3 ms·

Yeah, it also provides stable profit to certification "authorities".

by Grue3 11y ago

_ikke_ 11y ago
Not with initiatives like letsencrypt.
narrowrail 11y ago
As _ikke_ mentioned, it's as if you entirely missed the HN discussions about LE. https://en.wikipedia.org/wiki/Let's_Encrypt https://en.wikipedia.org/wiki/Let's_Encrypt You can also search HN and GitHub to discover the numerous features and tools.
- Grue3 11y ago
  Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt.
  - matt4077 11y ago
    - Why should I care about the backing CA as long as all browsers accept it? - You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. With their certificate expiry set at 3 months, that comes out to about 6,000 subdomains you can register. I know there are some setups where every user gets a subdomain. But I'd wager that less than 1 in 10000 LE users would run into these limits. (which may actually be lifted when the beta period ends). - LE doesn't offer any paid certificates so it's really hard to spin this as a shareware-style incentive to spend money with them.
    - Grue3 11y ago
      >Why should I care about the backing CA as long as all browsers accept it? https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar >You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. What if I want dynamic subdomains for my website? These limitations are absurdly low. >LE doesn't offer any paid certificates They don't, but their partners do. If HTTPS becomes ubiquitous and necessary to host a website, they stand to gain a lot.
  - cyphar 11y ago
    > Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. First off, it's free software and it's an open community. LetsEncrypt is trying to get wildcard certificates, but just because they haven't yet convinced CAs to allow them to have wildcard certificates doesn't make it anywhere close to shareware bullshit. > Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt. This is FUD. Why do you care about IdenTrust beating their chest? Why do you want to use another backing CA? What possible benefit does that provide? The whole CA thing is fucked anyway (in terms of the massive centralisation), so changing the backing CA won't do much. Also, to be fair, they did pull the trigger on LE, so it's not fair to get all pissy when they take credit for their decision.
adregan 11y ago
I just set up a free ssl cert via AWS[0] yesterday for serving static assets and securing an API Gateway endpoint (previously was using a free Lets Encrypt[1] cert). So hopefully there will be more ways around certification authorities who charge. 0: http://aws.amazon.com/certificate-manager/ http://aws.amazon.com/certificate-manager/ 1: https://letsencrypt.org/ https://letsencrypt.org/
tomjen3 11y ago
Chrome and Firefox should remove the root certificate of any provider that charges for SSL certificates. Not because 10 usd is much, but because it prevents the web from being open to people in third-world countries or those who don't want to (or can't) run their own servers (and so can't use lets encrypt).
- comex 11y ago
  You don't need to run your own server to use Let's Encrypt. You probably do want some sort of automated method for updating the cert due to the low expiration time (though it isn't mandatory), but that can be done in many ways such as a desktop application, or just having the shared hosting service add built-in support for Let's Encrypt, as Dreamhost has already done.

Yeah, it also provides stable profit to certification "authorities".

by Grue3 11y ago

Yeah, it also provides stable profit to certification "authorities".

_ikke_ 11y ago

Not with initiatives like letsencrypt.

narrowrail 11y ago

As _ikke_ mentioned, it's as if you entirely missed the HN discussions about LE. https://en.wikipedia.org/wiki/Let's_Encrypt https://en.wikipedia.org/wiki/Let's_Encrypt You can also search HN and GitHub to discover the numerous features and tools.

Grue3 11y ago
Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt.
- matt4077 11y ago
  - Why should I care about the backing CA as long as all browsers accept it? - You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. With their certificate expiry set at 3 months, that comes out to about 6,000 subdomains you can register. I know there are some setups where every user gets a subdomain. But I'd wager that less than 1 in 10000 LE users would run into these limits. (which may actually be lifted when the beta period ends). - LE doesn't offer any paid certificates so it's really hard to spin this as a shareware-style incentive to spend money with them.
  - Grue3 11y ago
    >Why should I care about the backing CA as long as all browsers accept it? https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar >You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. What if I want dynamic subdomains for my website? These limitations are absurdly low. >LE doesn't offer any paid certificates They don't, but their partners do. If HTTPS becomes ubiquitous and necessary to host a website, they stand to gain a lot.
- cyphar 11y ago
  > Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. First off, it's free software and it's an open community. LetsEncrypt is trying to get wildcard certificates, but just because they haven't yet convinced CAs to allow them to have wildcard certificates doesn't make it anywhere close to shareware bullshit. > Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt. This is FUD. Why do you care about IdenTrust beating their chest? Why do you want to use another backing CA? What possible benefit does that provide? The whole CA thing is fucked anyway (in terms of the massive centralisation), so changing the backing CA won't do much. Also, to be fair, they did pull the trigger on LE, so it's not fair to get all pissy when they take credit for their decision.

adregan 11y ago

I just set up a free ssl cert via AWS[0] yesterday for serving static assets and securing an API Gateway endpoint (previously was using a free Lets Encrypt[1] cert). So hopefully there will be more ways around certification authorities who charge. 0: http://aws.amazon.com/certificate-manager/ http://aws.amazon.com/certificate-manager/ 1: https://letsencrypt.org/ https://letsencrypt.org/

tomjen3 11y ago

Chrome and Firefox should remove the root certificate of any provider that charges for SSL certificates. Not because 10 usd is much, but because it prevents the web from being open to people in third-world countries or those who don't want to (or can't) run their own servers (and so can't use lets encrypt).

comex 11y ago
You don't need to run your own server to use Let's Encrypt. You probably do want some sort of automated method for updating the cert due to the low expiration time (though it isn't mandatory), but that can be done in many ways such as a desktop application, or just having the shared hosting service add built-in support for Let's Encrypt, as Dreamhost has already done.