4 ms·

I recently needed a cert and got one from letsencrypt. Haven't read about them or followed all the news. I have no idea about the architecture of Let's Encrypt.

by eknkc 11y ago

I recently needed a cert and got one from letsencrypt. Haven't read about them or followed all the news. I have no idea about the architecture of Let's Encrypt. So these might sound stupid; - Why do we need a local client app to issue certificates? Is there a web interface in development? Is there a technical reason for it to work this way? - Why does it issue 3 month certs? Beta period? (This is reason enough to pay btw, If I did not screw something up to end up with short term certs)

mordocai 11y ago
It gives 3 month certs because what you are supposed to be doing is automating the cert creation and when you have it automated 3 months certs are a good thing since it is a security benefit and has no disadvantages.
TazeTSchnitzel 11y ago
> Why do we need a local client app to issue certificates? So it can verify domain ownership automatically. > Why does it issue 3 month certs? Because it verifies domain ownership automatically.
- serge2k 11y ago
  Well, that and they didn't do DNS based validation first. I guess they have that now.
  - deleted 11y ago
    [deleted]
ianlevesque 11y ago
They want you to automate renewals.
herge 11y ago
I suspect the 3 month certs is to make sure you have to authenticate your domain 4 times a year with Let's Encrypt to make sure that you can't hold a valid SSL key for the domain for more than a few months after you transfer it. Also, if someone manages to scam Let's Encrypt, the resulting cert is only valid for a short time. The local client is there to make sure that the authentication process can be automated and not require your manual intervention.
pfg 11y ago
> - Why do we need a local client app to issue certificates? Is there a web interface in development? Is there a technical reason for it to work this way? The client takes care of solving the ownership challenge, provisioning the certificate and configuring your web server (if you want it to). It also helps with renewal, in a way that it can be automated completely. The entire process uses an open protocol (ACME), and there are a number of alternatives out there. If you like web-based ones, look at https://gethttpsforfree.com/ https://gethttpsforfree.com/ > - Why does it issue 3 month certs? Beta period? (This is reason enough to pay btw, If I did not screw something up to end up with short term certs) This is likely to stay even after the beta. The reasoning behind it is that Let's Encrypt makes it easy to automate renewal, and shorter renewal periods will encourage users to configure and use automation as opposed to doing it once a year and then forgetting about it. It also reduces the time frame in which you're vulnerable in case your key is exposed at some point. (CRL and OCSP solve this only in theory.)
JaggedJax 11y ago
The goal with letsencrypt is to get everyone using SSL, even the layman. With that in mind they aim to automate the process as much as possible so you don't need to remember to update your cert or worry about it expiring. The client will handle all this for you in the background. They are even considering shortening them to less than 3 months. I think the goal there is to ensure people automate it who would otherwise try and do it manually.
gnur 11y ago
The local client app is needed to verify that you actually own the domain. 3 month certs are actually more secure since there is shorter amount of time in which they can be stolen & used. The goal of letsencrypt is to make re-issuing certificates automated, so even a 1 week certificate is no problem since you can run a nightly cronjob to refresh it.
twothamendment 11y ago
I'm using Let's encrypt for personal and work stuff. The official client stinks. The first time I tried it I had to shut down my web server to get the cert? It was my personal stuff, so I did it, but moved on to find a new solution for work. I'm using this: https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny. It needed a bit of a tweak to get the challenge files to show up on all of the EC2 instances that hide behind the ELB since you don't know which one will be hit. As for the 90 day limit, we aren't too worried. We'll add domains often enough we shouldn't have to worry about it. and it can always be automated.
stordoff 11y ago
> Why does it issue 3 month certs? IIRC, it is to encourage automation, and short term certificates are somewhat more secure (shorter period of use if one leaks and it isn't revoked; shorter period to attack the keys [shouldn't be an issue in any reasonable time period, but it can't hurt to limit it] etc.)

by eknkc 11y ago

mordocai 11y ago

It gives 3 month certs because what you are supposed to be doing is automating the cert creation and when you have it automated 3 months certs are a good thing since it is a security benefit and has no disadvantages.

TazeTSchnitzel 11y ago

> Why do we need a local client app to issue certificates? So it can verify domain ownership automatically. > Why does it issue 3 month certs? Because it verifies domain ownership automatically.

serge2k 11y ago
Well, that and they didn't do DNS based validation first. I guess they have that now.
- deleted 11y ago
  [deleted]

ianlevesque 11y ago

They want you to automate renewals.

herge 11y ago

I suspect the 3 month certs is to make sure you have to authenticate your domain 4 times a year with Let's Encrypt to make sure that you can't hold a valid SSL key for the domain for more than a few months after you transfer it. Also, if someone manages to scam Let's Encrypt, the resulting cert is only valid for a short time. The local client is there to make sure that the authentication process can be automated and not require your manual intervention.

pfg 11y ago

> - Why do we need a local client app to issue certificates? Is there a web interface in development? Is there a technical reason for it to work this way? The client takes care of solving the ownership challenge, provisioning the certificate and configuring your web server (if you want it to). It also helps with renewal, in a way that it can be automated completely. The entire process uses an open protocol (ACME), and there are a number of alternatives out there. If you like web-based ones, look at https://gethttpsforfree.com/ https://gethttpsforfree.com/ > - Why does it issue 3 month certs? Beta period? (This is reason enough to pay btw, If I did not screw something up to end up with short term certs) This is likely to stay even after the beta. The reasoning behind it is that Let's Encrypt makes it easy to automate renewal, and shorter renewal periods will encourage users to configure and use automation as opposed to doing it once a year and then forgetting about it. It also reduces the time frame in which you're vulnerable in case your key is exposed at some point. (CRL and OCSP solve this only in theory.)

JaggedJax 11y ago

The goal with letsencrypt is to get everyone using SSL, even the layman. With that in mind they aim to automate the process as much as possible so you don't need to remember to update your cert or worry about it expiring. The client will handle all this for you in the background. They are even considering shortening them to less than 3 months. I think the goal there is to ensure people automate it who would otherwise try and do it manually.

gnur 11y ago

The local client app is needed to verify that you actually own the domain. 3 month certs are actually more secure since there is shorter amount of time in which they can be stolen & used. The goal of letsencrypt is to make re-issuing certificates automated, so even a 1 week certificate is no problem since you can run a nightly cronjob to refresh it.

twothamendment 11y ago

I'm using Let's encrypt for personal and work stuff. The official client stinks. The first time I tried it I had to shut down my web server to get the cert? It was my personal stuff, so I did it, but moved on to find a new solution for work. I'm using this: https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny. It needed a bit of a tweak to get the challenge files to show up on all of the EC2 instances that hide behind the ELB since you don't know which one will be hit. As for the 90 day limit, we aren't too worried. We'll add domains often enough we shouldn't have to worry about it. and it can always be automated.

stordoff 11y ago

> Why does it issue 3 month certs? IIRC, it is to encourage automation, and short term certificates are somewhat more secure (shorter period of use if one leaks and it isn't revoked; shorter period to attack the keys [shouldn't be an issue in any reasonable time period, but it can't hurt to limit it] etc.)