4 ms·

Let's Encrypt might be one of the most important initiatives for a secure web. I applaud all their great work. The fact that they have chosen to reduce certifi

by K0nserv 11y ago

Let's Encrypt might be one of the most important initiatives for a secure web. I applaud all their great work. The fact that they have chosen to reduce certificate lifetime in order to encourage automation is a really big win for the security of the web as a whole.

jaytaylor 11y ago
The only hiccup I've run into is that if you run too many tests during automation setup then they start denying further requests from you for weeks or longer under "too many certificates issued for that domain".
- K0nserv 11y ago
  Luckily they are raising the rate limit now when they are out of beta.
  - _wmd 11y ago
    Got a reference for this? I literally just bumped into the rate limit today
    - K0nserv 11y ago
      https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Also linked lower down in the thread
- n0us 11y ago
  Maybe they should have single day "test certs" for which you can issue an unlimited number on a given day for a given domain. Not even completely sure this would work but it might be convenient to have even with the limit increase.
  - pfg 11y ago
    Given that the resource being limited here is signing operations performed by their HSM, this wouldn't really help much. (OCSP responses wouldn't have to be signed for quite as long, but still.) There's a staging server issuing untrusted certificates with significantly higher rate limits for this purpose. With the reference client, it's a matter of using the --staging flag.
  - duaneb 11y ago
    I'd prefer they open sourced and allowed you to run the service (self-signed) locally.
    - pfg 11y ago
      They do! boulder[1], the server software behind Let's Encrypt, is open source. [1]: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
      - duaneb 11y ago
        I stand corrected! Seems like the best way to do your testing, then—nobody else needs to know how many times you sign your own certs.
- viperscape 11y ago
  They're is a non CA cert they provide during testing, which should not affect rate limits. I don't have link handy but was just looking at this today.
- pagwon 11y ago
  From https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ If you are trying out the client for the first time, you may want to use the --test-cert flag, and a domain name that does not receive live traffic. This will get certificates from our staging server. They won’t be valid in browsers, but otherwise the process will be the same, so you can test a variety of configuration options without hitting the rate limit.
  - crznp 11y ago
    It sounds like you are thinking of this being a tool for testing deployment configuration, but I could also see using it for internal test environments. The qc person adds the test CA to their browser, if they see "untrusted connection" then something is wrong. Would that model be supported?
    - vertex-four 11y ago
      For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer. [0] https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
  - Semaphor 11y ago
    Trying Let'sEncrypt out the first time I stumbled over this. --test-cert worked flawlessly after I figured out the kinks, as soon as I removed the flag it stopped working :/
- fpoling 11y ago
  For testing just use a local install of boulder server, https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder . It is very straightforward to run one especially when using their Docker scripts. That is how I check my setup against letsencrypt during development/testing on my laptop.
halviti 11y ago
The only problem with reducing the lifetime at the moment is that all of the solutions to use this for windows are ... lacking. Without using the various hacks people have created, you can generate the certificates on linux and then move them over to windows, but doing this all the time is extremely inconvenient. I hope that this gets addressed at some point, because encryption is important for everyone, not just linux admins.

by K0nserv 11y ago

jaytaylor 11y ago

The only hiccup I've run into is that if you run too many tests during automation setup then they start denying further requests from you for weeks or longer under "too many certificates issued for that domain".

K0nserv 11y ago
Luckily they are raising the rate limit now when they are out of beta.
- _wmd 11y ago
  Got a reference for this? I literally just bumped into the rate limit today
  - K0nserv 11y ago
    https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Also linked lower down in the thread
n0us 11y ago
Maybe they should have single day "test certs" for which you can issue an unlimited number on a given day for a given domain. Not even completely sure this would work but it might be convenient to have even with the limit increase.
- pfg 11y ago
  Given that the resource being limited here is signing operations performed by their HSM, this wouldn't really help much. (OCSP responses wouldn't have to be signed for quite as long, but still.) There's a staging server issuing untrusted certificates with significantly higher rate limits for this purpose. With the reference client, it's a matter of using the --staging flag.
- duaneb 11y ago
  I'd prefer they open sourced and allowed you to run the service (self-signed) locally.
  - pfg 11y ago
    They do! boulder[1], the server software behind Let's Encrypt, is open source. [1]: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
    - duaneb 11y ago
      I stand corrected! Seems like the best way to do your testing, then—nobody else needs to know how many times you sign your own certs.
viperscape 11y ago
They're is a non CA cert they provide during testing, which should not affect rate limits. I don't have link handy but was just looking at this today.
pagwon 11y ago
From https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ If you are trying out the client for the first time, you may want to use the --test-cert flag, and a domain name that does not receive live traffic. This will get certificates from our staging server. They won’t be valid in browsers, but otherwise the process will be the same, so you can test a variety of configuration options without hitting the rate limit.
- crznp 11y ago
  It sounds like you are thinking of this being a tool for testing deployment configuration, but I could also see using it for internal test environments. The qc person adds the test CA to their browser, if they see "untrusted connection" then something is wrong. Would that model be supported?
  - vertex-four 11y ago
    For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer. [0] https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
- Semaphor 11y ago
  Trying Let'sEncrypt out the first time I stumbled over this. --test-cert worked flawlessly after I figured out the kinks, as soon as I removed the flag it stopped working :/
fpoling 11y ago
For testing just use a local install of boulder server, https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder . It is very straightforward to run one especially when using their Docker scripts. That is how I check my setup against letsencrypt during development/testing on my laptop.

halviti 11y ago

The only problem with reducing the lifetime at the moment is that all of the solutions to use this for windows are ... lacking. Without using the various hacks people have created, you can generate the certificates on linux and then move them over to windows, but doing this all the time is extremely inconvenient. I hope that this gets addressed at some point, because encryption is important for everyone, not just linux admins.