14 ms·

> Symantec will vigorously defend the safe and productive use of the Internet, including minimizing any potential disruption caused by the proposal in Google’s

> Symantec will vigorously defend the safe and productive use of the Internet, including minimizing any potential disruption caused by the proposal in Google’s blog post. What they will vigorously defend is disruption to their reputation and their bottom line. What benefit does a business get from Symantec that they do not get from Let's Encrypt? EV?

eganist 10y ago
Support. And as mockable as that might sound, it comes in handy for businesses with special requirements.
- lomnakkus 10y ago
  Such as the issuance of SHA1 signed certificates long after they've been deprecated? /snark (Sorry, I couldn't resist.) EDIT: Apologies, didn't notice the other poster beat me to it.
- DannyBee 10y ago
  Why do i feel like support is one of the reason they issued so many certs they should not have?
mattzito 10y ago
Well, you can't do wildcard certs, which is fine for most businesses, but for some it's a non-starter. That doesn't make LE bad, of course, it just means it's not the appropriate tool for all use cases.
- leeoniya 10y ago
  but certs dont cost anything. you can easily automate the renewal of as many subdomain certs as needed.
  - brianwawok 10y ago
    If you are a big company and need say 100k wildcard certs (say one per client).. I am pretty sure I can justify spending $50 for a wildcard cert vs a fleet of servers and engineers and monitors to enforce let's encrypt work. Let's encrypt is great but let's not pretend it's the right solution for all websites.
    - leeoniya 10y ago
      LE should charge a small fee for wildcard certs and extended validity periods (up to some reasonable limit). They'd likely cover their operating budget very quickly. What's their stance on wildcard certs with SANs? Is it simply too risky / ripe for abuse?
      - mjevans 10y ago
        Absolutely no knowledge here, but my /guess/ has been that they don't do more because it would either require more effort or would have soured the cross-signing deal so that they'd be validated by a CA that's already in older operating systems/devices.
      - yjftsjthsd-h 10y ago
        I suspect they will never allow longer validity certs because they want renewal to be automated.
      - sandGorgon 10y ago
        I will a LOT if LE can issue wildcard certificates to me with a 3 year validity. And send me reminder emails when im nearing expiry.
  - tyingq 10y ago
    There is some time, scripting, etc, cost to integrating lots of certs into a single instance of Apache, nginx, etc. Wildcards certs have value in some settings.
  - simcop2387 10y ago
will_hughes 10y ago
A wider set of devices that accept it. If you have a service that serves to a fleet of STBs, TVs, or other embedded devices, they have a fixed set of RootCAs and getting the OEM to update those (and possibly through a ton of different resellers) is a nightmare. While the embedded devices won't be impacted by this announcement (if the deprecation goes ahead), there might be some additional work for anyone that services web browsers AND embedded devices from the same endpoints.
- toast0 10y ago
  This is a pretty big deal; Symantec controls many root CAs that are pretty old and widely distributed. If you're supporting embedded devices (or phones) with pretty old root stores, you don't have that many choices, and it can be hard to know what they really are, because documentation of root stores is fairly sparse. Of course, there's not a good way for clients to indicate which root CAs they accept, and so they don't. If you get into the situation where newer devices don't support Symantec certs, and older devices don't support non-Symantec certs, it's time to figure out how to guess if you're talking to a newer or an older device and give appropriate certs. :(
bubblethink 10y ago
LE is not scalable. You can't do wildcards, and you don't want to authenticate every subdomain to LE by having it spawn a http server. You don't even want most of your stuff to face the internet to begin with.
- kosinus 10y ago
  I've never hit te rate limit on LE. Seems to me you need to be running a public site that gives each user a subdomain, or similar setup, before you run into such issues. You don't need a HTTP server to do authentication, it's also possible to use DNS and TLS SNI. There's certainly no need to spawn a server per domain, even for HTTP. If your implementation is complex enough to require many certs, these problems are already solvable. Either fork over the money for a wildcard cert, or account for the extra work in your planning. The setup we use is to have our own authoritative nameserver for a 'dyn' subdomain, and do DNS auth. We auth a subdomain with LE in less than 10 seconds.

eganist 10y ago

Support. And as mockable as that might sound, it comes in handy for businesses with special requirements.

lomnakkus 10y ago
Such as the issuance of SHA1 signed certificates long after they've been deprecated? /snark (Sorry, I couldn't resist.) EDIT: Apologies, didn't notice the other poster beat me to it.
DannyBee 10y ago
Why do i feel like support is one of the reason they issued so many certs they should not have?

mattzito 10y ago

Well, you can't do wildcard certs, which is fine for most businesses, but for some it's a non-starter. That doesn't make LE bad, of course, it just means it's not the appropriate tool for all use cases.

leeoniya 10y ago
but certs dont cost anything. you can easily automate the renewal of as many subdomain certs as needed.
- brianwawok 10y ago
  If you are a big company and need say 100k wildcard certs (say one per client).. I am pretty sure I can justify spending $50 for a wildcard cert vs a fleet of servers and engineers and monitors to enforce let's encrypt work. Let's encrypt is great but let's not pretend it's the right solution for all websites.
  - leeoniya 10y ago
    LE should charge a small fee for wildcard certs and extended validity periods (up to some reasonable limit). They'd likely cover their operating budget very quickly. What's their stance on wildcard certs with SANs? Is it simply too risky / ripe for abuse?
    - mjevans 10y ago
      Absolutely no knowledge here, but my /guess/ has been that they don't do more because it would either require more effort or would have soured the cross-signing deal so that they'd be validated by a CA that's already in older operating systems/devices.
    - yjftsjthsd-h 10y ago
      I suspect they will never allow longer validity certs because they want renewal to be automated.
    - sandGorgon 10y ago
      I will a LOT if LE can issue wildcard certificates to me with a 3 year validity. And send me reminder emails when im nearing expiry.
- tyingq 10y ago
  There is some time, scripting, etc, cost to integrating lots of certs into a single instance of Apache, nginx, etc. Wildcards certs have value in some settings.
- simcop2387 10y ago

will_hughes 10y ago

A wider set of devices that accept it. If you have a service that serves to a fleet of STBs, TVs, or other embedded devices, they have a fixed set of RootCAs and getting the OEM to update those (and possibly through a ton of different resellers) is a nightmare. While the embedded devices won't be impacted by this announcement (if the deprecation goes ahead), there might be some additional work for anyone that services web browsers AND embedded devices from the same endpoints.

toast0 10y ago
This is a pretty big deal; Symantec controls many root CAs that are pretty old and widely distributed. If you're supporting embedded devices (or phones) with pretty old root stores, you don't have that many choices, and it can be hard to know what they really are, because documentation of root stores is fairly sparse. Of course, there's not a good way for clients to indicate which root CAs they accept, and so they don't. If you get into the situation where newer devices don't support Symantec certs, and older devices don't support non-Symantec certs, it's time to figure out how to guess if you're talking to a newer or an older device and give appropriate certs. :(

bubblethink 10y ago

LE is not scalable. You can't do wildcards, and you don't want to authenticate every subdomain to LE by having it spawn a http server. You don't even want most of your stuff to face the internet to begin with.

kosinus 10y ago
I've never hit te rate limit on LE. Seems to me you need to be running a public site that gives each user a subdomain, or similar setup, before you run into such issues. You don't need a HTTP server to do authentication, it's also possible to use DNS and TLS SNI. There's certainly no need to spawn a server per domain, even for HTTP. If your implementation is complex enough to require many certs, these problems are already solvable. Either fork over the money for a wildcard cert, or account for the extra work in your planning. The setup we use is to have our own authoritative nameserver for a 'dyn' subdomain, and do DNS auth. We auth a subdomain with LE in less than 10 seconds.