6 ms·
It's about time that HN switches to Let's Encrypt.
by 0xmohit 10y ago
It's about time that HN switches to Let's Encrypt.
- chc 10y agoWhy? Is there something wrong with HN's current cert?
- 0xmohit 10y agoSuffices to say that it has been issued by Comodo.
- Nullabillity 10y ago1. Funds Comodo's shady behaviour, and arguably increases their brand recognition 2. Ridiculous expiry time
- 0xmohit 10y ago> Ridiculous expiry time Looks like a cert is similar to a President. Should be around for 5 years.
- stephenr 10y agoYou know that Comodo won't issue a refund if they decide not to use them any more right? They've paid the money. I can understand moving things to show support for better alternatives but let's not kid ourselves - moving now or moving when the cert expires, doesn't hurt Comodo any differently.
- bhhaskin 10y agoLet's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal.
- koolba 10y ago> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)
- nailer 10y agoHeads up: I work for a company that speeds up the background checks used for EV. Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS. And yes, we (CertSimple) are looking at Certbot support for EV.
- scrollaway 10y agoFYI: Your server's vulnerable to CVE-2016-2107 and is getting an F from ssllabs. https://www.ssllabs.com/ssltest/analyze.html?d=certsimple.com https://www.ssllabs.com/ssltest/analyze.html?d=certsimple.co...
- 0x0 10y agoLol
- nailer 10y agoNow back to our previous A+. Thanks for the heads up. I had been logging in to update but the rate of new, severe openssl vulnerabilities - and the risk of missing one, fairly obviously - is high enough I'd rather just apply them immediately. yum-cron's also now enabled to apply openssl updates as soon as they're issued.
- koolba 10y ago> Heads up: I work for a company that speeds up the background checks used for EV. How much faster? The one time I've gotten an EV cert it took a couple hours to get verified. Didn't seem too long at all and compared to the time to plan the swap out of the cert in production, the wait was a non issue. The verification itself was a joke though. It was basically just a phone call asking "Are you X? Ok great! Here's your cert!" > Tying real world identities to public keys is very much a part of crypto. Joe User isn't going to look at the details and validation chain of a certificate. The whole idea of the green bar for "more trusted" is a scamola by the cert providers as they saw the writing on the wall for their margins going to zero for domain validated ones (granted they saw it early enough to get traction on it!).
- seiferteric 10y agoIt appears that HN's cert is a wildcard, so they can't switch yet anyway.
- Nullabillity 10y agoDoes it need to stay that way? I'd assume there are only a couple of subdomains (www, news, maybe a handful more?), so replacing them with SANs or separate certificates shouldn't be too much work.
- dingaling 10y agoThe processes for handling LE cert renewals is quite different than for traditional certs with manual trusted-operator procedures. It's a lot more work to switch an existing cert environment to LE than to start from zero.