7 ms·

Let’s Encrypt client will transition to a new name and a new home at EFF

321 points by riqbal 11y ago

_jomo 11y ago
Previous post: https://news.ycombinator.com/item?id=11253570 https://news.ycombinator.com/item?id=11253570
- dfc 11y ago
  Previous post with zero comments. Who cares?
  - prawn 11y ago
    _jomo, who submitted it. It's "I submitted this already but wasn't the one who got the fake internet points." _jomo, it happens. Don't worry about it.
heavenlyhash 11y ago
Anyone looking to use Let's Encrypt and free to make choices regarding their server may want to check out https://caddyserver.com/ https://caddyserver.com/ -- it has Let's Encrypt support baked right in.
- geostyx 11y ago
  Caddy is working really well for me. Way easier than nginx to setup, and TLS is on by default.
- recursive 11y ago
  Wow, this is awesome. I had been assuming letsencrypt supported only Unixy operating systems. Most of the web hosts I care about necessarily run Windows, so I thought letsencrypt was out of reach. I wonder how they did this.
  - simoncion 11y ago
    > I wonder how they did this. The ACME protocol is simple and fully documented: https://letsencrypt.github.io/acme-spec/ https://letsencrypt.github.io/acme-spec/
- pilif 11y ago
  I've said it before when caddy was last mentioned, but this is how I want Let's Encrypt to work with all web servers. Yes. That includes the big ones like nginx, apache and even IIS. By default, all that's needed is to turn on ssl and you'll be up and running - including a let's encrypt certificate. Following this vision is why I believe that let's encrypt limited the validity period of their certs (in addition to some security benefits and much lower OCSP load): Once the integration into clients has proceeded to this level where caddy is showing us it's going to, then even quicker expirations would become feasible - heck even as low as a week or so. So, while I'm not planning on using caddy any time soon (I don't see a benefit to switching away from nginx right now), I applaud caddy for showing everyone how this should be done. A huge thank you to the author. This goes to show how very important UX is even for backend-y stuff.
  - xt 11y ago
    I've been working on a script that does this within Nginx. See https://github.com/torhve/lua-resty-letsencrypt https://github.com/torhve/lua-resty-letsencrypt It's not quite production ready but it shows you it's technically possible
  - mholt 11y ago
    Thank you for your kind remarks. :) It goes a long way to keeping the burnout away.
- hackerboos 11y ago
  Dokku's Letsencrypt plugin is also very simple to use. https://github.com/dokku/dokku-letsencrypt https://github.com/dokku/dokku-letsencrypt
- embik 11y ago
  Caddy sounds great but I'm a bit worried by the fact it does not offer repositories for major Linux distributions. Shouldn't a component that important for public facing servers be included in standard software updating processes?
  - nitrogen 11y ago
    In my experience it's not typical for web infrastructure to come from distro packages, unfortunately.
riscy 11y ago
> Another reason is that we want it to be clear that the client can work with any ACME-enabled CA in the future, not just Let’s Encrypt. Great to see that they are actively aware of CA monopolization, and taking steps to avoid becoming one themselves.
mioelnir 11y ago
Missed opportunity to move beyond the reach of NSLs.
- ceejayoz 11y ago
  On the other hand, it's a potential opportunity for the EFF to collect some in the wild.
- andruby 11y ago
  What are NSLs?
  - ceejayoz 11y ago
    https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter Incidentally, moving out of reach of NSLs just means you're now in the reach of the CIA/NSA with no need for a warrant.
    - leereeves 11y ago
      And within the reach of other governments likely to be equally (if not more) meddlesome.
- patrickod 11y ago
  How would one move beyond the reach of NSLs?
  - mastax 11y ago
    I presume the OP meant moving LetsEncrypt to an organization that's in a more privacy-friendly jurisdiction.
    - duskwuff 11y ago
      Which isn't what's happening here. What's being transferred to the EFF is not the whole service, but one specific piece of client software which interacts with the service.
desireco42 11y ago
Let's encrypt really helps get ssl everywhere. It is not super easy to set it up, but I am sure this will get better as time goes, this is huge.
- RKearney 11y ago
  Let's Encrypt makes an effort not to use "ssl" anywhere on their site when they really mean tls or https. I'd also hope that no one helps get ssl anywhere given the vulnerabilities that come with it.
  - desireco42 11y ago
    Can you explain me a little, I am not sure I understand all the points. I can't say I follow everything that is happening in crypto world, I just know I could use free ssl cert for small sites and I have one personal one that I was able to 'secure' with Let's Encrypt cert. As someone said, if it could work, just by saying SSL yes, it would help a lot.
    - mholt 11y ago
      Technically, SSL is the name of the older protocol that TLS replaced. TLS builds upon SSL so that it's more secure. Unfortunately, SSL is still the ubiquitous term, it seems, but we really should start saying TLS now so as not to confuse unsuspecting site owners / sysadmins.
    - _fs 11y ago
      SSL is a dead protocol that has major vulnerabilities. It no longer has support and anyone still using it should really move on. TLS is the recommended replacement protocol that is still secure. HTTPS can be thought of as secure http, regardless of protocol.
    - desireco42 11y ago
      Thank you both. Understand.
- cm2187 11y ago
waskosky 11y ago
If you were like me and holding out on Let's Encrypt until Windows XP is supported (even Chrome is still broken on XP) it looks like a date of March 22nd has been set for "getting new cross-signatures from IdenTrust which work on Windows XP." https://letsencrypt.org/upcoming-features/ https://letsencrypt.org/upcoming-features/ https://github.com/letsencrypt/letsencrypt/issues/1660 https://github.com/letsencrypt/letsencrypt/issues/1660
- groovy2shoes 11y ago
  Why on earth are you still running Windows XP?
  - schoen 11y ago
    More likely a matter of having a site that has a lot of users who are still running it.
    - vsl 11y ago
      Or an application… Exactly that.
  - waskosky 11y ago
    I haven't met many of these people to ask them, but I know they still exist because of their user agent containing "Windows NT 5.1" and I know for sure they aren't all bots, and many of them even live in Southern California. I suspect these are the people who would be most confused by websites failing to load. The cost of providing support then is much greater than the cost of a Comodo certificate.
    - groovy2shoes 11y ago
      I see. It's a shame you can't intercept the error and display your own along the lines of "upgrade your damn OS already!"
      - 11y ago
BillyParadise 11y ago
Need to refresh the cert every 3 months, need to pick a new name every 3 months too?
cm2187 11y ago
Does that mean that they also intend to develop a client for IIS? It would be great if Microsoft was doing that themselves instead. That the Let's Encrypt client would come by default out of the box.

321 points by riqbal 11y ago

_jomo 11y ago

Previous post: https://news.ycombinator.com/item?id=11253570 https://news.ycombinator.com/item?id=11253570

dfc 11y ago
Previous post with zero comments. Who cares?
- prawn 11y ago
  _jomo, who submitted it. It's "I submitted this already but wasn't the one who got the fake internet points." _jomo, it happens. Don't worry about it.

heavenlyhash 11y ago

Anyone looking to use Let's Encrypt and free to make choices regarding their server may want to check out https://caddyserver.com/ https://caddyserver.com/ -- it has Let's Encrypt support baked right in.

geostyx 11y ago
Caddy is working really well for me. Way easier than nginx to setup, and TLS is on by default.
recursive 11y ago
Wow, this is awesome. I had been assuming letsencrypt supported only Unixy operating systems. Most of the web hosts I care about necessarily run Windows, so I thought letsencrypt was out of reach. I wonder how they did this.
- simoncion 11y ago
  > I wonder how they did this. The ACME protocol is simple and fully documented: https://letsencrypt.github.io/acme-spec/ https://letsencrypt.github.io/acme-spec/
pilif 11y ago
I've said it before when caddy was last mentioned, but this is how I want Let's Encrypt to work with all web servers. Yes. That includes the big ones like nginx, apache and even IIS. By default, all that's needed is to turn on ssl and you'll be up and running - including a let's encrypt certificate. Following this vision is why I believe that let's encrypt limited the validity period of their certs (in addition to some security benefits and much lower OCSP load): Once the integration into clients has proceeded to this level where caddy is showing us it's going to, then even quicker expirations would become feasible - heck even as low as a week or so. So, while I'm not planning on using caddy any time soon (I don't see a benefit to switching away from nginx right now), I applaud caddy for showing everyone how this should be done. A huge thank you to the author. This goes to show how very important UX is even for backend-y stuff.
- xt 11y ago
  I've been working on a script that does this within Nginx. See https://github.com/torhve/lua-resty-letsencrypt https://github.com/torhve/lua-resty-letsencrypt It's not quite production ready but it shows you it's technically possible
- mholt 11y ago
  Thank you for your kind remarks. :) It goes a long way to keeping the burnout away.
hackerboos 11y ago
Dokku's Letsencrypt plugin is also very simple to use. https://github.com/dokku/dokku-letsencrypt https://github.com/dokku/dokku-letsencrypt
embik 11y ago
Caddy sounds great but I'm a bit worried by the fact it does not offer repositories for major Linux distributions. Shouldn't a component that important for public facing servers be included in standard software updating processes?
- nitrogen 11y ago
  In my experience it's not typical for web infrastructure to come from distro packages, unfortunately.

riscy 11y ago

> Another reason is that we want it to be clear that the client can work with any ACME-enabled CA in the future, not just Let’s Encrypt. Great to see that they are actively aware of CA monopolization, and taking steps to avoid becoming one themselves.

mioelnir 11y ago

Missed opportunity to move beyond the reach of NSLs.

ceejayoz 11y ago
On the other hand, it's a potential opportunity for the EFF to collect some in the wild.
andruby 11y ago
What are NSLs?
- ceejayoz 11y ago
  https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter Incidentally, moving out of reach of NSLs just means you're now in the reach of the CIA/NSA with no need for a warrant.
  - leereeves 11y ago
    And within the reach of other governments likely to be equally (if not more) meddlesome.
patrickod 11y ago
How would one move beyond the reach of NSLs?
- mastax 11y ago
  I presume the OP meant moving LetsEncrypt to an organization that's in a more privacy-friendly jurisdiction.
  - duskwuff 11y ago
    Which isn't what's happening here. What's being transferred to the EFF is not the whole service, but one specific piece of client software which interacts with the service.

desireco42 11y ago

Let's encrypt really helps get ssl everywhere. It is not super easy to set it up, but I am sure this will get better as time goes, this is huge.

RKearney 11y ago
Let's Encrypt makes an effort not to use "ssl" anywhere on their site when they really mean tls or https. I'd also hope that no one helps get ssl anywhere given the vulnerabilities that come with it.
- desireco42 11y ago
  Can you explain me a little, I am not sure I understand all the points. I can't say I follow everything that is happening in crypto world, I just know I could use free ssl cert for small sites and I have one personal one that I was able to 'secure' with Let's Encrypt cert. As someone said, if it could work, just by saying SSL yes, it would help a lot.
  - mholt 11y ago
    Technically, SSL is the name of the older protocol that TLS replaced. TLS builds upon SSL so that it's more secure. Unfortunately, SSL is still the ubiquitous term, it seems, but we really should start saying TLS now so as not to confuse unsuspecting site owners / sysadmins.
  - _fs 11y ago
    SSL is a dead protocol that has major vulnerabilities. It no longer has support and anyone still using it should really move on. TLS is the recommended replacement protocol that is still secure. HTTPS can be thought of as secure http, regardless of protocol.
  - desireco42 11y ago
    Thank you both. Understand.
cm2187 11y ago

waskosky 11y ago

If you were like me and holding out on Let's Encrypt until Windows XP is supported (even Chrome is still broken on XP) it looks like a date of March 22nd has been set for "getting new cross-signatures from IdenTrust which work on Windows XP." https://letsencrypt.org/upcoming-features/ https://letsencrypt.org/upcoming-features/ https://github.com/letsencrypt/letsencrypt/issues/1660 https://github.com/letsencrypt/letsencrypt/issues/1660

groovy2shoes 11y ago
Why on earth are you still running Windows XP?
- schoen 11y ago
  More likely a matter of having a site that has a lot of users who are still running it.
  - vsl 11y ago
    Or an application… Exactly that.
- waskosky 11y ago
  I haven't met many of these people to ask them, but I know they still exist because of their user agent containing "Windows NT 5.1" and I know for sure they aren't all bots, and many of them even live in Southern California. I suspect these are the people who would be most confused by websites failing to load. The cost of providing support then is much greater than the cost of a Comodo certificate.
  - groovy2shoes 11y ago
    I see. It's a shame you can't intercept the error and display your own along the lines of "upgrade your damn OS already!"
    - 11y ago

BillyParadise 11y ago

Need to refresh the cert every 3 months, need to pick a new name every 3 months too?

cm2187 11y ago

Does that mean that they also intend to develop a client for IIS? It would be great if Microsoft was doing that themselves instead. That the Let's Encrypt client would come by default out of the box.