your private key because LE never sees it to begin with. Could the NSA coerce LE into signing one of the NSA's public keys under your Common Name (that is, coerce them into issuing rogue certificates for "national security" use)? Certainly, but they could do this before, with any already existing CA.
grizzles 11y ago
Java: I made a cron friendly script to convert the letsencrypt keys to JKS format. https://github.com/ericbets/letsconvert https://github.com/ericbets/letsconvert
sleepychu 11y ago
Any word on *.mydomain.tld certs from letsencrypt? That's the only thing stopping me from installing it today.
- simoncion 11y ago
  Is the ability to get any number of subdomain certs at no charge an adequate substitute for wildcard certs?
  - detaro 11y ago
    It still might get annoying (for both sides) if you request thousands of them, + you might not want to publish a list of all valid ones. Example: The issue came up in relation to sandstorm.io, which uses (for security reasons) a subdomain for every document that exists on a server.
    - simoncion 11y ago
      Perhaps I'm ignorant, but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) > + you might not want to publish a list of all valid ones. I assume that you mention this to illustrate a scenario where certs with a bunch of SANs is not a solution to the problem? If you weren't, does LE do something like publishing a list of all of the domains for which they have issued certs?
      - detaro 11y ago
        > does LE do something like publishing a list of all of the domains for which they have issued certs? Yes, they do, using certificate transparency logs. You can view all issued certs here: https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395
      - archimedespi 11y ago
        > but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) We have to actually run a complicated server that does things with an external Hardware Security Module. CPU time, disk space, and bandwidth all cost money, and there's a finite amount of money we can spend on resources :) Thus, rate-limits. That also helps keeps latency low for most users, and prevents DDOSing.
hlandau 11y ago
I'm the nth author of an ACME (Let's Encrypt) client. It's a single-binary Go client which you can build and upload to your server. It's designed to work like "make"; you tell it what hostnames you want certificates for, and it tries to satisfy those requirements. It can install a cronjob automatically for autorenewal, and the authorization process doesn't require downtime. https://github.com/hlandau/acme.t https://github.com/hlandau/acme.t
- w00kie 11y ago
  This was super simple and worked like a charm!
- helfire 11y ago
  Out of all the clients I tried yesterday, this one seemed the most thought out in terms of usability and operations with automation.
nodesocket 11y ago
Anyway to get a wildcard SSL certificate from Let's Encrypt? Mine is coming up for renewal soon.
- mynameisvlad 11y ago
  No, the whole point of LE is that you wouldn't need one because you'd automatically get a named certificate for each one of your sites.
  - lucb1e 11y ago
    Ah you can get any number of certificates for each subdomain you wish? Aside from dynamic subdomains, that would indeed solve the need for wildcard certificates.
    - pfg 11y ago
      Yep, or one certificate for multiple subdomains (SAN certs).
    - Tepix 11y ago
      They enforce certain rate limits. Check their website.
  - niij 11y ago
    *each host, not site. But, yeah, I agree with you, I think just registering for all active hosts should be the standard (because if you example.com, you don't necessarily own waikiki.example.com)
SwellJoe 11y ago
This is among the most exciting things going on in the web world, for me. It's a pretty dramatic change that now every website can be encrypted, by default, and in a secure(ish) fashion (it doesn't really do much for proving identity, but SSL has been broken for that for years anyway). I suspect integrating this has been the most requested feature for Virtualmin for the past several months (and we're about to roll it out, probably next week). For whatever reason, SSL is just always intimidating for people...even when it's been almost entirely automated, the back and forth between the CA and the server and dealing with private keys is a deal-breaker for a lot of non-technical users, so many of our users who are new to web server management have problems with SSL. It follows close behind DNS in terms of how much confusion it causes. Anyway, I love that Mozilla and others took the initiative to pull this together, and used their not insignificant clout to push it to completion.
- mei0Iesh 11y ago
  What else is exciting? This is the most exciting thing for me, which is actually pretty sad. It's 2015, and HTTPS still isn't widespread, and something like this wasn't done before? It's a good little new thing, but it doesn't really push anything forward. It feels like we're still where we were a decade ago.
  - SwellJoe 11y ago
    PHP 7 is a pretty big deal for our users, though not particularly to me (though our websites run on Drupal, WordPress, and Mediawiki so we will get some performance benefit from the change). It does seem ridiculous that something like Let's Encrypt didn't happen sooner. But, now that it's finally here, I'm excited about it. I like that we can also expect mail to get more widespread encryption because of this, as well.
SCHiM 11y ago
How does lets encrypt handle possible phising domains? Even if there's zero mitigation I think the benefits will outweigh the downsides, but I wonder if there's anything that stops a criminal from registering a domain that is very similar to, say, that of a bank? I know from experience (ethical hack) that the traditional authorities won't easily let you register 'suspicious' names like: <bank>-<name>.com where the original domain is <bankname>.com. Or something like that.
- pyvek 11y ago
  I'd like to know more about this. When you buy domain validated SSL certificate (that costs $5-10) for which the process is completely automated, does the issuing authority really check or care about which domain it is being used on? Does a human (or a program) check the "suspicious factor" of the domain?
  - chrisfosterelli 11y ago
    No. It's easy to currently register an SSL certificate for any domain, even if that domain is similar to the name of another. The main reason this was a "deterrent" to phishers is that generating tons of these was expensive. The phishers still have to front the cost for the domain itself, so this really isn't going to increase the number of phishing domains. It may increase the number of phishing domains with SSL, but the purpose of Lets Encrypt is to encrypt everything -- not just "official domains"
    - SCHiM 11y ago
      No you are wrong. Perhaps it's not the case everywhere. But like I said, from personal experience I know that certain types of domains are checked. I tried and failed to register a certificate for a phising domain that masqueraded as a banking website. whether or not this was originaly the point of ssl or not, this is how many non-technical people decide to trust a page or not: by looking at the lock in their browser.
      - 11y ago
xrstf 11y ago
For those already using Let's Encrypt since the closed beta: Do not forget to remove the `agree-dev-preview` flags, as newer client version do seem to throw up if it's still set. I had `agree-dev-preview = True` in a config file and got an error about True being an invalid value.
awqrre 11y ago
Can you use this on a shared host and avoid the certificate installation fee?
barosl 11y ago
For those concerned with the official client requiring `sudo`: there are already many alternative clients that are compatible with the Let's Encrypt server, mine included.[1] I made my own client because I wanted to know what's exactly going on during the certificate issue process. I tried to make the code as simple as possible, so take a look if you have time![2] It's a simple single file script. [1] https://github.com/barosl/letsencrypt-simple https://github.com/barosl/letsencrypt-simple [2] https://github.com/barosl/letsencrypt-simple/blob/master/letsencrypt-simple.py https://github.com/barosl/letsencrypt-simple/blob/master/let...
scoot 11y ago
Dumb question time: Why would idenTrust, part of whose business is selling SSL certificates, cross-sign for Lets Encrypt, whose business is giving them away for free?
- davisr 11y ago
  Probably for the publicity, because a lot of Let's Encrypt users will want to upgrade to EV certificates at some point.
binwiederhier 11y ago
In case anyone is looking for an actual cronjob example. This works wonderfully: #!/bin/bash cd /srv/cert/domain.xyz simp_le -d domain.xyz:/srv/www/domain.xyz/html \ -f key.pem -f cert.pem -f fullchain.pem \ && service apache2 reload And in the crontab: 43 1 * * * /srv/bin/cert-renew || true EDIT: This is using the simp_le client (https://github.com/kuba/simp_le https://github.com/kuba/simp_le), not the official client. But this one is wayy easier to use. EDIT 2: Guide here: https://blog.philippheckel.com/2015/12/04/lets-encrypt-5-min-guide-to-set-up-cronjob-based-certificate-renewal/ https://blog.philippheckel.com/2015/12/04/lets-encrypt-5-min...
- bronson 11y ago
  It should be noted that this isn't using LetsEncrypt's client.
  - binwiederhier 11y ago
    Yes, correct. This is using the simp_le client (as mentioned in https://news.ycombinator.com/item?id=10672006 https://news.ycombinator.com/item?id=10672006). The client is easier to use and developed by the same author as the official client. Works wonderfully.
stevebmark 11y ago
PSA: don't use ReadTheDocs for your documentation. Turns good projects sour with a nasty UI, poor features, and horrible SEO.
- archimedespi 11y ago
  Eh, it works and we care way more about that. Anyhow, we can always switch the Sphinx theme, and your comment sounds more like a complaint about Sphinx in general (which I don't happen to agree with, but whatever).
AndyKelley 11y ago
Does it work without port 80? Many home ISPs block port 80 which would prevent homes from being able to use the service.
- deleted 11y ago
  [deleted]
arca_vorago 11y ago
What I would really like is wildcard certs for internal only use. For now, as I understand it, the only way to do so would be to temporarily port forward the internal server so it can reach out and close it later... Certs are not just for the internet websites, they are important for Intranets too.
chmike 11y ago
Can we use the certificate for dovecot and postfix as well ? Would it be safe ? From the documentation it applies only to web servers.
- trampi 11y ago
  I do, it works. Exim and dovecot.
  - chmike 11y ago
    What about this 90 days validity limit ? Do you update it with a script ?
    - trampi 11y ago
      Haven't been on the limit yet, but i have a small bash-script which will revalidate them. I have a TODO to revalidate once manually when it is near expiration. If the script works, i will probably throw it in a cronjob.
gradi3nt 11y ago
Ignorant question: If they are making getting a certificate easy for everyone, what is to stop "bad guys" from getting certificates for their sketchy sites? I usually look to the green "https" in my uri bar for reassurance when I'm on an unusual site.
- M4v3R 11y ago
  Nothing will. Checking for https for validation whether author of a website has malicious intents is wrong, SSL is not intended for that purpose. That's the purpose of an EV cert, because it requires a company to prove its identity, so the very least you can do is to look for green bar / company name in the address bar.
  - gradi3nt 11y ago
    So then why is it important? What is the argument for encrypting all web traffic? Does it act as a sort of camouflage for the actually important encrypted traffic?
rynop 11y ago
From what I can tell, this does not support generating an SSL cert for use with AWS ELB correct?

1249 points by sinak 11y ago

I know this late, but FYI: it seems that certificates issued by Lets Encrypt are not as widely accepted as other commercial providers. For example, my trial and error I found that the webhook api for both Mandrill and SendGrid did not recognise the Let's Enrypt certificate (although Google Chrome did recognise it). When I switched to a certificate issued by Name Cheap both Mandrill and SendGrid worked.

pfg 11y ago
Make sure you're serving the full chain to the root CA, that might be the issue. LE certs might have that issue with Java apps, since the cross-signed CA isn't currently included in the Oracle root store (they're working on that).

SunDwarf 11y ago

Works flawlessly on my site. SSLLabs recognises the cert. Super easy to setup.

ultramancool 11y ago
> Super easy to setup. Yes, thank god I don't have to manually contact anyone like StartSSL or even provide real contact information for this. It's just what it says - domain validation, nothing more. Interestingly, StartSSL did far more verification for their free certificates than other providers I used for paid certificates, Comodo, GlobalSign, AlphaSSL, etc.
- Stranglethorn 11y ago
  StartSSL's offering of free domain certs were ahead of their time and LE is taking it a step further. Having said that, there's no cost attached w/ LE in cases where revoking a cert is required (ex: security vuln). If managing a sizable portfolio of doms w/ StartSSL Class 1 Certs, missed their fee structure, you're in for a surprise.

diafygi 11y ago

FYI, if you don't want to install anything to try it out, you can use https://gethttpsforfree.com https://gethttpsforfree.com which is a browser-based ACME client. It doesn't ask for private keys, so you don't need to trust it.

aw3c2 11y ago
Nice, thank you so much! Please use example.com instead of foo.com though! Edit: 20 minutes later I am online with a cert thanks to your site. Awesome!
necessity 11y ago
I'm a layman when it comes to secure websites and certificates. I remember reading that the "free https" provided by Cloudflare meant Cloudflare owned the private keys to something and was able to see all traffic. Is that the case with Let's Encrypt? Because if it is I don't see as an improvement at all.
- atonse 11y ago
  No, you never send your private key to anyone, with any HTTPS certificate generating scheme. All they do is sign your public key.
  - ge0rg 11y ago
    At least you should not. StartSSL (and probably other CAs) has a prominent feature to create your key pair for you, which you need to skip to use a signing request. Always use the latter!
- pfg 11y ago
  You create your own private key (or rather, the client does that for you, if you use the official one) and send them a Certificate Signing Request (CSR) which only includes your public key. The private key stays on your server.
- ianlevesque 11y ago

FPSDavid 11y ago

Can't wait to start using this on nginx.

finnn 11y ago
Just use the webroot authenticator + manually configure nginx with help from https://mozilla.github.io/server-side-tls/ssl-config-generator/ https://mozilla.github.io/server-side-tls/ssl-config-generat...
kangman 11y ago
why don't you give caddy a try which has let's encrypt baked in. https://caddyserver.com/ https://caddyserver.com/
- Touche 11y ago
  This looks pretty cool, it doesn't explain how to use Let's Encrypt as far as I can find in the docs, have an example? EDIT: Looks like it's available in the latest prerelease. https://github.com/mholt/caddy/releases https://github.com/mholt/caddy/releases
  - mholt 11y ago
    Yep, check back tomorrow. Meanwhile here's a 28-second teaser video of it working: https://www.youtube.com/watch?v=nk4EWHvvZtI https://www.youtube.com/watch?v=nk4EWHvvZtI

davexunit 11y ago

The official lets-encrypt client has an extremely large dependency graph, and using the client requires server downtime since it takes over port 80. Can either of these things be improved?

ultramancool 11y ago
Yes, this greatly annoyed me too especially given the 3 month expiry time. https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny is a tiny alternative client without any dependencies (except python itself), and you can use any web server including your usual running one to serve the challenge responses up.
- davexunit 11y ago
  Awesome. Exactly what I was hoping to hear. Thanks!
- wbond 11y ago
  It also requires the openssl executable in your path.
  - diafygi 11y ago
    Luckily, it's less than 200 lines and open source! Please feel free to fork it and modify for your needs :)
    - wbond 11y ago
      I was just clarifying for other readers. I looked through it because I've been working on some Python crypto stuff for a while, so I was curious what it used since the statement above was that it only required Python.
scrollaway 11y ago
The client supports being plugged into your running instance of nginx/apache as long as it can provide the appropriate .well-known paths.

mholt 11y ago

Here's a Go client that has no dependencies and runs everywhere: https://github.com/xenolf/lego https://github.com/xenolf/lego

tshannon 11y ago
I just used it, and it works beautifully. Much easier and less impact than the official client. Thanks,

sinak 11y ago

EFF's post on the beta, including details on the roadmap: https://www.eff.org/deeplinks/2015/12/lets-encrypt-enters-public-beta https://www.eff.org/deeplinks/2015/12/lets-encrypt-enters-pu...

mtgx 11y ago
Looks like Certificate Transparency isn't on the roadmap? What's the holdup on that? Seems like a perfect match for something automated like Let's Encrypt.
- pfg 11y ago
  Certificates are already being pushed to CT log servers.
  - deleted 11y ago
    [deleted]
  - rockdoe 11y ago
    SSL Labs claims there's no CT support, but I must admit I'm at a loss if this is a server configuration issue or not.

pfg 11y ago

Happy to see this project hit public beta! I've deployed Let's Encrypt on a couple of side projects during the last month or so, and my experience has been mostly positive. The official client still needs some work, especially in terms of auto-configuration on apache, nginx and others, but it's getting there. Some say it's become a bit bloated, which is true to a certain degree, but probably necessary to achieve the goals they have set for it. Luckily, Let's Encrypt is based on an open specification (ACME) and it's really easy to implement a custom client. There are already more than 10 client implementations out there[1], all created with different goals in mind - anything from a Ruby gem to a simple scripts to get your own CSR signed. If you're not running your typical LAMP or LEMP stack, and don't want to run the official client which is more of a certificate manager requiring root access, that's definitely something to look into. Note that if Windows XP support is relevant for your use-case, you might want to hold off. There's currently a problem with how XP deals with name constraints, which means any application using Windows XP's SSL API (I believe it's called schannel?) won't work - for example Internet Explorer and Chrome. This might get fixed in the future[2]. Hopefully, that's not relevant to you. :) [1]: https://community.letsencrypt.org/t/list-of-client-implementations/2103?u=pfg https://community.letsencrypt.org/t/list-of-client-implement... [2]: https://github.com/letsencrypt/letsencrypt/issues/1660 https://github.com/letsencrypt/letsencrypt/issues/1660

StavrosK 11y ago
I love this one in particular: https://github.com/diafygi/acme-tiny/ https://github.com/diafygi/acme-tiny/
- _asciiker_ 11y ago
  Very good indeed!

jstalin 11y ago

Hoping for automation for Nginx...

jbverschoor 11y ago
git clone https://github.com/letsencrypt/letsencrypt https://github.com/letsencrypt/letsencrypt cd letsencrypt/ ./letsencrypt-auto (ignore the 'error'. It's because you don't run apache) /root/.local/share/letsencrypt/bin/letsencrypt certonly --webroot -w /var/www/example.com/public -d www.example.com -d example.com (uses the public directory for ownership check, and creates a cert for www.example.com + example.com) Then in your /etc/nginx/sites-enabled/example.com: /etc/letsencrypt/live/www.example.com/fullchain.pem; /etc/letsencrypt/live/www.example.com/privkey.pem; Sorry.. you're asking for automation

deleted 11y ago

[deleted]

denisu 11y ago

I have seen many howtos recommending to add a monthly cronjob for the certificate renewal on the first day of the month at 12am (0 0 1 * * or @monthly). It is probably better to renew the certificate on a random day/time (30 4 5 * *) to prevent excessive load on their servers.

mrw34 11y ago
A RANDOM_DELAY is actually built into @monthly, at least on RHEL/CentOS 6+.

mei0Iesh 11y ago

They keep trying to push the idea that letsencrypt should be ran as root. If you disagree with that, I ran it as a normal user using: letsencrypt -t --work-dir /tmp --logs-dir /tmp \ certonly --webroot /www/public -d example.com Except on my system the letsencrypt command did not work. It failed with an "Operation not permitted". So I edited the webroot.py file, and commented out line 108 that said: # Remove execution bit (not needed for this file) os.chmod(path, filemode & ~stat.S_IEXEC) It ran fine without root, sudo, or su. Then I added this to nginx.conf: listen 443 ssl http2; ssl_certificate /usr/local/etc/letsencrypt/live/example.com/fullchain.pem ssl_certificate_key /usr/local/etc/letsencrypt/live/example.com/privkey.pem It gets an A+ on ssllabs.com, and it works fine in the browser. When I click the lock it says "Let's Encrypt".

simoncion 11y ago
> They keep trying to push the idea that letsencrypt should be ran as root. When you say it that way, it sounds like there's something untoward going on. ;) From what I understand, the official client can bind to port 80 to do Basic HTTP verification. This requires root privs. The official client can also update many HTTP server config files. I guess you don't need to be root to do this, but it does remove a command line flag. LE is designed to be stupidly simple, but -as you've discovered- it does let more technical users run it in safer modes of operation. > Except on my system the letsencrypt command did not work. It failed with an "Operation not permitted". Odd. If I'm reading the code correctly, it looks like you have to have write and create privs to 'path', so it's odd that you wouldn't also be able to remove the execute bit. Regardless, would you file a bug about this or -at least- bring it up on the mailing list? It's possible that this is user error, but if it's not, I expect that it's something the LE guys would like to hear about.
- skydev0h 11y ago
  Actually... its chown that is failing, which is very logical: only root can do chown.

slavik81 11y ago

I'm having trouble finding where it specifies what permissions I need to use Let's Encrypt. Can I get a certificate for my subdomain even if I don't control the full domain?

pfg 11y ago
Yes, as long as you're able to host content at subdomain.example.com/.well-known/acme-challenge/{random_token}, you're good to go!
blablablaat 11y ago
Yes this is possible. The only verification is that you are able to react to certain HTTP requests sent to port 80 on your domain. https://community.letsencrypt.org/t/possible-to-issue-certificates-for-customers-subdomains/1504 https://community.letsencrypt.org/t/possible-to-issue-certif...

mei0Iesh 11y ago

Now that it's public, and I verified it works... https://letsencrypt.org/donate/ https://letsencrypt.org/donate/

tokenizerrr 11y ago

Does anyone know if their server supports DNS validation yet?

pfg 11y ago
Not yet, but soon[1]! [1]: https://community.letsencrypt.org/t/on-the-state-of-the-dns-01-challenge/4805/2?u=pfg https://community.letsencrypt.org/t/on-the-state-of-the-dns-...
- Perceptes 11y ago
  Is there a GitHub issue to track?

Savagedlight 11y ago

If you're using FreeBSD and NGINX you may like the guide I wrote the other day. :) http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-nginx-reverse-proxy/ http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd-... PS: I also made a cron-callable script which checks the expirity time of the cert before telling letsencrypt to renew. It checks if the cert was renewed afterwards, and echos to stderr if renewal didn't take.

kubaw 11y ago

You may also want to try alternative client from https://github.com/kuba/simp_le https://github.com/kuba/simp_le. It can be easily dropped into crontab and renew certificates when necessary. Disclaimer: I'm the author of simp_le and developer of the official client :)

biomcgary 11y ago
What are the constraints on the official client that motivated you to author simp_le?
- kubaw 11y ago
  The primary difference is in the underlying philosophy. I encourage everyone to read the manifest from the main project site [0]. Most of the points are counteracting bad design decisions (IMO) made in the official client. In general, official client tries to do too many things at once. In the result, the code base is huge -- too big to be easily audited; it's also proven that it's likely to have a lot more bugs. On a similar note, letsencrypt-auto, the default installation method, pulls in Apache plugin with all of its dependencies. And so on, and so forth... At the same time standard modes of operation are well hidden and/or difficult to configure. For instance, running the official client without root is technically possible, but let me know how much time it took you to figure this out ;). Likewise, scripting is pretty much impossible, because the CLI tends to ask interactive questions... "webroot" plugin is probably the only plugin that could be made into non-interactive mode, and again you have to be knowledgeable enough to figure out all necessary flags. simp_le tries to takes the best from the official client ("webroot" plugin -- not stealing, I authored that plugin myself) and adds some missing features that IMO should be the standard. E.g. you can just just put `simp_le --some --flags && this_command_will_be_run_only_if_cert_was_renewed_eg_restart_nginx` into your crontab -- this mode of operation is simply not possible with the official client. NB You can also turn simp_le into a standalone binary (~8MB) using built-in PyInstaller setup [1] and distribute to your machines without having to install any dependencies (even Python) :) I hope that answers your question. You can also catch me on #letsencrypt, or better yet #simp_le (both at Freenode). [0] https://github.com/kuba/simp_le#manifest https://github.com/kuba/simp_le#manifest [1] https://github.com/kuba/simp_le/tree/master/pyi https://github.com/kuba/simp_le/tree/master/pyi

r1ch 11y ago

Problems with a reverse proxy? "There were too many requests of a given type :: Error creating new registration :: Too many registrations from this IP" First time trying to sign up and only for a single domain.

NikLP 11y ago
I got this too. No idea why.

pjbrunet 11y ago

"We want to see HTTPS become the default." Sounds fine for shopping, online banking, user authorizations. But for every website? If I'm a blogger/publisher or have a brochure type of website, I don't see point of the extra overhead. Update: Thanks to those who answered my question. You pointed out some things I hadn't considered. Blocking the injection of invisible trackers and javascripts and ads, if that's what this is about for websites without user logins, then it would help to explicitly spell that out in marketing communications to promote adoption of this technology. The free speech angle argument is not as compelling to me though, but that's just my opinion.

jrowley 11y ago
Well if you're blogging about something important, you don't want the government to MITM your page and edit it without your permission. Imagine if the government did that for a major news site - lots of control.
- pjbrunet 11y ago
  Do you have any examples of that happening in real life where posts, archives and RSS feeds where simultaneously altered by a government? Sounds like a rare fridge case. Not a "DEFAULT" scenario. If you disagree, you sound really paranoid.
  - jrowley 11y ago
    Nope, but there is no reason to think that a sufficiently motivated and well funded party wouldn't be able to pull it off. If governments can build things like stuxnet then a project like this should be relatively straightforward.
    - pjbrunet 11y ago
      Absolutely, certain people and websites should use https or GPG or whatever technology. I'm only asking why it should be the "default" for the entire Internet? This is not a good argument to make it the default. I'm not against https at all.

wereHamster 11y ago

How do I use it with Google Cloud HTTP Load Balancer?

nulltype 11y ago

Does renewing a certificate require completing a challenge, or is that only for the initial certificate?

abricot 11y ago
Also for renewing. Otherwise they can't be sure you still actually control the domain.

esher 11y ago

everyone interested in conspiracy, please read the comments over here: https://www.schneier.com/blog/archives/2014/11/a_new_free_ca.html#comments https://www.schneier.com/blog/archives/2014/11/a_new_free_ca... when bruce schneier wrote about let's encrypt.

aw3c2 11y ago
That's very overblown. Any CA in any place on the globe is in danger of being taking on their balls by some shady state agency. That's the CA problem. Doing this at huge scale is not possible though without people noticing. Also one can pin certificates in some situations. Let's Encrypt makes it easy for us people to put an end to mass surveillance.
- chias 11y ago
  Unless I'm mistaken they're also fundamentally misunderstanding SSL/TLS. As far as I can tell, LE never sees your private keys. A Certificate Authority signs your public key, so no, the NSA can't coerce LE to give up your private key because LE never sees it to begin with. Could the NSA coerce LE into signing one of the NSA's public keys under your Common Name (that is, coerce them into issuing rogue certificates for "national security" use)? Certainly, but they could do this before, with any already existing CA.

grizzles 11y ago

Java: I made a cron friendly script to convert the letsencrypt keys to JKS format. https://github.com/ericbets/letsconvert https://github.com/ericbets/letsconvert

sleepychu 11y ago

Any word on *.mydomain.tld certs from letsencrypt? That's the only thing stopping me from installing it today.

simoncion 11y ago
Is the ability to get any number of subdomain certs at no charge an adequate substitute for wildcard certs?
- detaro 11y ago
  It still might get annoying (for both sides) if you request thousands of them, + you might not want to publish a list of all valid ones. Example: The issue came up in relation to sandstorm.io, which uses (for security reasons) a subdomain for every document that exists on a server.
  - simoncion 11y ago
    Perhaps I'm ignorant, but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) > + you might not want to publish a list of all valid ones. I assume that you mention this to illustrate a scenario where certs with a bunch of SANs is not a solution to the problem? If you weren't, does LE do something like publishing a list of all of the domains for which they have issued certs?
    - detaro 11y ago
      > does LE do something like publishing a list of all of the domains for which they have issued certs? Yes, they do, using certificate transparency logs. You can view all issued certs here: https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395
    - archimedespi 11y ago
      > but I don't see how the LE guys would be annoyed about thousands of requests for TLS certs from a single user. The system is automated, after all. :) We have to actually run a complicated server that does things with an external Hardware Security Module. CPU time, disk space, and bandwidth all cost money, and there's a finite amount of money we can spend on resources :) Thus, rate-limits. That also helps keeps latency low for most users, and prevents DDOSing.

hlandau 11y ago

I'm the nth author of an ACME (Let's Encrypt) client. It's a single-binary Go client which you can build and upload to your server. It's designed to work like "make"; you tell it what hostnames you want certificates for, and it tries to satisfy those requirements. It can install a cronjob automatically for autorenewal, and the authorization process doesn't require downtime. https://github.com/hlandau/acme.t https://github.com/hlandau/acme.t

w00kie 11y ago
This was super simple and worked like a charm!
helfire 11y ago
Out of all the clients I tried yesterday, this one seemed the most thought out in terms of usability and operations with automation.

nodesocket 11y ago

Anyway to get a wildcard SSL certificate from Let's Encrypt? Mine is coming up for renewal soon.

mynameisvlad 11y ago
No, the whole point of LE is that you wouldn't need one because you'd automatically get a named certificate for each one of your sites.
- lucb1e 11y ago
  Ah you can get any number of certificates for each subdomain you wish? Aside from dynamic subdomains, that would indeed solve the need for wildcard certificates.
  - pfg 11y ago
    Yep, or one certificate for multiple subdomains (SAN certs).
  - Tepix 11y ago
    They enforce certain rate limits. Check their website.
- niij 11y ago
  *each host, not site. But, yeah, I agree with you, I think just registering for all active hosts should be the standard (because if you example.com, you don't necessarily own waikiki.example.com)

SwellJoe 11y ago

This is among the most exciting things going on in the web world, for me. It's a pretty dramatic change that now every website can be encrypted, by default, and in a secure(ish) fashion (it doesn't really do much for proving identity, but SSL has been broken for that for years anyway). I suspect integrating this has been the most requested feature for Virtualmin for the past several months (and we're about to roll it out, probably next week). For whatever reason, SSL is just always intimidating for people...even when it's been almost entirely automated, the back and forth between the CA and the server and dealing with private keys is a deal-breaker for a lot of non-technical users, so many of our users who are new to web server management have problems with SSL. It follows close behind DNS in terms of how much confusion it causes. Anyway, I love that Mozilla and others took the initiative to pull this together, and used their not insignificant clout to push it to completion.

mei0Iesh 11y ago
What else is exciting? This is the most exciting thing for me, which is actually pretty sad. It's 2015, and HTTPS still isn't widespread, and something like this wasn't done before? It's a good little new thing, but it doesn't really push anything forward. It feels like we're still where we were a decade ago.
- SwellJoe 11y ago
  PHP 7 is a pretty big deal for our users, though not particularly to me (though our websites run on Drupal, WordPress, and Mediawiki so we will get some performance benefit from the change). It does seem ridiculous that something like Let's Encrypt didn't happen sooner. But, now that it's finally here, I'm excited about it. I like that we can also expect mail to get more widespread encryption because of this, as well.

SCHiM 11y ago

How does lets encrypt handle possible phising domains? Even if there's zero mitigation I think the benefits will outweigh the downsides, but I wonder if there's anything that stops a criminal from registering a domain that is very similar to, say, that of a bank? I know from experience (ethical hack) that the traditional authorities won't easily let you register 'suspicious' names like: <bank>-<name>.com where the original domain is <bankname>.com. Or something like that.

pyvek 11y ago
I'd like to know more about this. When you buy domain validated SSL certificate (that costs $5-10) for which the process is completely automated, does the issuing authority really check or care about which domain it is being used on? Does a human (or a program) check the "suspicious factor" of the domain?
- chrisfosterelli 11y ago
  No. It's easy to currently register an SSL certificate for any domain, even if that domain is similar to the name of another. The main reason this was a "deterrent" to phishers is that generating tons of these was expensive. The phishers still have to front the cost for the domain itself, so this really isn't going to increase the number of phishing domains. It may increase the number of phishing domains with SSL, but the purpose of Lets Encrypt is to encrypt everything -- not just "official domains"
  - SCHiM 11y ago
    No you are wrong. Perhaps it's not the case everywhere. But like I said, from personal experience I know that certain types of domains are checked. I tried and failed to register a certificate for a phising domain that masqueraded as a banking website. whether or not this was originaly the point of ssl or not, this is how many non-technical people decide to trust a page or not: by looking at the lock in their browser.
    - 11y ago

xrstf 11y ago

For those already using Let's Encrypt since the closed beta: Do not forget to remove the `agree-dev-preview` flags, as newer client version do seem to throw up if it's still set. I had `agree-dev-preview = True` in a config file and got an error about True being an invalid value.

awqrre 11y ago

Can you use this on a shared host and avoid the certificate installation fee?

barosl 11y ago

For those concerned with the official client requiring `sudo`: there are already many alternative clients that are compatible with the Let's Encrypt server, mine included.[1] I made my own client because I wanted to know what's exactly going on during the certificate issue process. I tried to make the code as simple as possible, so take a look if you have time![2] It's a simple single file script. [1] https://github.com/barosl/letsencrypt-simple https://github.com/barosl/letsencrypt-simple [2] https://github.com/barosl/letsencrypt-simple/blob/master/letsencrypt-simple.py https://github.com/barosl/letsencrypt-simple/blob/master/let...

scoot 11y ago

Dumb question time: Why would idenTrust, part of whose business is selling SSL certificates, cross-sign for Lets Encrypt, whose business is giving them away for free?

davisr 11y ago
Probably for the publicity, because a lot of Let's Encrypt users will want to upgrade to EV certificates at some point.

binwiederhier 11y ago

In case anyone is looking for an actual cronjob example. This works wonderfully: #!/bin/bash cd /srv/cert/domain.xyz simp_le -d domain.xyz:/srv/www/domain.xyz/html \ -f key.pem -f cert.pem -f fullchain.pem \ && service apache2 reload And in the crontab: 43 1 * * * /srv/bin/cert-renew || true EDIT: This is using the simp_le client (https://github.com/kuba/simp_le https://github.com/kuba/simp_le), not the official client. But this one is wayy easier to use. EDIT 2: Guide here: https://blog.philippheckel.com/2015/12/04/lets-encrypt-5-min-guide-to-set-up-cronjob-based-certificate-renewal/ https://blog.philippheckel.com/2015/12/04/lets-encrypt-5-min...

bronson 11y ago
It should be noted that this isn't using LetsEncrypt's client.
- binwiederhier 11y ago
  Yes, correct. This is using the simp_le client (as mentioned in https://news.ycombinator.com/item?id=10672006 https://news.ycombinator.com/item?id=10672006). The client is easier to use and developed by the same author as the official client. Works wonderfully.

stevebmark 11y ago

PSA: don't use ReadTheDocs for your documentation. Turns good projects sour with a nasty UI, poor features, and horrible SEO.

archimedespi 11y ago
Eh, it works and we care way more about that. Anyhow, we can always switch the Sphinx theme, and your comment sounds more like a complaint about Sphinx in general (which I don't happen to agree with, but whatever).

AndyKelley 11y ago

Does it work without port 80? Many home ISPs block port 80 which would prevent homes from being able to use the service.

deleted 11y ago
[deleted]

arca_vorago 11y ago

What I would really like is wildcard certs for internal only use. For now, as I understand it, the only way to do so would be to temporarily port forward the internal server so it can reach out and close it later... Certs are not just for the internet websites, they are important for Intranets too.

chmike 11y ago

Can we use the certificate for dovecot and postfix as well ? Would it be safe ? From the documentation it applies only to web servers.

trampi 11y ago
I do, it works. Exim and dovecot.
- chmike 11y ago
  What about this 90 days validity limit ? Do you update it with a script ?
  - trampi 11y ago
    Haven't been on the limit yet, but i have a small bash-script which will revalidate them. I have a TODO to revalidate once manually when it is near expiration. If the script works, i will probably throw it in a cronjob.

gradi3nt 11y ago

Ignorant question: If they are making getting a certificate easy for everyone, what is to stop "bad guys" from getting certificates for their sketchy sites? I usually look to the green "https" in my uri bar for reassurance when I'm on an unusual site.

M4v3R 11y ago
Nothing will. Checking for https for validation whether author of a website has malicious intents is wrong, SSL is not intended for that purpose. That's the purpose of an EV cert, because it requires a company to prove its identity, so the very least you can do is to look for green bar / company name in the address bar.
- gradi3nt 11y ago
  So then why is it important? What is the argument for encrypting all web traffic? Does it act as a sort of camouflage for the actually important encrypted traffic?

rynop 11y ago

From what I can tell, this does not support generating an SSL cert for use with AWS ELB correct?