4 ms·
Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure W
by comex 11y ago
Wow. Public beta for 2.5 months and already 700,000 certificates issued, more than a third of the largest competitor's number, about 10% of the entire secure Web.
There certainly seems to have been pent-up demand.
- toyg 11y agoThere is always pent-up demand for a previously-expensive service to become free.
- jonlucc 11y agoThere were free options. I think the biggest benefits to Let's Encrypt are the EFF's clout and the simplicity.
- toyg 11y agoNo there were not. Free options meant untrusted certificates or short-lived certificates that could not be renewed. LE made SSL free, trusted and long-term. You could have made it twice as hard to do the initial setup and people would have jumped at the opportunity regardless.
- pfg 11y agoStartSSL and WoSign have been offering free, publicly trusted certificates with one year lifetimes (and the ability to renew for free) for quite some time. The former doesn't allow commercial usage, while the latter operates in China. That's probably why it wasn't an option for a lot of people. (That, and the terrible UX at least in StartSSL's case.)
- _ak 11y agoStartSSL isn't free. They charge for certificate revocation.
- beefhash 11y agoFurthermore, their free certificates cannot be used for commercial purposes.
- mehrdada 11y agoI don't know why your comment is downvoted -- this is acutally a legitimate issue mentioned in their terms of service.
- nailer 11y agoStartSSL generally don't mention their terms, so a lot of the use of 'StartSSL Free' is commercial. People don't like to hear they've been misled (and shoot the messenger).
- vsl 11y agoThey actually started policing this and refuse to renew a certificate if they decide it's a commercial use. Happened to me and rather than argue with them (it wasn't), I bought a $5 one at ssls.com...
- mehrdada 11y agoWhile I agree LetsEncrypt is awesome, the certificates are actually shorter-lived (90 days), I believe, than the former CAs that issued certs for free (e.g. StartSSL) that offered a year of validity. The rationale is replacing the keys sooner since you can easily do it automatically with LE.
- IgorPartola 11y agoI used to use Wossl and StartSSL before for lots of little personal projects. I recently switched everything over to LE. I am looking forward to switching other projects to it too, such as ones for clients where we had to pay for wildcard certs in the past. Not having to mark the calendar to renew certs every year is going to be really nice. Incidentally, does anyone have a good way to integrate LE with EC2's load balancers?
- iancarroll 11y agoAmazon operates a free CA (Amazon Certificate Manager) for use with ELB and CloudFront.
- deleted 11y ago[deleted]
- teh 11y agoFor us the free doesn't matter because certificates are cheap. It's the byzantine and insecure process of obtaining a cert (sending us our private cert in a zip in a plain text mail. I mean, really?) that makes LE so great. Edit: Total brainfart, apologies; The company sending us private info as a zip was a different thing.
- pfg 11y agoYour CA should not be in a position to send you your private key. They don't need it in order to sign your certificate. Pretty much every CA I'm aware of allows you to provide your own CSR (which only includes your public key). Sending the certificate (as opposed to the private key) via email is fine, since that only includes your public key, which is visible to every site visitor anyway. (I agree that an automated process based on an open, standardized specification is preferable.)
- nailer 11y agoAgreed a thousand percent, but there are services that offer easy installs onto cloud providers that do know your private key - that's how they get it onto your ELB or Heroku.
- duaneb 11y agoIf you can restrict the service to a subdomain, there are alternatives like the SAN extension that allow those third parties to avoid handling your private key at a small extra cost.
- nailer 11y agoI'm having trouble understanding your comment. SANs are mandatory (current browsers don't even use CNs), how would SANs specifically prevent this? The endpoint where your terminating your traffic obviously must have the private key to decrypt it.
- 11y ago
- wildpeaks 11y agoAnother interesting stat is that it's mostly domains that didn't have https before.
- johannes1234321 11y agoMight be interesting to look in a year's time - I don't think people will replace commercial certs before their expiration by a free offer in beta. Ones those expire it becomes interesting.
- mapunk 11y agoWhy is that interesting? I have quite a few sites where I'd rather keep my commercial cert (which expires every 12 months), as opposed to a beta cert that expires every 3 months.