5 ms·
+1 for https://letsencrypt.org https://letsencrypt.org
by johnwheeler 10y ago
+1 for https://letsencrypt.org https://letsencrypt.org
- hosh 10y agoI remember reading through the forum post for that letsencrypt bruhahaha when Comodo filed for trademark infringement on Letsencrypt. The CEO seemed really self absorbed and saw himself as an innovator with letsencrypt stealing business processes from him (which makes filing for trademark infringement make less sense). He took it as a personal insult, and did not even appear to understand that letsencrypt was a public service rather than a for-profit product. There was a fan who claimed to be a paralegal cheering on the CEO's rant yet appeared to confuse trademarks with patents with copyrights. At least with the forums alone, that thread read like teenage high school soap opera, not a business. It was like an echo chamber of the CEO's fixation. And now this. Sounds like there was a deliberate business decision to use faulty tech, and forgetting the wider social impact of operating a CA.
- maket 10y agoHere's the forum post in question https://forums.comodo.com/general-discussion-off-topic-anything-and-everything/shame-on-you-comodo-t115958.0.html;msg837411#msg837411 https://forums.comodo.com/general-discussion-off-topic-anyth... Here's the HN discussion https://news.ycombinator.com/item?id=11964583 https://news.ycombinator.com/item?id=11964583
- victor9000 10y agoI recently replaced an expired cert with one from LE and the entire process was super simple. Their cli automatically handles all the tedious steps like creating the signed request, proving server ownership, and creating the certificate bundle. What's more, it also provides tools for renewing certs in an automated way. I really can't see myself using anything else from here on out.
- amelius 10y agoLast time I checked the LE cli tool required root access to my machine. Totally annoying and unnecessary. Otherwise, I applaud the initiative.
- mitchty 10y agoThere are alternative clients one can use like acme_tiny.
- colemickens 10y agoHow does this meme keep getting repeated over and over and over when it was wrong the day LE launched? It doesn't even make sense if you just think about it. Why would you need root access to make some HTTP calls? Most ACME clients don't require root. The one-click-and-reconfigure-my-webserver obviously requires root.
- eksu 10y agoCertbot defaults to a path on your system that requires root, and sets permissions so non-root users can't look at your private keys. If you would like to use it without root/sudo, you can pass flags changing the directory it uses. For example: certbot --logs-dir ~/SSL --work-dir ~/SSL --config-dir ~/SSL
- anfedorov 10y agoTo clarify, Let's Encrypt validates identity by trusting DNS resolution of a domain and then trusting a TCP/IP connection to the IP, correct? It's good to encrypt things, but I wouldn't be too surprised if it were possible for folks to issue bad certs via them, as well.
- tokenizerrr 10y agoYes, this is called domain validation and most CAs operate like this for regular non-EV certificates. Sometimes it's an email, sometimes it's a file with certain content at a certain URL, sometimes it's a DNS record. But beyond that, no further validation is required for regular certificates.
- AndyMcConachie 10y agoI don't know why you were down voted. Yes, Let's Encrypt does verification by requiring a site to host a string on port 80. They discover the site via DNS, and they do NOT require DNSSEC. Thus you can absolutely trick Let's Encrypt into issuing a bad cert if you can serve them bad DNS responses. This OCR issue with Comodo in TFA concerns WHOIS data, which may or may not be more reliable than unsigned DNS data. Regardless your point remains valid.
- tokenizerrr 10y agoYou can also trick practically every other CA using the same techniques.
- AndyMcConachie 10y agoYes. And remember you only have to trick one of them for them all to be useless :)
- deleted 10y ago[deleted]
- dcosson 10y agoThis really comes down to the weakest link though. You can use letsencrypt if you want, but someone else can still spoof your domain with a fake Comodo cert and any of your users' browsers will happily trust it. Public key pinning seems like it would prevent this attack though.
- hughes 10y agoJust saying, the following domain is available: 1etsencrypt.org