4 ms·

If I see that right, it could be the Geschäftsführer (CEO) from https://www.psw-group.de/ https://www.psw-group.de/. I saw no further Mozilla involvement in my

by onli 11y ago

If I see that right, it could be the Geschäftsführer (CEO) from https://www.psw-group.de/ https://www.psw-group.de/. I saw no further Mozilla involvement in my short search either.

tptacek 11y ago
Which is a CA reseller. Nice.
- userbinator 11y ago
  No doubt a lot of other CAs are going to be pretty perturbed once LE really gets widespread. What reason for existence will they have then? EV certs?
  - ceejayoz 11y ago
    GoDaddy claims support is a selling point. Which, if you've used GoDaddy's support, is hilariously laughable.
  - dingaling 11y ago
    > What reason for existence will they have then? EV certs? I doubt that corporate users will move in any significant numbers to LE, even for basic DV certs. Two reasons: 1. The certificate renewal process appears to be incompatible with most corporate change-control processes I've encountered: nothing may change on a production server unless an admin is given authorisation to change it. A cron job that could take all customer-facing services offline is just crazy[0]. 2. When something goes wrong with a cert issuance or renewal, corporate users ( want | need ) to be able to call a human to have them fix it, regardless of cost. And even that cost is insignificant in context to revenue. I'm sure LE will be popular with bloggers and hobby users. Beyond that? [0] yes, the admins could run the LE client manually in non-prod and move the certs over to production. But that's no easier than current cert renewals, and would have to occur every 60-90 days.
    - toomuchtodo 11y ago
      Someone who is responsible for a site's uptime is going to be more conservative about changes being made, most definitely. As a sysadmin, I don't think Let's Encrypt's 90 day expiration period is too onerous, but if I can sidestep that aggressive expiration period with a $300-600 wildcard cert that expires yearly from a traditional CA, that's the route I'm going to go (when my fully loaded costs to my employer are on the low end of that cost per hour). Disclaimer: I'm a big proponent of Let's Encrypt, and tweeted at Jeff Barr @ AWS asking if they could integrate its lifecycle into AWS' IAM SSL ecosystem.
      - userbinator 11y ago
        I think servers are patched a bit more often than 90 days now, so the expiration period is not that short.
        toomuchtodo 11y ago
        Patching servers and cycling SSL certificates are apples and oranges. Depending on the size of the org, you may have several divisions that need to have new key/certs distributed to them, and their environments updated through change requests processes. Not everyone are teams of 5-20 on EC2 or DigitalOcean.
jepler 11y ago
He has posted on at least one other occasion on mozilla's bugzilla, see this 2010 comment on another certificate-related bug: https://bugzilla.mozilla.org/show_bug.cgi?id=556468#c33 https://bugzilla.mozilla.org/show_bug.cgi?id=556468#c33
- jepler 11y ago
  And also on this bugzilla item, again questioning whether Mozilla is properly following procedure WRT letsencrypt https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 https://bugzilla.mozilla.org/show_bug.cgi?id=1204656
  - onli 11y ago
    This one I saw. I did not count it as mozilla involvement. Nonetheless good to have it linked here to see the train of thought.

by onli 11y ago

If I see that right, it could be the Geschäftsführer (CEO) from https://www.psw-group.de/ https://www.psw-group.de/. I saw no further Mozilla involvement in my short search either.

tptacek 11y ago

Which is a CA reseller. Nice.

userbinator 11y ago
No doubt a lot of other CAs are going to be pretty perturbed once LE really gets widespread. What reason for existence will they have then? EV certs?
- ceejayoz 11y ago
  GoDaddy claims support is a selling point. Which, if you've used GoDaddy's support, is hilariously laughable.
- dingaling 11y ago
  > What reason for existence will they have then? EV certs? I doubt that corporate users will move in any significant numbers to LE, even for basic DV certs. Two reasons: 1. The certificate renewal process appears to be incompatible with most corporate change-control processes I've encountered: nothing may change on a production server unless an admin is given authorisation to change it. A cron job that could take all customer-facing services offline is just crazy[0]. 2. When something goes wrong with a cert issuance or renewal, corporate users ( want | need ) to be able to call a human to have them fix it, regardless of cost. And even that cost is insignificant in context to revenue. I'm sure LE will be popular with bloggers and hobby users. Beyond that? [0] yes, the admins could run the LE client manually in non-prod and move the certs over to production. But that's no easier than current cert renewals, and would have to occur every 60-90 days.
  - toomuchtodo 11y ago
    Someone who is responsible for a site's uptime is going to be more conservative about changes being made, most definitely. As a sysadmin, I don't think Let's Encrypt's 90 day expiration period is too onerous, but if I can sidestep that aggressive expiration period with a $300-600 wildcard cert that expires yearly from a traditional CA, that's the route I'm going to go (when my fully loaded costs to my employer are on the low end of that cost per hour). Disclaimer: I'm a big proponent of Let's Encrypt, and tweeted at Jeff Barr @ AWS asking if they could integrate its lifecycle into AWS' IAM SSL ecosystem.
    - userbinator 11y ago
      I think servers are patched a bit more often than 90 days now, so the expiration period is not that short.
      - toomuchtodo 11y ago
        Patching servers and cycling SSL certificates are apples and oranges. Depending on the size of the org, you may have several divisions that need to have new key/certs distributed to them, and their environments updated through change requests processes. Not everyone are teams of 5-20 on EC2 or DigitalOcean.

jepler 11y ago

He has posted on at least one other occasion on mozilla's bugzilla, see this 2010 comment on another certificate-related bug: https://bugzilla.mozilla.org/show_bug.cgi?id=556468#c33 https://bugzilla.mozilla.org/show_bug.cgi?id=556468#c33

jepler 11y ago
And also on this bugzilla item, again questioning whether Mozilla is properly following procedure WRT letsencrypt https://bugzilla.mozilla.org/show_bug.cgi?id=1204656 https://bugzilla.mozilla.org/show_bug.cgi?id=1204656
- onli 11y ago
  This one I saw. I did not count it as mozilla involvement. Nonetheless good to have it linked here to see the train of thought.