3 ms·

As _ikke_ mentioned, it's as if you entirely missed the HN discussions about LE. https://en.wikipedia.org/wiki/Let's_Encrypt https://en.wikipedia.org/wiki/Let'

As _ikke_ mentioned, it's as if you entirely missed the HN discussions about LE. https://en.wikipedia.org/wiki/Let's_Encrypt https://en.wikipedia.org/wiki/Let's_Encrypt You can also search HN and GitHub to discover the numerous features and tools.

Grue3 11y ago
Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt.
- matt4077 11y ago
  - Why should I care about the backing CA as long as all browsers accept it? - You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. With their certificate expiry set at 3 months, that comes out to about 6,000 subdomains you can register. I know there are some setups where every user gets a subdomain. But I'd wager that less than 1 in 10000 LE users would run into these limits. (which may actually be lifted when the beta period ends). - LE doesn't offer any paid certificates so it's really hard to spin this as a shareware-style incentive to spend money with them.
  - Grue3 11y ago
    >Why should I care about the backing CA as long as all browsers accept it? https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar >You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. What if I want dynamic subdomains for my website? These limitations are absurdly low. >LE doesn't offer any paid certificates They don't, but their partners do. If HTTPS becomes ubiquitous and necessary to host a website, they stand to gain a lot.
- cyphar 11y ago
  > Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. First off, it's free software and it's an open community. LetsEncrypt is trying to get wildcard certificates, but just because they haven't yet convinced CAs to allow them to have wildcard certificates doesn't make it anywhere close to shareware bullshit. > Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt. This is FUD. Why do you care about IdenTrust beating their chest? Why do you want to use another backing CA? What possible benefit does that provide? The whole CA thing is fucked anyway (in terms of the massive centralisation), so changing the backing CA won't do much. Also, to be fair, they did pull the trigger on LE, so it's not fair to get all pissy when they take credit for their decision.

Grue3 11y ago

Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt.

matt4077 11y ago
- Why should I care about the backing CA as long as all browsers accept it? - You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. With their certificate expiry set at 3 months, that comes out to about 6,000 subdomains you can register. I know there are some setups where every user gets a subdomain. But I'd wager that less than 1 in 10000 LE users would run into these limits. (which may actually be lifted when the beta period ends). - LE doesn't offer any paid certificates so it's really hard to spin this as a shareware-style incentive to spend money with them.
- Grue3 11y ago
  >Why should I care about the backing CA as long as all browsers accept it? https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar >You can register up to 100 subdomains in a certificate and up to 5 certificates per domain/week. What if I want dynamic subdomains for my website? These limitations are absurdly low. >LE doesn't offer any paid certificates They don't, but their partners do. If HTTPS becomes ubiquitous and necessary to host a website, they stand to gain a lot.
cyphar 11y ago
> Let's Encrypt is essentially shareware. The basic features are available for free, but if you want something better than that, such as wildcard certificates, you must pay up. First off, it's free software and it's an open community. LetsEncrypt is trying to get wildcard certificates, but just because they haven't yet convinced CAs to allow them to have wildcard certificates doesn't make it anywhere close to shareware bullshit. > Not to mention that it's cross-signed with IdenTrust, a commercial CA, and since everyone on the web has to use this service to get HTTPS (there aren't other decent alternatives), this is a good way for IdenTrust to boost its numbers and be able to claim it's "the biggest CA in the world" or something. There's no way to choose a different CA with Let's Encrypt. This is FUD. Why do you care about IdenTrust beating their chest? Why do you want to use another backing CA? What possible benefit does that provide? The whole CA thing is fucked anyway (in terms of the massive centralisation), so changing the backing CA won't do much. Also, to be fair, they did pull the trigger on LE, so it's not fair to get all pissy when they take credit for their decision.