15 ms·

Leaving Beta, New Sponsors

896 points by dankohn1 11y ago

diegorbaquero 11y ago
I would like to thank LE and its sponsor for disrupting https and doing a great job. I love it.
K0nserv 11y ago
Let's Encrypt might be one of the most important initiatives for a secure web. I applaud all their great work. The fact that they have chosen to reduce certificate lifetime in order to encourage automation is a really big win for the security of the web as a whole.
- jaytaylor 11y ago
  The only hiccup I've run into is that if you run too many tests during automation setup then they start denying further requests from you for weeks or longer under "too many certificates issued for that domain".
  - K0nserv 11y ago
    Luckily they are raising the rate limit now when they are out of beta.
    - _wmd 11y ago
      Got a reference for this? I literally just bumped into the rate limit today
      - K0nserv 11y ago
        https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Also linked lower down in the thread
  - n0us 11y ago
    Maybe they should have single day "test certs" for which you can issue an unlimited number on a given day for a given domain. Not even completely sure this would work but it might be convenient to have even with the limit increase.
    - pfg 11y ago
      Given that the resource being limited here is signing operations performed by their HSM, this wouldn't really help much. (OCSP responses wouldn't have to be signed for quite as long, but still.) There's a staging server issuing untrusted certificates with significantly higher rate limits for this purpose. With the reference client, it's a matter of using the --staging flag.
    - duaneb 11y ago
      I'd prefer they open sourced and allowed you to run the service (self-signed) locally.
      - pfg 11y ago
        They do! boulder[1], the server software behind Let's Encrypt, is open source. [1]: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
        duaneb 11y ago
        I stand corrected! Seems like the best way to do your testing, then—nobody else needs to know how many times you sign your own certs.
  - viperscape 11y ago
    They're is a non CA cert they provide during testing, which should not affect rate limits. I don't have link handy but was just looking at this today.
  - pagwon 11y ago
    From https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ If you are trying out the client for the first time, you may want to use the --test-cert flag, and a domain name that does not receive live traffic. This will get certificates from our staging server. They won’t be valid in browsers, but otherwise the process will be the same, so you can test a variety of configuration options without hitting the rate limit.
    - crznp 11y ago
      It sounds like you are thinking of this being a tool for testing deployment configuration, but I could also see using it for internal test environments. The qc person adds the test CA to their browser, if they see "untrusted connection" then something is wrong. Would that model be supported?
      - vertex-four 11y ago
        For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer. [0] https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
    - Semaphor 11y ago
      Trying Let'sEncrypt out the first time I stumbled over this. --test-cert worked flawlessly after I figured out the kinks, as soon as I removed the flag it stopped working :/
  - fpoling 11y ago
    For testing just use a local install of boulder server, https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder . It is very straightforward to run one especially when using their Docker scripts. That is how I check my setup against letsencrypt during development/testing on my laptop.
- halviti 11y ago
  The only problem with reducing the lifetime at the moment is that all of the solutions to use this for windows are ... lacking. Without using the various hacks people have created, you can generate the certificates on linux and then move them over to windows, but doing this all the time is extremely inconvenient. I hope that this gets addressed at some point, because encryption is important for everyone, not just linux admins.
mvitorino 11y ago
Can someone clarify something for me please: "1.7 million certificates for more than 3.8 million websites" How is this possible if they (AFAIK) don't issue wildcard?
- mikecb 11y ago
  They do do SAN.
  - mvitorino 11y ago
    Ah! Didn't think of that. Thank you.
  - nxzero 11y ago
    Subject Alternative Name (SAN) and photo showing a SAN on a CERT: https://en.m.wikipedia.org/wiki/SubjectAltName https://en.m.wikipedia.org/wiki/SubjectAltName
  - perlgeek 11y ago
    In fact they allow 99 or 100 or so domain names per certificate, which should be enough for most personal/side projects :-)
vox_mollis 11y ago
Reminder to the LE site maintainer folks: http://i.imgur.com/jvp6a8M.png http://i.imgur.com/jvp6a8M.png Open Sans does not render very well on some platform combinations. Edit: I should say your specific version of Open Sans. Your 14272-byte version of OpenSans-Regular.woff renders like this, whereas other sites' 21956-byte version renders fine.
- sleepychu 11y ago
  Any idea why? Seems like Open Sans ought to be quite well supported.
  - me_bx 11y ago
    You can expect at least huge difference in how open sans bold text is rendered between platforms. On some (OSX) it's very very bold, on some other far less (font-weight bold/700). Designing a harmonious and consistent UI under these conditions is difficult.
- geofft 11y ago
  Out of curiosity, what platform combination is that?
  - vox_mollis 11y ago
    Firefox 45.0.1 on Fedora 23 running Gnome 3 on X. Renders fine on Chrome on the same OS; renders fine on FF on a different OS. But I've seen it break on other platform combinations too, though. If you google around stackexchange and the mozilla forums, you'll find others.
    - INTPenis 11y ago
      I'm using that exact combo, Fedora 23, Firefox 45 and Gnome 3. Basically vanilla Fedora 23. I have no issues. Given how common that font is and how well visited that page is I think it's pretty obvious your system is broken.
    - 11y ago
claar 11y ago
I assume "Leaving Beta" means their service as a whole is leaving beta, even though their Github client is still Beta? From https://github.com/letsencrypt/letsencrypt https://github.com/letsencrypt/letsencrypt: "The Let's Encrypt Client is BETA SOFTWARE. It contains plenty of bugs and rough edges, and should be tested thoroughly in staging environments before use on production systems." And NGINX support is still labeled "highly experimental". Not complaining though; these things take time. Thank you for bringing free encryption to the masses, Let's Encrypt!
- ran290 11y ago
  The client will be renamed and moved to the EFF soon: https://letsencrypt.org/2016/03/09/le-client-new-home.html https://letsencrypt.org/2016/03/09/le-client-new-home.html
  - atonse 11y ago
    Any plans to make the official client based on Go? I wasn't too happy about having to download a bunch of Python stuff on my server just to get an SSL cert. Reminded me of the days of yore when you had to fiddle with Perl modules just to run basic scripts.
    - greggman 11y ago
      I don't know about an "official" client but but caddy has support built in so you could probably extract the portions you need from that? https://caddyserver.com/ https://caddyserver.com/
    - pfg 11y ago
      I'm not sure if, conceptually, the term "official client" is still appropriate after the project is moved to the EFF and the rename is done. It's basically a move to ensure a vibrant client ecosystem which encourages users to pick the client that best fits their needs. If you're looking for a Go client, lego[1] is awesome. [1]: https://github.com/xenolf/lego https://github.com/xenolf/lego
azdle 11y ago
Anyone know what, if anything, this means for the rate limits on issuing certs on a given domain? That was the one thing that was stopping us from making SSL completely automatic on our customer's domains.
- mholt 11y ago
  They recently raised the rate limit on certificates per domain per week from 5 to 20. https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769/2?u=mholt https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
  - joshmoz 11y ago
    It's also worth pointing out that you can have up to 100 SANs in a certificate, so you can technically issue for up to 20x100 (2000) subdomains per week.
    - shawabawa3 11y ago
      When I hit a rate limit on sub1.example.com, it let me create a certificate with a SAN for sub1.example.com and sub2.example.com So I think it's actually essentially unlimited, you just can't request the exact same certificate more than 20 times per week
      - nsgi 11y ago
        There are separate rate limits for FQDNs and domain names. The former is 5, the latter is 20.
- stanmancan 11y ago
  Forgive my ignorance, but can anyone please explain this a bit more? I've only configured SSL on small, single server sites, but when I buy a SSL cert once a year. I believe LE certs expire after 6 weeks? Why would you ever even need to issue 5 certs for the same domain in a week?
trufflepiggames 11y ago
This shit is responsible for the whole buzz here. http://www.bridezilla-game.com http://www.bridezilla-game.com
__david__ 11y ago
Does "leaving beta" mean that any API limits have been increased? The 7 certs per domain per week thing is kind of a pain…
- mholt 11y ago
  They recently raised that one to 20. https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769/2?u=mholt https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
- greggman 11y ago
  What does this mean to you? Note this is an honest question. Does it mean you're rebuilding your server from scratch and therefore requesting a new key each time for the same domain? Or does it mean something else? I wonder if anyone has created a simple middle service that can locally cache the certs so you talk to the cache server?
  - kuschku 11y ago
    The issue is when you try to set up the client. Oops, typo in something, let’s try again. Oops, forgot to set permissions. Again. Oops, forgot a domain. Oops, forgot to sudo it this time. Oops, limit run out. I’ve been through that, now I just use https://gethttpsforfree.com/ https://gethttpsforfree.com/, which avoids the issues. And it doesn’t wreck my Apache config every time.
  - __david__ 11y ago
    When I was first testing out my automation I was using real keys instead of the staging server, so every time I tested I was eating up a cert. In the end though, I have more than 7 certs for my main domain--With a bunch of services built up over the years, I have roughly 14 or 15 certs (so it took me 3 weeks to get all my certs created). Subdomains count against your domain limit, so "mail.example.com", "blog.example.com", and "www.example.com" count as 3 certs for "example.com".
    - greggman 11y ago
supremeanger 11y ago
> Gemalto Ah yes, Gemalto: the apex of security
lisper 11y ago
Does this mean that the 5 cert/domain/week limit is being lifted?
- pfg 11y ago
  It's been changed to 20 per domain (and 5 per identical FQDN set, i.e. certificates that are exactly the same) recently.
toomuchtodo 11y ago
What can we as a community do to ensure the long term financial health of Let's Encrypt? EDIT: Any chance Let's Encrypt (or the underlying 501c3) could obtain cybersecurity grants from the US government?
- ruffrey 11y ago
  Donate!
  - jasonkostempski 11y ago
    I don't know how much it helps but if you shop on Amazon, EFF is a sponsor of LE and EFF is an option for Amazon Smile. Tricky part is remembering to use smile.amazon.com instead of www but Amazon has started reminding users to go there and there's also browser plugins to force it to go there.
    - xd1936 11y ago
      https://addons.mozilla.org/en-US/firefox/addon/amazonsmileredirector/ https://addons.mozilla.org/en-US/firefox/addon/amazonsmilere... https://chrome.google.com/webstore/detail/smile-always/jgpmhnmjbhgkhpbgelalfpplebgfjmbf https://chrome.google.com/webstore/detail/smile-always/jgpmh...
    - chime 11y ago
      I wish Amazon would just forward to smile.amazon.com instead.
      - ianlevesque 11y ago
        They want to support charity, but not too much.
yeukhon 11y ago
I would love to use LE but I can't because my use case is all about internal network. I don't want self-signed cert. I want to leverage internal domain system, especially the ones with IPs. While I understand the design of LE would not encourage any of the above, I do hope one day LE has a solution to end the pain of self-signed cert (without modifying host CA file).
- pfg 11y ago
  If your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challenge token and make sure Let's Encrypt can resolve that record. Your actual internal domains don't have to be publicly resolvable or routable for that to work. This is still a WIP in the official client, but there are a number of other clients with dns-01 support[1]. Publicly trusted CAs are not allowed to issue certificates for internal domains (i.e. made-up names which don't end with an ICANN TLD.) [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash https://github.com/letsencrypt/letsencrypt/wiki/Links#bash
- newjersey 11y ago
  How does turret19.local talk to commandserver.local? I imagine there has to be someone on the middle who says yes 192.168.1.24 is actually the command server and not camera3.local or public webserver.local How is it supposed to work? How can LE know that you are 192.168.1.24? Maybe we'd need some kind of certificates that are only valid within a certain zone? How would that work? Thanks.
- e12e 11y ago
  You could use their code/system, if you set up something like: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder internally?
ruffrey 11y ago
The node/express middleware works flawlessly for me. I am really stoked that Let's Encrypt is happening. Writing multi-microservice apps in Node just got a lot easier to deploy for my side projects and small consulting clients - as well as cheaper. Of course it's safer, you never have to think twice about doing TLS. That said, I'd still opt for a wildcard certificate for anything enterprisey. Thank you to all the people who worked for years to make it happen.
- dineshp2 11y ago
  > That said, I'd still opt for a wildcard certificate for anything enterprisey. Let's encrypt can be used to generate a certificate for every subdomain, though it's a little more work compared to just using a wild card certificate.
  - Jaruzel 11y ago
    If you are running Windows Server as your Webserver (many Enterprise places do), and the version of IIS is <7.5 (i.e. Server 2008, still under extended support until 2020), you can't assign more than one Cert to the same IP which sucks. SNI is only available from Windows Server 2012 onwards, and that doesn't work with Windows XP as the client (Still approx 10% of users globally).
    - wtetzner 11y ago
      Right, but at least you can up to 100 subdomains as SANs on the same certificate.
      - Jaruzel 11y ago
        Agreed, and before LetsEncrypt that was insanely expensive for absolutely no reason whatsoever. I sincerely hope that paying through the nose for Certs becomes something only Enterprise Orgs do, just for the backend support service.
- pfg 11y ago
gabamnml 11y ago
Wow! Awesome news. Good job guys. We all have the right to be a little safer. It is running out the vile business of certificates.
CephalopodMD 11y ago
Does this mean anything for developers? Like, do I have to change anything to keep using LE?
- joshmoz 11y ago
  You don't have to change anything.
blakeyrat 11y ago
Leaving beta? They don't even have a Windows/IIS client yet. They're nowhere close to "release quality".
- wtetzner 11y ago
  Sure they are. They're a CA, the clients are just for users' convenience. Anyone who wants to can write their own client against the LE rest API.
  - blakeyrat 11y ago
    I disagree. When you go to the webpage linked above and hit "getting started", there's not even a hint that their system works in OSes other than Linux. Possible there is support for Windows and IIS, but their own website strongly suggests otherwise. EDIT: if they consider their client and their CA as two different products, well, right now the website conflates the two badly. And there's absolutely nothing there to suggest it supports Windows/IIS.
    - wtetzner 11y ago
      > here's not even a hint that their system works in OSes other than Linux. > And there's absolutely nothing there to suggest it supports Windows/IIS. Their "system" is an API for issuing certificates. There's nothing platform specific about that. > right now the website conflates the two badly. From https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/: You’re welcome to use any compatible client, but we only provide instructions for using the client that we provide. Edit: This is the protocol they use: https://github.com/letsencrypt/acme-spec https://github.com/letsencrypt/acme-spec I found the link here: https://letsencrypt.org/how-it-works/ https://letsencrypt.org/how-it-works/
      - blakeyrat 11y ago
        So what part of this is going out of beta? The protocol, the CA, or the client? Now I'm just confused. But I still say: if their mission is to make it as easy as possible to install a SSL cert on any website, as long as they don't have any (apparent) support for Windows/IIS, they're a long, long, long way away from fulfilling that mission and probably shouldn't be leaving beta.
farrokhi 11y ago
I wish their client had first class support for other operating systems like FreeBSD. Current client is too debian/ubuntu specific.
- _wmd 11y ago
  Which part of https://www.eriklundblad.com/log/post/lets-encrypt-on-freebsd/ https://www.eriklundblad.com/log/post/lets-encrypt-on-freebs... is hard?
  - jrapdx3 11y ago
    Actually, setting up LE on FBSD was even easier than that. We've had LE working on two of our FBSD servers for 4 months. Running the py27-letsencrypt client with --certonly and -d domainname -d ..., installed the certs in /usr/local/etc/letsencrypt/live/<domain>/... Then pointing nginx to the "live" cert location and setting a cron job to renew every 4 weeks or so pretty much takes care of the whole process. I notice the FBSD LE client was just upgraded, not sure what new features it offers, but certainly should work at least as well as before.
  - farrokhi 11y ago
    Yes, but that is not the official client.
lazyjones 11y ago
What's the plan if LE ever goes down / commercial / rogue? Millions of sites will have to get new certs manually within 90 days or less or they will all break. Wouldn't it be healthier if LE had some "competition" with compatible protocols as backup?
- nachtigall 11y ago
  That's why they renamed the client: https://letsencrypt.org/2016/03/09/le-client-new-home.html https://letsencrypt.org/2016/03/09/le-client-new-home.html So, they want competition. Creating the competition is up to others ;-) (and should be relatively easy compared to what LE has already done)
- pfg 11y ago
  Let's Encrypt is actually an implementation of the ACME (Automated Certificate Management Environment) specification, developed by the IETF[1]. The goal is to get other CAs to adopt the standard as well. In the meantime, other CAs are starting to offer free DV certs (Symantec being the most recent example), although there's no word yet on ACME compatibility.
aresant 11y ago
Randomly who designed the website @ https://letsencrypt.org/ https://letsencrypt.org/ ? I love the landing page, it's clean, well organized and simple.
nachtigall 11y ago
Mozilla on this: https://blog.mozilla.org/blog/2016/04/12/mozilla-supported-lets-encrypt-goes-out-of-beta/ https://blog.mozilla.org/blog/2016/04/12/mozilla-supported-l...
yexponential 11y ago
This is awesome news. Should we be worried that LE is sponsored by the big players (cisco et al.) Not implying that we should. Just genuinely wondering if we should be wary or if it means anything at all, for the future of LE I mean. ps:might be my misunderstanding as im not sure what sponsored actually entails.
- jedisct1 11y ago
  Having Cisco onboard is scary, but it doesn't imply that backdoors have been added to LE. Sponsors only give money to support LE development and infrastructure.
  - joering2 11y ago
    hmm sponsors not "only give money"... they usually expect something in return - which is understandable. To me this is a deal-breaker. Cisco did so many bad things in the past in terms of privacy that the only good news is that now I know to stay away from LetsEncrypt.
    - pfg 11y ago
      Could you elaborate on how Cisco being a sponsor affects your trust in Let's Encrypt? It's in the nature of the CA system that it's only as strong as its weakest link, and there are dozens if not hundreds of CAs of questionable trust. This seems like a conceptual misunderstanding of how TLS works. Let's Encrypt does not have access to your private key and does not have the ability to decrypt your traffic. They put a stamp on your certificate saying "Yep, this key belongs to this domain" - that's it.
      - count 11y ago
        Hypothetically, the risk could be that LE is now a trusted CA, Cisco could pressure to get a signed, trusted cert for anything. I don't think that's realistic, but if we're talking conspiracy theories...
rythie 11y ago
Full list of sponsors here: https://letsencrypt.org/sponsors/ https://letsencrypt.org/sponsors/ Good to see most of them using HTTPS for their homepage. Though Cisco and Gemalto don't yet.
- bla2 11y ago
  No Apple or Microsoft. Are they opposed to this initiative? Do they think it's not important?
  - joshmoz 11y ago
    We would love to have Apple and Microsoft on board. If anyone works for them and wants to help get them to sponsor we'd appreciate it! Email sponsor@letsencrypt.org to coordinate.
  - odbol_ 11y ago
    Apple don't give money to no one. Possibly the least altruistic company ever, which is disgraceful considering they're also the wealthiest.
    - johncolanduoni 11y ago
      Steve Jobs was pretty publicly opposed to donating to charity, but he's been gone for a while. If you Google "Apple Donations" you'll find a whole slew of articles detailing some of the contributions they have made since Tim Cook took the reins. For example, they match employee donations both in money and time.
      - halviti 11y ago
        Tim Cook exposes the lie that Steve Jobs ignored philanthropy http://appleinsider.com/articles/12/02/02/tim_cook_exposes_the_lie_that_steve_jobs_ignored_philanthropy_ http://appleinsider.com/articles/12/02/02/tim_cook_exposes_t...
  - rythie 11y ago
ing33k 11y ago
just installed a certificate yesterday and felt happy as I didn't had to wait for hours to get a certificated via email.
kyledrake 11y ago
Please add wildcard support.
- Osiris 11y ago
  They don't support wildcard, but they do support alternate names, so you can have multiple domains on the same cert. I know it's not the same, but if you have a known list of subdomains, you could still use it.
  - kyledrake 11y ago
    I have a list of 75,800 subdomains on one of my sites, several hundred sometimes added in the course of a day. On my IPFS HSHCA subdomain CORS proxy, I have ∞. It's not mechanically sensical to just sit there banging on a centralized server all day to get an updated certificate. Wildcard certs start at $100/yr (for -the- cheapest) and go quickly up from there. Many people are not using SSL for many use cases because of this, and that's bad. Why leave them out in the cold for doing things like enforcing CORS security? It's mind boggling to me that they could leave them out of the final product.
    - aorth 11y ago
      It seems like if you need TLS certificates for 75,000 subdomains then $100/year is the least of your problems...
      - kyledrake 11y ago
        Wasting money is always a problem. I've got a $500+ bill coming up for a multi-year wildcard renewal that I'd really love to spend on pretty much anything else. And I only need to pay it because I can't use *.site.org as a "subdomain" on Let's Encrypt. Ponder the absurdity of that. FWIW, I donated to Let's Encrypt in its early stages (and considered sponsorship), so it's not like I'm trying to just freeload here. I'm feeding a lot of money into broken system and I hate doing it. One last thought: Google is about to start docking sites for not using SSL, which means that a lot of sites are basically going to be forced to buy these expensive certificates in order to play. This is a really artificial and sad barrier to entry for small startups. Security and privacy shouldn't just be the purview of the economically privileged.
djhworld 11y ago
I use LE to secure my rasperry pi at home, accessible via a domain. + client side certs. Really easy to setup, thanks for all your efforts!
- daptaq 11y ago
  Dynamic or Static DNS? I've currently got a Pi running my site, but haven't bothered with setting https up. Probably also because it seems a bit more complicated if you use a non-standard web server (in my case thttpd). But on the other hand, I baerly looked into it at all.
  - djhworld 11y ago
    Dynamic, I use Amazon Route53 to manage the DNS, and have a script that checks my public IP every 15 minutes, if it's != the one it has seen before, it updates Amazon Route53 to the new IP. In terms of setting up HTTPS, I use nginx.
neovive 11y ago
Great News! I've been using Let's Encrypt through Laravel Forge and it's far and away the best experience I've had with SSL. Let's Encrypt is great for all web developers and end users.
madetech 11y ago
This is fantastic news well done Let's Encrypt.
deleted 11y ago
[deleted]
oldgun 11y ago
Hats off to all the people who contributed to LetsEncrypt. Your work has brought web security to the next level.
Sephr 11y ago
If you wish to allow the creation of subdomains by users, or if you dynamically handle unlimited subdomains for any purpose, then Let's Encrypt won't be able to help you just yet. Luckily, wildcard support is at least planned, so these use cases will eventually be supported in the future. I've been using Let's Encrypt for my personal blog and I definitely appreciate the free security that is does offer, even without wildcard certificates.
- jlgaddis 11y ago
  So, they've solved a major problem... but not your problem? Honestly, wildcart certs would make my job a lot easier too, but with automatic renewal I'm more than happy to deal with multiple certs and stop giving the commercial CAs my money.
jlgaddis 11y ago
I really really wish there was a client with decent support for using DNS-based verification, mainly so that I can generate certificates for mail servers (since they don't run a local httpd on the same machine). Even if it was just spitting out a string that I needed to add/edit in my zone files (self-hosted DNS) every ~90 days, I'd be fine with that. I haven't had much luck finding clients w/ support for this. I did find one that supported using Route 53, etc., via the APIs, but that didn't help me any. If anyone is working on something like this, I'd be happy to throw a few dollars their way.
- pfg 11y ago
  Take a look at any of the three bash clients listed here[1]. [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash https://github.com/letsencrypt/letsencrypt/wiki/Links#bash
- veeti 11y ago
  My client should be right up your alley: https://github.com/veeti/manuale https://github.com/veeti/manuale
- aorth 11y ago
  You could use the official client with the --standalone flag — that's actually what nginx users have to do right now, as there's no automagic vhost configuration for nginx with the official client yet. The client spins up an HTTP listener on port 80 or 443 for the domains you've specified and listens for the challenge. Then your certs are live in /etc/letsencrypt.
giancarlostoro 11y ago
I wonder if NameCheap will ever offer this to customers, I guess it would take out from their profits if they did considering they sell SSL tickets, but I never bought a ticket from them, and unless I absolutely have to / am being paid to I wouldn't bother doing so either way. If domain registrars push this it could raise more awareness, that and web hosts elsewhere. I wonder how DigitalOcean can aid in this endeavour as well (LEMP / LAMP images with LE integreated as an option?).
- noahbradley 11y ago
  I was pleased to see Dreamhost (who I use) offering free Let's Encrypt for any domain bought/hosted with them. Quick & easy setup. Would love to see other registrars/hosts do the same.
- jaxondu 11y ago
  I use WebFaction and so far they're totally quite if there is any plan to support Lets Encrypt. Just does not gel with their "Hosting for Developers" tagline. Contemplating moving my sites to VPS at other host.
Scirra_Tom 11y ago
Been using ReliableSite.net for years for our hosting, brilliant company and will always recommend them. What a pleasant surprise to see them as a new sponsor!
qewrffewqwfqew 11y ago
Came here to complain about the HN title which tells me nothing about why I might care to read the OP. Noticed the domain, now glad to know. The title could do with a fixup though - my RSS reader doesn't show the target domain.
cyphar 11y ago
I'm incredibly happy that boulder is under the MPL. Not enough new software is copyleft these days.
thisrod 11y ago
I'm confused. The web has a new server. If I trick the server into thinking that stuff I write gets hosted on example.com, it will generate a certificate asserting that I have a right to post stuff on example.com. It's easy for me to get that certificate revoked, but hard for the legitimate owners of example.com to do so. Comparing this to self-signed certificates, I can think of a bunch of drawbacks, but I can't see any advantage. I hope I'm missing something.
- an_ko 11y ago
  Part of getting a certificate from Let's Encrypt involves getting a file from them that you then serve from a certain URL on your domain. Someone without enough control over your server to be able to do that won't be able to issue a certificate for it. This is called a "domain-validated" certificate. It's not self-signed: Let's Encrypt is a certificate authority, which signs the certificates it issues.
  - wielebny 11y ago
    It it also possible to perform DNS validation, which is my preferred method as I can automate certificate generation/replacement from Ansible.
  - mastax 11y ago
    I think their point is that any connection that LE makes to example.com in order to verify ownership will be insecure and thus vulnerable to MITM. Not a problem specific to LE, but to any DV cert.
ryandrake 11y ago
Besides the automation features, what's the difference between these guys and, say, StartSSL, who also provide free SSL certificates? If I only have one or two personal domains for toy projects, why would I switch?
- deepsun 11y ago
  Let's Encrypt certificates quality is better: Grade A [1] versus Grade A- for StartSSL [2]. I personally like who's behind it. AFAIK, Let's Encrypt started with EFF sponsorship, later came Google, Mozilla, Facebook, now Cisco, Akamai, HP. Probably there are other differences, would be glad to know. [1] https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.letsencrypt.org https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le... [2] https://www.ssllabs.com/ssltest/analyze.html?d=www.startssl.com https://www.ssllabs.com/ssltest/analyze.html?d=www.startssl....
  - pfg 11y ago
    That grade is actually mostly about your TLS configuration (available cipher suites, etc.), and not about the certificate. Aside from some major no-goes (like SHA-1 certificates), TLS security is about server configuration; certificates are relatively straightforward in that respect. It's true that they embrace a lot of best practices, like short certificate lifetimes, automation, logging all certificates to CT log servers (which StartSSL started doing quite recently as well), etc. The client also helps with securing your TLS configuration, among other things.
- jorangreef 11y ago
  StartSSL is actually only free for non-commercial use.
betadreamer 11y ago
I want to use LE for my side project that I host on GAE. Does anyone have a good tip on this? Also do I have to manually renew it every 3 months?

896 points by dankohn1 11y ago

I would like to thank LE and its sponsor for disrupting https and doing a great job. I love it.

Let's Encrypt might be one of the most important initiatives for a secure web. I applaud all their great work. The fact that they have chosen to reduce certificate lifetime in order to encourage automation is a really big win for the security of the web as a whole.

jaytaylor 11y ago
The only hiccup I've run into is that if you run too many tests during automation setup then they start denying further requests from you for weeks or longer under "too many certificates issued for that domain".
- K0nserv 11y ago
  Luckily they are raising the rate limit now when they are out of beta.
  - _wmd 11y ago
    Got a reference for this? I literally just bumped into the rate limit today
    - K0nserv 11y ago
      https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Also linked lower down in the thread
- n0us 11y ago
  Maybe they should have single day "test certs" for which you can issue an unlimited number on a given day for a given domain. Not even completely sure this would work but it might be convenient to have even with the limit increase.
  - pfg 11y ago
    Given that the resource being limited here is signing operations performed by their HSM, this wouldn't really help much. (OCSP responses wouldn't have to be signed for quite as long, but still.) There's a staging server issuing untrusted certificates with significantly higher rate limits for this purpose. With the reference client, it's a matter of using the --staging flag.
  - duaneb 11y ago
    I'd prefer they open sourced and allowed you to run the service (self-signed) locally.
    - pfg 11y ago
      They do! boulder[1], the server software behind Let's Encrypt, is open source. [1]: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
      - duaneb 11y ago
        I stand corrected! Seems like the best way to do your testing, then—nobody else needs to know how many times you sign your own certs.
- viperscape 11y ago
  They're is a non CA cert they provide during testing, which should not affect rate limits. I don't have link handy but was just looking at this today.
- pagwon 11y ago
  From https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ If you are trying out the client for the first time, you may want to use the --test-cert flag, and a domain name that does not receive live traffic. This will get certificates from our staging server. They won’t be valid in browsers, but otherwise the process will be the same, so you can test a variety of configuration options without hitting the rate limit.
  - crznp 11y ago
    It sounds like you are thinking of this being a tool for testing deployment configuration, but I could also see using it for internal test environments. The qc person adds the test CA to their browser, if they see "untrusted connection" then something is wrong. Would that model be supported?
    - vertex-four 11y ago
      For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer. [0] https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
  - Semaphor 11y ago
    Trying Let'sEncrypt out the first time I stumbled over this. --test-cert worked flawlessly after I figured out the kinks, as soon as I removed the flag it stopped working :/
- fpoling 11y ago
  For testing just use a local install of boulder server, https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder . It is very straightforward to run one especially when using their Docker scripts. That is how I check my setup against letsencrypt during development/testing on my laptop.
halviti 11y ago
The only problem with reducing the lifetime at the moment is that all of the solutions to use this for windows are ... lacking. Without using the various hacks people have created, you can generate the certificates on linux and then move them over to windows, but doing this all the time is extremely inconvenient. I hope that this gets addressed at some point, because encryption is important for everyone, not just linux admins.

mvitorino 11y ago

Can someone clarify something for me please: "1.7 million certificates for more than 3.8 million websites" How is this possible if they (AFAIK) don't issue wildcard?

mikecb 11y ago
They do do SAN.
- mvitorino 11y ago
  Ah! Didn't think of that. Thank you.
- nxzero 11y ago
  Subject Alternative Name (SAN) and photo showing a SAN on a CERT: https://en.m.wikipedia.org/wiki/SubjectAltName https://en.m.wikipedia.org/wiki/SubjectAltName
- perlgeek 11y ago
  In fact they allow 99 or 100 or so domain names per certificate, which should be enough for most personal/side projects :-)

vox_mollis 11y ago

Reminder to the LE site maintainer folks: http://i.imgur.com/jvp6a8M.png http://i.imgur.com/jvp6a8M.png Open Sans does not render very well on some platform combinations. Edit: I should say your specific version of Open Sans. Your 14272-byte version of OpenSans-Regular.woff renders like this, whereas other sites' 21956-byte version renders fine.

sleepychu 11y ago
Any idea why? Seems like Open Sans ought to be quite well supported.
- me_bx 11y ago
  You can expect at least huge difference in how open sans bold text is rendered between platforms. On some (OSX) it's very very bold, on some other far less (font-weight bold/700). Designing a harmonious and consistent UI under these conditions is difficult.
geofft 11y ago
Out of curiosity, what platform combination is that?
- vox_mollis 11y ago
  Firefox 45.0.1 on Fedora 23 running Gnome 3 on X. Renders fine on Chrome on the same OS; renders fine on FF on a different OS. But I've seen it break on other platform combinations too, though. If you google around stackexchange and the mozilla forums, you'll find others.
  - INTPenis 11y ago
    I'm using that exact combo, Fedora 23, Firefox 45 and Gnome 3. Basically vanilla Fedora 23. I have no issues. Given how common that font is and how well visited that page is I think it's pretty obvious your system is broken.
  - 11y ago

claar 11y ago

I assume "Leaving Beta" means their service as a whole is leaving beta, even though their Github client is still Beta? From https://github.com/letsencrypt/letsencrypt https://github.com/letsencrypt/letsencrypt: "The Let's Encrypt Client is BETA SOFTWARE. It contains plenty of bugs and rough edges, and should be tested thoroughly in staging environments before use on production systems." And NGINX support is still labeled "highly experimental". Not complaining though; these things take time. Thank you for bringing free encryption to the masses, Let's Encrypt!

ran290 11y ago
The client will be renamed and moved to the EFF soon: https://letsencrypt.org/2016/03/09/le-client-new-home.html https://letsencrypt.org/2016/03/09/le-client-new-home.html
- atonse 11y ago
  Any plans to make the official client based on Go? I wasn't too happy about having to download a bunch of Python stuff on my server just to get an SSL cert. Reminded me of the days of yore when you had to fiddle with Perl modules just to run basic scripts.
  - greggman 11y ago
    I don't know about an "official" client but but caddy has support built in so you could probably extract the portions you need from that? https://caddyserver.com/ https://caddyserver.com/
  - pfg 11y ago
    I'm not sure if, conceptually, the term "official client" is still appropriate after the project is moved to the EFF and the rename is done. It's basically a move to ensure a vibrant client ecosystem which encourages users to pick the client that best fits their needs. If you're looking for a Go client, lego[1] is awesome. [1]: https://github.com/xenolf/lego https://github.com/xenolf/lego

azdle 11y ago

Anyone know what, if anything, this means for the rate limits on issuing certs on a given domain? That was the one thing that was stopping us from making SSL completely automatic on our customer's domains.

mholt 11y ago
They recently raised the rate limit on certificates per domain per week from 5 to 20. https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769/2?u=mholt https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
- joshmoz 11y ago
  It's also worth pointing out that you can have up to 100 SANs in a certificate, so you can technically issue for up to 20x100 (2000) subdomains per week.
  - shawabawa3 11y ago
    When I hit a rate limit on sub1.example.com, it let me create a certificate with a SAN for sub1.example.com and sub2.example.com So I think it's actually essentially unlimited, you just can't request the exact same certificate more than 20 times per week
    - nsgi 11y ago
      There are separate rate limits for FQDNs and domain names. The former is 5, the latter is 20.
stanmancan 11y ago
Forgive my ignorance, but can anyone please explain this a bit more? I've only configured SSL on small, single server sites, but when I buy a SSL cert once a year. I believe LE certs expire after 6 weeks? Why would you ever even need to issue 5 certs for the same domain in a week?

trufflepiggames 11y ago

This shit is responsible for the whole buzz here. http://www.bridezilla-game.com http://www.bridezilla-game.com

__david__ 11y ago

Does "leaving beta" mean that any API limits have been increased? The 7 certs per domain per week thing is kind of a pain…

mholt 11y ago
They recently raised that one to 20. https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769/2?u=mholt https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
greggman 11y ago
What does this mean to you? Note this is an honest question. Does it mean you're rebuilding your server from scratch and therefore requesting a new key each time for the same domain? Or does it mean something else? I wonder if anyone has created a simple middle service that can locally cache the certs so you talk to the cache server?
- kuschku 11y ago
  The issue is when you try to set up the client. Oops, typo in something, let’s try again. Oops, forgot to set permissions. Again. Oops, forgot a domain. Oops, forgot to sudo it this time. Oops, limit run out. I’ve been through that, now I just use https://gethttpsforfree.com/ https://gethttpsforfree.com/, which avoids the issues. And it doesn’t wreck my Apache config every time.
- __david__ 11y ago
  When I was first testing out my automation I was using real keys instead of the staging server, so every time I tested I was eating up a cert. In the end though, I have more than 7 certs for my main domain--With a bunch of services built up over the years, I have roughly 14 or 15 certs (so it took me 3 weeks to get all my certs created). Subdomains count against your domain limit, so "mail.example.com", "blog.example.com", and "www.example.com" count as 3 certs for "example.com".
  - greggman 11y ago

supremeanger 11y ago

> Gemalto Ah yes, Gemalto: the apex of security

lisper 11y ago

Does this mean that the 5 cert/domain/week limit is being lifted?

pfg 11y ago
It's been changed to 20 per domain (and 5 per identical FQDN set, i.e. certificates that are exactly the same) recently.

toomuchtodo 11y ago

What can we as a community do to ensure the long term financial health of Let's Encrypt? EDIT: Any chance Let's Encrypt (or the underlying 501c3) could obtain cybersecurity grants from the US government?

ruffrey 11y ago
Donate!
- jasonkostempski 11y ago
  I don't know how much it helps but if you shop on Amazon, EFF is a sponsor of LE and EFF is an option for Amazon Smile. Tricky part is remembering to use smile.amazon.com instead of www but Amazon has started reminding users to go there and there's also browser plugins to force it to go there.
  - xd1936 11y ago
    https://addons.mozilla.org/en-US/firefox/addon/amazonsmileredirector/ https://addons.mozilla.org/en-US/firefox/addon/amazonsmilere... https://chrome.google.com/webstore/detail/smile-always/jgpmhnmjbhgkhpbgelalfpplebgfjmbf https://chrome.google.com/webstore/detail/smile-always/jgpmh...
  - chime 11y ago
    I wish Amazon would just forward to smile.amazon.com instead.
    - ianlevesque 11y ago
      They want to support charity, but not too much.

yeukhon 11y ago

I would love to use LE but I can't because my use case is all about internal network. I don't want self-signed cert. I want to leverage internal domain system, especially the ones with IPs. While I understand the design of LE would not encourage any of the above, I do hope one day LE has a solution to end the pain of self-signed cert (without modifying host CA file).

pfg 11y ago
If your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challenge token and make sure Let's Encrypt can resolve that record. Your actual internal domains don't have to be publicly resolvable or routable for that to work. This is still a WIP in the official client, but there are a number of other clients with dns-01 support[1]. Publicly trusted CAs are not allowed to issue certificates for internal domains (i.e. made-up names which don't end with an ICANN TLD.) [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash https://github.com/letsencrypt/letsencrypt/wiki/Links#bash
newjersey 11y ago
How does turret19.local talk to commandserver.local? I imagine there has to be someone on the middle who says yes 192.168.1.24 is actually the command server and not camera3.local or public webserver.local How is it supposed to work? How can LE know that you are 192.168.1.24? Maybe we'd need some kind of certificates that are only valid within a certain zone? How would that work? Thanks.
e12e 11y ago
You could use their code/system, if you set up something like: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder internally?

ruffrey 11y ago

The node/express middleware works flawlessly for me. I am really stoked that Let's Encrypt is happening. Writing multi-microservice apps in Node just got a lot easier to deploy for my side projects and small consulting clients - as well as cheaper. Of course it's safer, you never have to think twice about doing TLS. That said, I'd still opt for a wildcard certificate for anything enterprisey. Thank you to all the people who worked for years to make it happen.

dineshp2 11y ago
> That said, I'd still opt for a wildcard certificate for anything enterprisey. Let's encrypt can be used to generate a certificate for every subdomain, though it's a little more work compared to just using a wild card certificate.
- Jaruzel 11y ago
  If you are running Windows Server as your Webserver (many Enterprise places do), and the version of IIS is <7.5 (i.e. Server 2008, still under extended support until 2020), you can't assign more than one Cert to the same IP which sucks. SNI is only available from Windows Server 2012 onwards, and that doesn't work with Windows XP as the client (Still approx 10% of users globally).
  - wtetzner 11y ago
    Right, but at least you can up to 100 subdomains as SANs on the same certificate.
    - Jaruzel 11y ago
      Agreed, and before LetsEncrypt that was insanely expensive for absolutely no reason whatsoever. I sincerely hope that paying through the nose for Certs becomes something only Enterprise Orgs do, just for the backend support service.
pfg 11y ago

gabamnml 11y ago

Wow! Awesome news. Good job guys. We all have the right to be a little safer. It is running out the vile business of certificates.

CephalopodMD 11y ago

Does this mean anything for developers? Like, do I have to change anything to keep using LE?

joshmoz 11y ago
You don't have to change anything.

blakeyrat 11y ago

Leaving beta? They don't even have a Windows/IIS client yet. They're nowhere close to "release quality".

wtetzner 11y ago
Sure they are. They're a CA, the clients are just for users' convenience. Anyone who wants to can write their own client against the LE rest API.
- blakeyrat 11y ago
  I disagree. When you go to the webpage linked above and hit "getting started", there's not even a hint that their system works in OSes other than Linux. Possible there is support for Windows and IIS, but their own website strongly suggests otherwise. EDIT: if they consider their client and their CA as two different products, well, right now the website conflates the two badly. And there's absolutely nothing there to suggest it supports Windows/IIS.
  - wtetzner 11y ago
    > here's not even a hint that their system works in OSes other than Linux. > And there's absolutely nothing there to suggest it supports Windows/IIS. Their "system" is an API for issuing certificates. There's nothing platform specific about that. > right now the website conflates the two badly. From https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/: You’re welcome to use any compatible client, but we only provide instructions for using the client that we provide. Edit: This is the protocol they use: https://github.com/letsencrypt/acme-spec https://github.com/letsencrypt/acme-spec I found the link here: https://letsencrypt.org/how-it-works/ https://letsencrypt.org/how-it-works/
    - blakeyrat 11y ago
      So what part of this is going out of beta? The protocol, the CA, or the client? Now I'm just confused. But I still say: if their mission is to make it as easy as possible to install a SSL cert on any website, as long as they don't have any (apparent) support for Windows/IIS, they're a long, long, long way away from fulfilling that mission and probably shouldn't be leaving beta.

farrokhi 11y ago

I wish their client had first class support for other operating systems like FreeBSD. Current client is too debian/ubuntu specific.

_wmd 11y ago
Which part of https://www.eriklundblad.com/log/post/lets-encrypt-on-freebsd/ https://www.eriklundblad.com/log/post/lets-encrypt-on-freebs... is hard?
- jrapdx3 11y ago
  Actually, setting up LE on FBSD was even easier than that. We've had LE working on two of our FBSD servers for 4 months. Running the py27-letsencrypt client with --certonly and -d domainname -d ..., installed the certs in /usr/local/etc/letsencrypt/live/<domain>/... Then pointing nginx to the "live" cert location and setting a cron job to renew every 4 weeks or so pretty much takes care of the whole process. I notice the FBSD LE client was just upgraded, not sure what new features it offers, but certainly should work at least as well as before.
- farrokhi 11y ago
  Yes, but that is not the official client.

lazyjones 11y ago

What's the plan if LE ever goes down / commercial / rogue? Millions of sites will have to get new certs manually within 90 days or less or they will all break. Wouldn't it be healthier if LE had some "competition" with compatible protocols as backup?

nachtigall 11y ago
That's why they renamed the client: https://letsencrypt.org/2016/03/09/le-client-new-home.html https://letsencrypt.org/2016/03/09/le-client-new-home.html So, they want competition. Creating the competition is up to others ;-) (and should be relatively easy compared to what LE has already done)
pfg 11y ago
Let's Encrypt is actually an implementation of the ACME (Automated Certificate Management Environment) specification, developed by the IETF[1]. The goal is to get other CAs to adopt the standard as well. In the meantime, other CAs are starting to offer free DV certs (Symantec being the most recent example), although there's no word yet on ACME compatibility.

aresant 11y ago

Randomly who designed the website @ https://letsencrypt.org/ https://letsencrypt.org/ ? I love the landing page, it's clean, well organized and simple.

nachtigall 11y ago

Mozilla on this: https://blog.mozilla.org/blog/2016/04/12/mozilla-supported-lets-encrypt-goes-out-of-beta/ https://blog.mozilla.org/blog/2016/04/12/mozilla-supported-l...

yexponential 11y ago

This is awesome news. Should we be worried that LE is sponsored by the big players (cisco et al.) Not implying that we should. Just genuinely wondering if we should be wary or if it means anything at all, for the future of LE I mean. ps:might be my misunderstanding as im not sure what sponsored actually entails.

jedisct1 11y ago
Having Cisco onboard is scary, but it doesn't imply that backdoors have been added to LE. Sponsors only give money to support LE development and infrastructure.
- joering2 11y ago
  hmm sponsors not "only give money"... they usually expect something in return - which is understandable. To me this is a deal-breaker. Cisco did so many bad things in the past in terms of privacy that the only good news is that now I know to stay away from LetsEncrypt.
  - pfg 11y ago
    Could you elaborate on how Cisco being a sponsor affects your trust in Let's Encrypt? It's in the nature of the CA system that it's only as strong as its weakest link, and there are dozens if not hundreds of CAs of questionable trust. This seems like a conceptual misunderstanding of how TLS works. Let's Encrypt does not have access to your private key and does not have the ability to decrypt your traffic. They put a stamp on your certificate saying "Yep, this key belongs to this domain" - that's it.
    - count 11y ago
      Hypothetically, the risk could be that LE is now a trusted CA, Cisco could pressure to get a signed, trusted cert for anything. I don't think that's realistic, but if we're talking conspiracy theories...

rythie 11y ago

Full list of sponsors here: https://letsencrypt.org/sponsors/ https://letsencrypt.org/sponsors/ Good to see most of them using HTTPS for their homepage. Though Cisco and Gemalto don't yet.

bla2 11y ago
No Apple or Microsoft. Are they opposed to this initiative? Do they think it's not important?
- joshmoz 11y ago
  We would love to have Apple and Microsoft on board. If anyone works for them and wants to help get them to sponsor we'd appreciate it! Email sponsor@letsencrypt.org to coordinate.
- odbol_ 11y ago
  Apple don't give money to no one. Possibly the least altruistic company ever, which is disgraceful considering they're also the wealthiest.
  - johncolanduoni 11y ago
    Steve Jobs was pretty publicly opposed to donating to charity, but he's been gone for a while. If you Google "Apple Donations" you'll find a whole slew of articles detailing some of the contributions they have made since Tim Cook took the reins. For example, they match employee donations both in money and time.
    - halviti 11y ago
      Tim Cook exposes the lie that Steve Jobs ignored philanthropy http://appleinsider.com/articles/12/02/02/tim_cook_exposes_the_lie_that_steve_jobs_ignored_philanthropy_ http://appleinsider.com/articles/12/02/02/tim_cook_exposes_t...
- rythie 11y ago

ing33k 11y ago

just installed a certificate yesterday and felt happy as I didn't had to wait for hours to get a certificated via email.

kyledrake 11y ago

Please add wildcard support.

Osiris 11y ago
They don't support wildcard, but they do support alternate names, so you can have multiple domains on the same cert. I know it's not the same, but if you have a known list of subdomains, you could still use it.
- kyledrake 11y ago
  I have a list of 75,800 subdomains on one of my sites, several hundred sometimes added in the course of a day. On my IPFS HSHCA subdomain CORS proxy, I have ∞. It's not mechanically sensical to just sit there banging on a centralized server all day to get an updated certificate. Wildcard certs start at $100/yr (for -the- cheapest) and go quickly up from there. Many people are not using SSL for many use cases because of this, and that's bad. Why leave them out in the cold for doing things like enforcing CORS security? It's mind boggling to me that they could leave them out of the final product.
  - aorth 11y ago
    It seems like if you need TLS certificates for 75,000 subdomains then $100/year is the least of your problems...
    - kyledrake 11y ago
      Wasting money is always a problem. I've got a $500+ bill coming up for a multi-year wildcard renewal that I'd really love to spend on pretty much anything else. And I only need to pay it because I can't use *.site.org as a "subdomain" on Let's Encrypt. Ponder the absurdity of that. FWIW, I donated to Let's Encrypt in its early stages (and considered sponsorship), so it's not like I'm trying to just freeload here. I'm feeding a lot of money into broken system and I hate doing it. One last thought: Google is about to start docking sites for not using SSL, which means that a lot of sites are basically going to be forced to buy these expensive certificates in order to play. This is a really artificial and sad barrier to entry for small startups. Security and privacy shouldn't just be the purview of the economically privileged.

djhworld 11y ago

I use LE to secure my rasperry pi at home, accessible via a domain. + client side certs. Really easy to setup, thanks for all your efforts!

daptaq 11y ago
Dynamic or Static DNS? I've currently got a Pi running my site, but haven't bothered with setting https up. Probably also because it seems a bit more complicated if you use a non-standard web server (in my case thttpd). But on the other hand, I baerly looked into it at all.
- djhworld 11y ago
  Dynamic, I use Amazon Route53 to manage the DNS, and have a script that checks my public IP every 15 minutes, if it's != the one it has seen before, it updates Amazon Route53 to the new IP. In terms of setting up HTTPS, I use nginx.

neovive 11y ago

Great News! I've been using Let's Encrypt through Laravel Forge and it's far and away the best experience I've had with SSL. Let's Encrypt is great for all web developers and end users.

madetech 11y ago

This is fantastic news well done Let's Encrypt.

deleted 11y ago

[deleted]

oldgun 11y ago

Hats off to all the people who contributed to LetsEncrypt. Your work has brought web security to the next level.

Sephr 11y ago

If you wish to allow the creation of subdomains by users, or if you dynamically handle unlimited subdomains for any purpose, then Let's Encrypt won't be able to help you just yet. Luckily, wildcard support is at least planned, so these use cases will eventually be supported in the future. I've been using Let's Encrypt for my personal blog and I definitely appreciate the free security that is does offer, even without wildcard certificates.

jlgaddis 11y ago
So, they've solved a major problem... but not your problem? Honestly, wildcart certs would make my job a lot easier too, but with automatic renewal I'm more than happy to deal with multiple certs and stop giving the commercial CAs my money.

jlgaddis 11y ago

I really really wish there was a client with decent support for using DNS-based verification, mainly so that I can generate certificates for mail servers (since they don't run a local httpd on the same machine). Even if it was just spitting out a string that I needed to add/edit in my zone files (self-hosted DNS) every ~90 days, I'd be fine with that. I haven't had much luck finding clients w/ support for this. I did find one that supported using Route 53, etc., via the APIs, but that didn't help me any. If anyone is working on something like this, I'd be happy to throw a few dollars their way.

pfg 11y ago
Take a look at any of the three bash clients listed here[1]. [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash https://github.com/letsencrypt/letsencrypt/wiki/Links#bash
veeti 11y ago
My client should be right up your alley: https://github.com/veeti/manuale https://github.com/veeti/manuale
aorth 11y ago
You could use the official client with the --standalone flag — that's actually what nginx users have to do right now, as there's no automagic vhost configuration for nginx with the official client yet. The client spins up an HTTP listener on port 80 or 443 for the domains you've specified and listens for the challenge. Then your certs are live in /etc/letsencrypt.

giancarlostoro 11y ago

I wonder if NameCheap will ever offer this to customers, I guess it would take out from their profits if they did considering they sell SSL tickets, but I never bought a ticket from them, and unless I absolutely have to / am being paid to I wouldn't bother doing so either way. If domain registrars push this it could raise more awareness, that and web hosts elsewhere. I wonder how DigitalOcean can aid in this endeavour as well (LEMP / LAMP images with LE integreated as an option?).

noahbradley 11y ago
I was pleased to see Dreamhost (who I use) offering free Let's Encrypt for any domain bought/hosted with them. Quick & easy setup. Would love to see other registrars/hosts do the same.
jaxondu 11y ago
I use WebFaction and so far they're totally quite if there is any plan to support Lets Encrypt. Just does not gel with their "Hosting for Developers" tagline. Contemplating moving my sites to VPS at other host.

Scirra_Tom 11y ago

Been using ReliableSite.net for years for our hosting, brilliant company and will always recommend them. What a pleasant surprise to see them as a new sponsor!

qewrffewqwfqew 11y ago

Came here to complain about the HN title which tells me nothing about why I might care to read the OP. Noticed the domain, now glad to know. The title could do with a fixup though - my RSS reader doesn't show the target domain.

cyphar 11y ago

I'm incredibly happy that boulder is under the MPL. Not enough new software is copyleft these days.

thisrod 11y ago

I'm confused. The web has a new server. If I trick the server into thinking that stuff I write gets hosted on example.com, it will generate a certificate asserting that I have a right to post stuff on example.com. It's easy for me to get that certificate revoked, but hard for the legitimate owners of example.com to do so. Comparing this to self-signed certificates, I can think of a bunch of drawbacks, but I can't see any advantage. I hope I'm missing something.

an_ko 11y ago
Part of getting a certificate from Let's Encrypt involves getting a file from them that you then serve from a certain URL on your domain. Someone without enough control over your server to be able to do that won't be able to issue a certificate for it. This is called a "domain-validated" certificate. It's not self-signed: Let's Encrypt is a certificate authority, which signs the certificates it issues.
- wielebny 11y ago
  It it also possible to perform DNS validation, which is my preferred method as I can automate certificate generation/replacement from Ansible.
- mastax 11y ago
  I think their point is that any connection that LE makes to example.com in order to verify ownership will be insecure and thus vulnerable to MITM. Not a problem specific to LE, but to any DV cert.

ryandrake 11y ago

Besides the automation features, what's the difference between these guys and, say, StartSSL, who also provide free SSL certificates? If I only have one or two personal domains for toy projects, why would I switch?

deepsun 11y ago
Let's Encrypt certificates quality is better: Grade A [1] versus Grade A- for StartSSL [2]. I personally like who's behind it. AFAIK, Let's Encrypt started with EFF sponsorship, later came Google, Mozilla, Facebook, now Cisco, Akamai, HP. Probably there are other differences, would be glad to know. [1] https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.letsencrypt.org https://www.ssllabs.com/ssltest/analyze.html?d=helloworld.le... [2] https://www.ssllabs.com/ssltest/analyze.html?d=www.startssl.com https://www.ssllabs.com/ssltest/analyze.html?d=www.startssl....
- pfg 11y ago
  That grade is actually mostly about your TLS configuration (available cipher suites, etc.), and not about the certificate. Aside from some major no-goes (like SHA-1 certificates), TLS security is about server configuration; certificates are relatively straightforward in that respect. It's true that they embrace a lot of best practices, like short certificate lifetimes, automation, logging all certificates to CT log servers (which StartSSL started doing quite recently as well), etc. The client also helps with securing your TLS configuration, among other things.
jorangreef 11y ago
StartSSL is actually only free for non-commercial use.

betadreamer 11y ago

I want to use LE for my side project that I host on GAE. Does anyone have a good tip on this? Also do I have to manually renew it every 3 months?