4 ms·

Watch LetsEncrypt issue its millionth certificate live

75 points by svenfaw 11y ago

Aissen 11y ago
Is this a Certificate Transparency log ? It does not look "live" though. How often is it refreshed ?
- metachris 11y ago
  It refreshed a few minutes ago. Perhaps all 15 min?
  - Aissen 11y ago
    Yes, and it just grew by ~20 certificates, which means people aren't gettings those as quickly as I thought.
    - metachris 11y ago
      It jumped from 997,800 to 998,500 to 999,905 within the last 30 minutes. So i guess in in the next hour they will break 1M.
      - aorth 11y ago
        Lucky me, I saw it at 999,905 and then immediately refreshed and it was at 1,000,038. I feel so blessed to have seen it pass 1M. :)
    - darfs 11y ago
      +33 certs by last reload. Edit: 1Million
- technion 11y ago
  The transparency logs themselves grow in bulk. If I watch one of the main logs with a 30 second refresh, I can go two hours without a single cert, then 2000 or so scroll past at once.
noja 11y ago
Who is publishing this list of possibly not-published-anywhere-else SSL sites? Having them all in a big easy to download list is not what I expected from LetsEncrypt.
- xrstf 11y ago
  It's the public certificate audit log. It's not an accidental data leak.
- blfr 11y ago
  Certificate transparency makes it much harder to surreptitiously issue a certificate and holds the offending CA responsible in case of unauthorized certificates. If your site is not public, you're better off with your own private CA anyway.
- JetSpiegel 11y ago
  https://whois.domaintools.com/crt.sh https://whois.domaintools.com/crt.sh Thought I recognised the favicon, it's Comodo. I don't see the problem, if you want a secret url then self sign and distribute your certificate with other methods.
- dan1234 11y ago
  It’s intentional. The general idea is to make it easier to detect fraudulently issued certificates. LetsEncrypt submit all certificates[0] to Certificate Transparency[1] logs. Chrome won’t actually show the green address bar for EV certs unless a CT proof is provided along with the certificate[2]. [0]https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/ [1]https://www.certificate-transparency.org/faq https://www.certificate-transparency.org/faq [2]https://blog.digicert.com/certificate-transparency-required-ev-certificates-show-green-address-bar-chrome/ https://blog.digicert.com/certificate-transparency-required-...
- fpoling 11y ago
  For private sites just use your own CA. Also the server for LetsEncrypt is open source [1] and comes with test scripts to run it during development and testing to avoid premature exposure to the public instance of LetsEncrypt. [1] https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
jpcarmona 11y ago
Why does it look that most of issued certificates are for malware /ads domains? I'm guessing from the weird names.
- fpoling 11y ago
  It could be very well that most domains on the internet are for malware and ads where the cost of the domain itself is just slightly below break even point and LetsEncrypt now allows to serve them over https without extra investment.
thejosh 11y ago
Woo! Just hit the 1,000,038th!
- phit_ 11y ago
  #1,000,000 https://crt.sh/?id=14392504 https://crt.sh/?id=14392504
- dan2k3k4 11y ago
  I think this was the 1,000,000th one: https://crt.sh/?id=14392497 https://crt.sh/?id=14392497 [but I just counted back down 38 from the page list...]
  - phit_ 11y ago
    If you include the most recent you have to count down by 39, yours is the 1,000,001st
    - darfs 11y ago
      Why can't it be simply ?id=1000000? .__.
      - phit_ 11y ago
        the site is owned by Comodo, it shows logs for various CA's
        darfs 11y ago
        Hrm. Ok. Never saw it before and looking atm from mobile. Sorry :)
      - deleted 11y ago
        [deleted]
metachris 11y ago
For reference: * Certificate # 250k: Jan. 5, 2016 [1] * Certificate # 500k: Feb. 4, 2016 [2] * Certificate # 1M: Mar. 8, 2016 Seems they went from 250k certs per month in Jan to 500k certs per month in Feb. [1] https://twitter.com/letsencrypt/status/684221075966705664 https://twitter.com/letsencrypt/status/684221075966705664 [2] https://twitter.com/letsencrypt/status/695077737380208640 https://twitter.com/letsencrypt/status/695077737380208640
- evilpie 11y ago
  https://letsencrypt.org/stats/ https://letsencrypt.org/stats/
executesorder66 11y ago
Yay to : webdemo.jung.de You win some internet points.
- slevin063 11y ago
  Its vuweb.smf.telema-stg.whitecloud.jp actually!
  - zeeZ 11y ago
    I counted the same. https://crt.sh/?id=14392504 https://crt.sh/?id=14392504
  - executesorder66 11y ago
    Damn off by 1 errors.
jorgecurio 11y ago
has anyone been able to use letsencrypt with AWS api gatway? I've been struggling for months. I keep getting https crossed out in red when accessing my aws api gateway endpoint.... I generated certificates for *.mysite.com and when I go to api.mysite.com it throws warning and if you continue the https in the address bar is red and crossed out....

75 points by svenfaw 11y ago

Aissen 11y ago

Is this a Certificate Transparency log ? It does not look "live" though. How often is it refreshed ?

metachris 11y ago
It refreshed a few minutes ago. Perhaps all 15 min?
- Aissen 11y ago
  Yes, and it just grew by ~20 certificates, which means people aren't gettings those as quickly as I thought.
  - metachris 11y ago
    It jumped from 997,800 to 998,500 to 999,905 within the last 30 minutes. So i guess in in the next hour they will break 1M.
    - aorth 11y ago
      Lucky me, I saw it at 999,905 and then immediately refreshed and it was at 1,000,038. I feel so blessed to have seen it pass 1M. :)
  - darfs 11y ago
    +33 certs by last reload. Edit: 1Million
technion 11y ago
The transparency logs themselves grow in bulk. If I watch one of the main logs with a 30 second refresh, I can go two hours without a single cert, then 2000 or so scroll past at once.

noja 11y ago

Who is publishing this list of possibly not-published-anywhere-else SSL sites? Having them all in a big easy to download list is not what I expected from LetsEncrypt.

xrstf 11y ago
It's the public certificate audit log. It's not an accidental data leak.
blfr 11y ago
Certificate transparency makes it much harder to surreptitiously issue a certificate and holds the offending CA responsible in case of unauthorized certificates. If your site is not public, you're better off with your own private CA anyway.
JetSpiegel 11y ago
https://whois.domaintools.com/crt.sh https://whois.domaintools.com/crt.sh Thought I recognised the favicon, it's Comodo. I don't see the problem, if you want a secret url then self sign and distribute your certificate with other methods.
dan1234 11y ago
It’s intentional. The general idea is to make it easier to detect fraudulently issued certificates. LetsEncrypt submit all certificates[0] to Certificate Transparency[1] logs. Chrome won’t actually show the green address bar for EV certs unless a CT proof is provided along with the certificate[2]. [0]https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/ [1]https://www.certificate-transparency.org/faq https://www.certificate-transparency.org/faq [2]https://blog.digicert.com/certificate-transparency-required-ev-certificates-show-green-address-bar-chrome/ https://blog.digicert.com/certificate-transparency-required-...
fpoling 11y ago
For private sites just use your own CA. Also the server for LetsEncrypt is open source [1] and comes with test scripts to run it during development and testing to avoid premature exposure to the public instance of LetsEncrypt. [1] https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder

jpcarmona 11y ago

Why does it look that most of issued certificates are for malware /ads domains? I'm guessing from the weird names.

fpoling 11y ago
It could be very well that most domains on the internet are for malware and ads where the cost of the domain itself is just slightly below break even point and LetsEncrypt now allows to serve them over https without extra investment.

thejosh 11y ago

Woo! Just hit the 1,000,038th!

phit_ 11y ago
#1,000,000 https://crt.sh/?id=14392504 https://crt.sh/?id=14392504
dan2k3k4 11y ago
I think this was the 1,000,000th one: https://crt.sh/?id=14392497 https://crt.sh/?id=14392497 [but I just counted back down 38 from the page list...]
- phit_ 11y ago
  If you include the most recent you have to count down by 39, yours is the 1,000,001st
  - darfs 11y ago
    Why can't it be simply ?id=1000000? .__.
    - phit_ 11y ago
      the site is owned by Comodo, it shows logs for various CA's
      - darfs 11y ago
        Hrm. Ok. Never saw it before and looking atm from mobile. Sorry :)
    - deleted 11y ago
      [deleted]

metachris 11y ago

For reference: * Certificate # 250k: Jan. 5, 2016 [1] * Certificate # 500k: Feb. 4, 2016 [2] * Certificate # 1M: Mar. 8, 2016 Seems they went from 250k certs per month in Jan to 500k certs per month in Feb. [1] https://twitter.com/letsencrypt/status/684221075966705664 https://twitter.com/letsencrypt/status/684221075966705664 [2] https://twitter.com/letsencrypt/status/695077737380208640 https://twitter.com/letsencrypt/status/695077737380208640

evilpie 11y ago
https://letsencrypt.org/stats/ https://letsencrypt.org/stats/

executesorder66 11y ago

Yay to : webdemo.jung.de You win some internet points.

slevin063 11y ago
Its vuweb.smf.telema-stg.whitecloud.jp actually!
- zeeZ 11y ago
  I counted the same. https://crt.sh/?id=14392504 https://crt.sh/?id=14392504
- executesorder66 11y ago
  Damn off by 1 errors.

jorgecurio 11y ago

has anyone been able to use letsencrypt with AWS api gatway? I've been struggling for months. I keep getting https crossed out in red when accessing my aws api gateway endpoint.... I generated certificates for *.mysite.com and when I go to api.mysite.com it throws warning and if you continue the https in the address bar is red and crossed out....