7 ms·
Looking Forward to 2018
- raonyguimaraes 9y agoI hope to see more built-in integration with Apache and Nginx web servers.
- infinisil 9y agoNixOS [1] actually has really great nginx integration with just a single line [2]: enableACME = true; This automatically does the ACME thing and sets up systemd units to renew the certificate. Have been using it a while for my (sub)domains and it's worked really well. [1]: https://nixos.org/ https://nixos.org/ [2]: https://nixos.org/nixos/options.html#%3Cname%3E.enableacme https://nixos.org/nixos/options.html#%3Cname%3E.enableacme
- tribaal 9y agoI know it's not directly what you've asked for (it's neither apache nor nginx), but the Caddy webserver does just that - almost 0 configuration dealing of the ACME part, auto-redirection from http to https. You still need to tell it what your domain name is, but barely (there's some DNS plugins that make it truely 0 config). https://github.com/mholt/caddy https://github.com/mholt/caddy (I'm not affiliated, just a happy user)
- Shoothe 9y agoDoes caddy still stop the server if it can't access Let's Encrypt service even though certificate is valid?
- tialaramex 9y agoThe bug you're thinking of was Caddy would refuse to /start/ if the certificate needed renewing and Let's Encrypt was down. They fixed that so that it has three weeks grace. Now only if you switch off the server wait until the cert has almost expired (say five days left) then switch it on, Caddy will go "eek, time to renew" and if Let's Encrypt is down it'll give up and the server doesn't start. This means either Let's Encrypt was down for longer than a decent summer vacation or you switched off your own web site for weeks. Neither of those is a good idea.
- mholt 9y agoNo, Caddy never did that. Caddy never stopped serving a site that it started serving. Only by shutting down the server (or sending the appropriate signal) would it stop serving the site.
- xorcist 9y agoCheck out mod_md. It's upstreamed in Apache now.
- robinwassen 9y agoSetup for Apache with certbot was basically one command. Was even easier than copying and configuring existing SSL certificates. So think that qualifies as a good integration.
- JosephRedfern 9y agoThe (beta) nginx certbot-auto module works flawlessly for me.
- majewsky 9y ago> We pride ourselves on being an efficient organization. In 2018 Let’s Encrypt will secure a large portion of the Web with a budget of only $3.0M. I sincerely hope that they don't become like Wikimedia with their ever-increasing scope and bureaucracy. And it might work because Let's Encrypt has a rather specific mission (free TLS certs for everyone), whereas Wikimedia has a rather broad mission (free knowledge/data for everyone).
- sverhagen 9y agoAnd for this reason I frowned upon the upcoming wildcard certificates. Adding a new product would cost them, no? I had previously read that wildcard certificates are a non-issue, if the specific certificates are free anyway, as is the obvious case with Let's Encrypt.
- anilgulecha 9y agowildcard certificates is really only thing missing in their offering. It definitely makes sense for them to also disrupt and offer a quality, more-efficient alternative here. It's an extension of their offering rather than a new product.
- tokenizerrr 9y agoFor small deployments you're right. If you have a lot of subdomains coming and going you will hit the Lets Encrypt rate limits real fast. They're generous enough, but I've hit them quite a few times. For certain use cases a wildcard cert just makes way more sense.
- vertex-four 9y agoOne of the things that's very, very difficult with individual certificates and LetsEncrypt's rate limits is to provide subdomains per-customer without leaking details (e.g. usernames) of other customers. If you don't want bob.example.com and alice.example.com on the same certificate, you can have a grand total of 20 users before you hit the rate limits. This also affects systems like Sandstorm, which use randomly generated, unguessable subdomains per user session per "grain" (document), which may have (small) privacy concerns in some cases. Certificate Transparency would publicly publish every subdomain generated, even if the rate limits weren't a thing.
- NicoJuicy 9y agoLetsencrypt has made my live easier... So, don't forget to donate, if it helps you: https://letsencrypt.org/donate/ https://letsencrypt.org/donate/ Don't forget the past :)
- mobilemidget 9y agoJimmy Wales of Letsencrypt? Is that you? :-D
- d33 9y agoThe least you can do is NOT make jokes of those who keep those organizations going.
- mobilemidget 9y ago“If you can't joke about the most horrendous things in the world, what's the point of jokes? What's the point in having humor? Humor is to get us over terrible things.” ― Ricky Gervais This includes less horrendous things, like the big parties behind LE that request donations? Akamai, Mozilla, Cisco, OVH, Google, etc, I'm pretty sure the running costs of LE is nihil for them. Why ask for donations?
- NicoJuicy 9y agoBecause services still aren't free. They have support from big companies, yes, doesn't mean you shouldn't donate. Definatly for something that makes your life easier ( it does mine)
- mobilemidget 9y agoJust saying 'doesn't mean you shouldn't donate' doesn't give ANY reason why you should donate. Those companies want everybody to have https for free right? Then offer it for free and don't start begging for money afterwards? The 2.6 million running costs is change for a party like google, and they pay it with money MADE by raping privacy of the same group of users... you are already paying... why donate? -- oh your lovely votes forbid me to take the discussion further... You say makes life easier, but you don't explain how it makes your life easier? Everybody should be capable of running a single openssl command and update configurations of a webserver or other service? (you still need to run LE command, so saves you one handling?) There are 60+ LE client implementations... because people apparently cant run a single openssl command and update a configuration? Isn't that overkill? In my opinion, for what it 'solves' or how it makes your life easier, it certainly is overkill. And don't forget all the clients need to be maintained, etc etc. And you certainly underestimate the information that is generated by running LE, the information leaked, (OCSP requests etc) They can monetise it easily (or do shadier things like leak this information to their partners, google Akamai etc), so again, why donate.
- hsivonen 9y agoAre full ECDSA chains going to depend on the upcoming Let's Encrypt ECDSA root being in the client trust store or is there going to be cross-signing?
- jaas 9y agoGood question. We are hoping to have a cross-sign from a widely trusted ECDSA root in place. It's non-trivial to make that happen, and it's part of the reason this feature is taking longer than we had hoped.
- oblio 9y agoI think they're underestimating the growth they're going to get when they implement wildard certificates and the word truly gets out :)
- y4mi 9y agouh, why? shouldn't it get less again? if i use ~8 certs for different servers, i could just get a wildcard for my domain and be done with it...?
- hobofan 9y agoGrowth in number of sites secured, not in number of certs issued.
- cm2187 9y agoTo be honest it is easy to do multi-sub domain certificates already. Wildcard certificates will only make my life more simple. But unless you need a huge number of sub domains, or dynamic sub domains, it's not really going to change that much. If anything it will reduce the strain on their servers. Instead of authorising subdomain by subdomain there will be a single authorisation by domain.
- jaas 9y agoIt's possible, but a couple of points to consider: 1) Wildcards may have a net negative effect on total issuance if subscribers who were getting many non-wildcard certificates before replace them with a single wildcard. I'm not sure this will be the case, but it could be. I expect wildcards will help move many more sites to HTTPS - perhaps just with fewer actual certs. 2) Wildcard validation from Let's Encrypt will be restricted to DNS validation, and many people don't have the ability to automate modifications to their DNS records. That being the case, it will be a bit more difficult to validate for wildcard certificates than for non-wildcards.
- eng_monkey 9y agoI wonder why they do not user their own certificates? https://letsencrypt.org https://letsencrypt.org reports Identrust.
- pluma 9y agoProbably because they got a certificate before their own certificates were widely accepted?
- simias 9y agoAt first I thought it might be so that you could still access their website for support if you had an issue with their CA. However it seems that https://community.letsencrypt.org/ https://community.letsencrypt.org/ which would seem a good place to get help is actually using one of their certificates so maybe it's just historical. The certificate dates back to 2015 and expires in next February, maybe they'll replace it by one of their own then.
- jaas 9y agoWe set that up before we were an operational CA and it has just never been a high enough priority to replace it. The team that would do it has a lot of other things to do. We'll get around to it at some point.
- borplk 9y agoProbably not a bad idea to use another CA for that.
- deleted 9y ago[deleted]
- alexchamberlain 9y ago> the Web went from 46% encrypted page loads to 67% according to statistics from Mozilla - a gain of 21% in a single year No no no... That's a gain of 50% (give or take) or 21 percentage points; not a gain of 21%.
- gmac 9y agoThe broader problem is that expressing changes as percentages is often intrinsically ambiguous. I'm not sure that the way you're choosing to signal the difference is widely appreciated or understood.
- Shoothe 9y agoIt depends on what do you mean by "widely understood". People that deal with numbers know the difference, but other can just read Wikipedia, see https://en.wikipedia.org/wiki/Percentage_point https://en.wikipedia.org/wiki/Percentage_point It may be similar to people not feeling the difference between causation and correlation.
- JorgeGT 9y agoIt is a common mistake, I remember that not so long ago my government (Spain) had to amend a law because the initial text incorrectly said % instead of percentage points.
- bufferoverflow 9y agoWhy are you calculating the gain out of 46% and not out of 100%? It clearly doesn't talk about the gain of a percent of a percentage.
- chairmanwow 9y agoPercentage changes are a scaling factor against the previous number. 1-(new/old) is how it should be calculated. So even though they are comparing two percentages, they can't directly subtract them (new - old). Percentages describe _relative_ change.
- codedokode 9y agoWhile Letsencrypt is doing a good thing, but what if it will stop issuing free certificates?
- dsr_ 9y agoThen we will not be worse off than we were before.
- dtech 9y agoWe would be better off, since there now exists a protocol and extensive tooling for automatic certificate management. This allows a competitor (even a commercial) one to fill in the gap left by letsencrypt if they stop issuing certs.
- perlgeek 9y agoIn the short term, some will be worse off, because their current certificates will be valid somewhere between 30 and 90 days, instead of the 0 to 365 that is common with traditional certificates. Still, it's worth it. I have some private sites that now have TLS thanks to let's encrypt, which were plain HTTP before. I still wish for a second free, automated CA. Just to have redundancy.
- cpach 9y agoWhy would they?
- bryanlarsen 9y agoThey would if they ran out of money. There's a donate button at the bottom of the post...
- kristofferR 9y agoLetsEncrypt has, as the post said, a super tiny (compared to their massive positive impact) budget of just $3 million dollars and the largest companies of the web as backers. They're never gonna run of of founds - their backers (Mozilla, Akamai, OVH, Cisco, Google, EFF,++++) would never let them.
- PakG1 9y agoFunny trivia. Recently, our firewall was blocking a ton of smaller websites. Wasn't sure why. Finally got on the phone with Sophos (our firewall manufacturer) to figure out what was going on. Support guy led me through some troubleshooting steps, we discovered that it's blocking Lets Encrypt certificates for whatever reason. He agreed with me that's strange and he'll look into why Lets Encrypt is getting blocked. So strange. Not related to anything at all, just topical trivia.
- jlgaddis 9y agoAt a guess, Sophos isn't/wasn't trusting Let's Encrypt's own root certificate (only their cross-signed ones).
- wilhil 9y agoI know they are planning wildcard already (as per article), I'm just keeping my fingers crossed we will see code signing and others before too long... I understand though, code signing will be much harder to automate and maybe not so fit for purpose...
- cm2187 9y agoOut of curiosity, how would you implement the authorisation? Would you tie it to a domain? Would that even make sense?
- Klathmon 9y agoYou could go the keybase route and tie in with various platforms using anywhere that you can post a public message to post "proof". So if you wanted to sign a windows executable, you'd need to have a microsoft account, and that microsoft account would need a place that you could publicly post a string of text. Then it's up to the Lets Encrypt service to validate that and cut the certificate
- gruez 9y agoCode signing certificates are essentially EV certificates (in terms of validation required), so I doubt they'll be free anytime soon.
- feelin_googley 9y agoDoes LE support listing an IP address in a certificate instead of domain names?