10 ms·
Early Impacts of Let's Encrypt
- spinlock 11y agoIs this a typical workflow for statistical analysis? The choice of go and mariadb seemed unique to me and I was wondering what others were using.
- chillydawg 11y agoMariaDB probably because the data he had was already in mysql/maria format or he had a meaty mariadb server set up. Go: it's easy to hack stuff together. Generally speaking, statistical analysis of stuff boils down to whatever you're comfortable with and what your goals are.
- jvehent 11y agotldr: Let's Encrypt is achieving its original mission: help people use TLS on domains that were previously insecure, and make the internet a safer place. > In the first quarter of its' operation then, Let's Encrypt has far and away been used more to secure previously-unsecured (or at least untrusted) websites than simply as a cost-savings measure.
- tootie 11y agoI've used them a bunch. We host a lot of internal-facing utilities that are low-profile, but occasionally hosting sensitive data. In the past I couldn't convince managers to spend money on certs even if the cost of someone stumbling on these sites could be very high and certs are cheap. Now I don't even have to ask.
- diafygi 11y agoKeep in mind that Let's Encrypt publishes a searchable list of all domains issued. https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395
- toomuchtodo 11y agoThis is why we're not using Let's Encrypt for internal/sensitive non-user facing services at the moment. Wildcard instead.
- tootie 11y agoWhy?
- pfg 11y agoFWIW, keeping internal hostnames private might be part of a security-by-obscurity strategy.
- technion 11y agoThey are following that Certificate transparency standard that, eventually, everyone will need to follow. It's already a requirement for anyone issuing EV certificates. Note crt.sh is actually a Comodo website, for interrogating the CT logs.
- schoen 11y agoOne way of putting it is that we want to get caught as quickly as possible if we ever misissue a certificate. We don't think it's a benefit to us or the certificate-using (relying party) public if we have the ability to secretly issue certs that are erroneous.
- pred_ 11y agoAs far as I can tell, the website can not be used to browse all certificates directly; when the number was at 500k, the site would consistently time out when trying to fetch the oldest ~250k. Is the raw data available somewhere? On a completely different and off-topic note, as someone who would normally just handle my certificate needs by piping together 10 openssl commands, your ACME client is super handy!
- pfg 11y agoThe raw data is publicly available on Certificate Transparency log servers[1]. There are various clients for CT log servers out there, but they all require you to essentially download the entire log to query it (there's no query API). [1]: https://www.certificate-transparency.org/known-logs https://www.certificate-transparency.org/known-logs
- davidgerard 11y agoYep - this is something we plan to do as well, SSLize all the dev servers just because we can and then they better reflect live.
- ratsbane 11y agoI tried Let's Encrypt for the first time a week or two ago and was really impressed. This is the way to do it. Well done!
- ex3ndr 11y agoSo, Let's Encrypt became 4-th in the world by amount of certs? Am i right?
- pfg 11y ago4th largest counting certificates that are either on Certificate Transparency Log servers or in censys' data set. CT logs are populated by CAs sending their certificates to log servers. Only a few CAs (including Let's Encrypt) do this consistently at the moment, since it's only mandatory for EV certs (for now), and CAs generally move rather slowly. Certificates encountered by Googlebot during web crawling also get pushed to their log servers. Censys probably does something similar. It's possible that there's a large number of certificates issued only for internal systems that would not end up on CT log servers and that are not accessible by public crawlers, so the numbers are probably not painting a full picture. It is, however, as close as you can get to the full picture unless every CA is willing to release their internal numbers.
- comex 11y agoWow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web. There certainly seems to have been pent-up demand.
- toyg 11y agoThere is always pent-up demand for a previously-expensive service to become free.
- jonlucc 11y agoThere were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.
- toyg 11y agoNo there were not. Free options meant untrusted certificates or short-lived certificates that could not be renewed. LE made SSL free, trusted and long-term. You could have made it twice as hard to do the initial setup and people would have jumped at the opportunity regardless.
- pfg 11y agoStartSSL and WoSign have been offering free, publicly trusted certificates with one year lifetimes (and the ability to renew for free) for quite some time. The former doesn't allow commercial usage, while the latter operates in China. That's probably why it wasn't an option for a lot of people. (That, and the terrible UX at least in StartSSL's case.)
- _ak 11y agoStartSSL isn't free. They charge for certificate revocation.
- 11y ago
- MCRed 11y agoDoes anyone know where one can get a free wildcard certificate? Need it for development and foo/bar/baz/biff.example.com change names regularly (they include the hash of the code commit) so I would like to get a *.dev.example.com wildcard cert. (one that won't give warnings that scare the business types who are testing the code, and won't understand what self-signed means.)
- moatra 11y agoAmazon Cetrificate Manager seems to do this, but it's only available in one region right now.
- scrollaway 11y agoYou can get sub-€100/year wildcard certs on gandi.net (free the first year for their own domains I think?), which shouldn't be a problem for a business expense.
- AcidBurn 11y agoOther than Amazon Certificate Manager as moatra mentions (which I don't think let's you export the certificate), I don't think there is currently an option for free wildcard certificates. As an alternative you could incorporate provisioning of a Let's Encrypt certificate for the new subdomain into your deployment process since the process is designed to be automated.
- iancarroll 11y agoCurrent rate limiting wouldn't really make it possible, unfortunately.
- x0 11y agoNot if you have more than five subdomains, you have to wait for a week, like me.
- detaro 11y ago... if you need a different certificate for each subdomain. You are limited to 5 certificates per domain per week, each of which can be valid for many subdomains. Bad if you want to be able to add them dynamically every time a new name comes up, but if it is a static set...
- yoha 11y agoFor anyone struggling with creating Let's Encrypt certificates (or just as lazy as I am), try out https://gethttpsforfree.com/ https://gethttpsforfree.com/ .
- veeti 11y agoI'll plug my own client [1], which is also completely manual for those who don't want to go all in on the magic automation just yet. It also has DNS verification, which is probably more convenient in most cases. [1] https://github.com/veeti/manuale https://github.com/veeti/manuale
- andrewpe 11y agoThe client I use: https://news.ycombinator.com/item?id=10676685 https://news.ycombinator.com/item?id=10676685
- TazeTSchnitzel 11y agoThe CLI version of the LE client is pretty simple to use. Literally one command line.
- bogus- 11y agoYes, it's almost too convenient. Lazy me is still slightly miffed that auto nginx is not fully supported, however.
- schoen 11y agoSorry for the delay. It's turned out that parsing is hard, especially in the absence of a formal grammar for configuration file formats! If you don't need the certs automatically installed, nginx users are generally doing well with the webroot plugin (which automatically creates files to perform the ACME challenge, regardless of what webserver is serving those files). This will also work for renewal, as long as you're able to do the initial configuration of your nginx to work with the certs you get.
- recursive 11y ago
- sansidentity 11y agoHypothetical. If I run a website for a small town public library that only serves information, ie no user accounts and no logins on our domain, is there a valid reason for me to go through the process of https and certificates? Plus I'm on a shared host. I briefly looked at the install doc on letsencypt and while it's clear it's easier than it used to be I am uncertain my shell access will give me the necessary permissions to even accomplish it without upgrading to something thing like a vps or administering my own vm with a cloud provider. Which is honestly something I am less than interested in doing if I can help it. Keeping a Web server secure is seems brutal to me.
- suraj 11y agoIn the case of library you would want to protect users privacy for searching books. I do not think it is possible to switch to https on shared hosting without explicit action from the provider. For minimal administration, a cloud provider will work best. Check out AWS since they also offer free certificates.
- pfg 11y agoEncrypting sensitive user data is only one advantage of TLS. Without TLS, every single network hop between you and your client could modify your site. This could mean altering the content, adding ads or even malware. Some large ISPs have done so in the past. Furthermore, browsers vendors have decided that HTTPS is the way to go forward and will gradually mark HTTP-only sites as unsafe. New browser APIs might only be available in secure contexts. You might be interested in this list of web hosts that support Let's Encrypt[1]. Generally speaking, your hoster should be able to provide a one-click interface for obtaining and installing a certificate for you, and odds are most hosts will eventually do so free of charge once HTTPS becomes mandatory. [1]: https://github.com/letsencrypt/letsencrypt/wiki/Web-Hosting-Supporting-LE https://github.com/letsencrypt/letsencrypt/wiki/Web-Hosting-...
- htor 11y agoI think Google penalizes non-https sites, so that's one reason.
- Titanous 11y ago
- ralmidani 11y agoJust the other day, we finished a "dry run" deployment of our new app for small businesses on a Digital Ocean droplet running Debian and Apache (our app is Ember and Django). Let's Encrypt was the final step. We followed the instructions provided by DO[0], and aside from our mistake of leaving a previous attempt as a Virtualhost on port 443, the client just works out-of-the-box. It automatically detects which file has the Virtualhost for port 80, asks you if you want to force redirect to https, copies your script to a new file with a Virtualhost on port 443 (adding SSL and telling Apache where to find the certs), and enables the site for you. Needless to say, my pair programmer and I were impressed thoroughly. [0]https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04 https://www.digitalocean.com/community/tutorials/how-to-secu...
- obituary_latte 11y agoSorry if I'm not understanding, but so it generates an httpd.conf for you?
- schoen 11y agoThe apache plugin for the Let's Encrypt Python client can edit apache configuration files (one of the most complex and hard-to-get-right but also one of the most convenient features of the client). There is also an nginx plugin which is significantly more experimental and which also edits nginx configuration files.
- ralmidani 11y agoWe had our sites configured in sites-enabled (ember.conf and django.conf). The LE client copied everything over to new files with encryption enabled, and had the old port 80 Virtualhosts redirect to the port 443 Virtualhosts.
- ShakataGaNai 11y agoSo one thing that would be interesting to take a look at from this dataset is wildcard vs non-wildcard. My employer has two wildcard certs for public sites (purchased from your standard vendors) and that's all that is required (for a lot of places). However one of my personal domains I play with a lot of technologies, all on their own subdomains. So for that single domain I probably have 10 LE certs (and yes, none of these were secured before). So maybe it's not wildcard vs non-wildcard, it's limit the datasets to root domain names?
- pfg 11y agoSlightly OT: It would be great if CT logs were available as part of Amazon's or Google's public data sets. Being able to access that data via BigQuery (or similar) would make generating something like this way easier. It would also be immensely useful when implementing CT log monitors.
- jchomali 11y agoI started using Let's Encrypt for a new app backend that I am building. I find very useful its free service as it give developers the opportunity to use secure servers to keep users privacy and server's security for free
- jchomali 11y agotext
- jchomali 11y agoI started using Let's Encrypt for a new app backend that I am building. I find it very useful as it give developers the opportunity to use secure servers to keep users privacy and server's security for free
- timetraveller 11y agoHow compatible is it? Are PositiveSSL/Comodo any more compatible?
- loumf 11y agoIt's nice that it's free, but if you have the means (like, you are using it for a business), please consider donating some of your savings.
- forlorn 11y agoIt doesnt support browsers in Windows XP and it is the only annoying thing which forced me to rollback letsencrypt. I know it is 2016 but complaining clients is not what you want anyway. I still have no idea if they are able to fix this in future.
- onuras 11y agoI installed Windows XP few days ago, Letsecrypt certificates are working fine on Firefox 43, it just doesn't work if you are using SNI and IE8. Haven't tried Chrome but it must work.
- heinrich5991 11y agoFirefox uses its own certificate store, that's why it works on Windows XP. Chrome and Internet Explorer will likely not work, because they use Windows XP's certificates, which don't include trust for Let's Encrypt.
- pfg 11y agoTheir root certificate is currently not trusted by any browser vendor. They have a cross-sign from IdenTrust, which is trusted even by XP. However, their intermediate certificate uses a name constraint in a way that causes schannel (Microsoft's TLS stack) on XP to think they're not allowed to issue certificates for any domain name. Chrome and IE use schannel, while Firefox ships its own TLS stack. This bug was fixed in newer versions of Windows. This might get fixed if someone finds a way to generate an intermediate cert that doesn't trigger this bug (while still including the *.mil constraint).
- hwdsl2 11y agoNo, Let's Encrypt does not work in either Chrome or IE on Windows XP [1]. This is a known bug with their intermediate certificate [2]. [1] https://github.com/letsencrypt/letsencrypt/issues/1660 https://github.com/letsencrypt/letsencrypt/issues/1660 [2] https://community.letsencrypt.org/t/help-needed-windows-xp-support/8756 https://community.letsencrypt.org/t/help-needed-windows-xp-s...
- vbezhenar 11y agoI used StartSSL and WoSign certificates for all websites I had to setup, but I welcome that initiative and my next website will certainly use LE certificate. While it was technically possible to issue free certificates before, LE looks much safer option. After all StartSSL and WoSign are both commercial entities and they can do what they want.
- dk8996 11y agoI got to say AWS Certificate Manager is a game changer -- it took me 5 min to secure two domains. Last time I did it, buying a certificate and converting to work with AWS took about four hrs.