5 ms·

> We’ve seen programs such as Let’s Encrypt that bring the price of domain name public key certificates down to a base of free Only free if you value your time

> We’ve seen programs such as Let’s Encrypt that bring the price of domain name public key certificates down to a base of free Only free if you value your time at $0.

robert_foss 9y ago
It is very easy to set up in a permanent fashion.
- betageek 9y ago
  Your definition of permanent is different to mine. LetsEncrypt relies on corporate sponsorship that could disappear at any time, then where would you be? Back to jumping through the same hoops you had to jump through before
  - tialaramex 9y ago
    Nah, there are two things going on here, and they're separate 1. The Let's Encrypt service from ISRG, which is a charity and so obviously if the donations dried up and somehow we didn't fix that then eventually (maybe a year or more) it would go away. This is also true for Wikipedia and the EFF in the most obvious direct sense, but it's true for all commercial services you rely on too, Youtube, Facebook, Hacker News, all could go away if their owners decide there isn't enough money any more. 2. ACME and other certificate automation. These are protocols, in ACME's case IETF Standards Track protocols, for how we can validate control over a name and issue certificates to an applicant. These don't vanish if ISRG goes away. For example loads of cPanel users already don't use Let's Encrypt, they have a single button "Yes, I want free certificates" feature, and Comodo (the root CA behind that) is taking a slice out of the cPanel license fees.
  - jmull 9y ago
    Your worst case scernaio is so mild: nothing lost. Why not use LetsEncrypt until it’s no longer available?
    - eadmund 9y ago
      > Your worst case scernaio is so mild: nothing lost. Not really. With Let's Encrypt available, the browser makers are now talking about penalising all HTTP sites. Next year, or the year after that, they could decommission Let's Encrypt (or start charging), and suddenly we'd all see what had been lost: it'd no longer be possible to set up an unpenalised site for free. Personally, I believe that an IP cert should be issued along with one's IP address, and a hostname cert should be issued along with one's domain name.
    - pbhjpbhj 9y ago
      If LE goes down, your cert expires and doesn't update, then your website visitors get the "unsafe site banner" and have to navigate instigation of an override to even see your pages. My small business page's cert got messed up (by Plesk, or the hosting provider I suspect) and the page went offline. If your site being essentially unavailable to customers isn't a major consequence I don't know what is.
StavrosK 9y ago
Indeed, otherwise they have negative cost. The Let's Encrypt API has saved me so much money by letting me automate certificate generation, it's crazy. No more having to install new certificates by hand every year!
- betageek 9y ago
  HTTP has a zero ongoing cost, HTTPS has a non-zero ongoing cost.
  - edent 9y ago
    Not for me. When I set up a new domain & hosting, I checked the box which said "Enable Lets Encrypt" and it was done instantly. I haven't had to manually renew it.
    - Joeboy 9y ago
      That's nice for you, but that's not how it is for other people.
      - ryukafalz 9y ago
        The tooling around Let's Encrypt is designed to make it possible to do that. If you're not dead set on using a specific web server, there are web servers with Let's Encrypt support out of the box[0]. And if you're using Apache or Nginx, Certbot[1] can configure Let's Encrypt support for them automatically. It's not the "one-click install" you'd get with some other software, but it's pretty close. [0] https://caddyserver.com/ https://caddyserver.com/ [1] https://certbot.eff.org/ https://certbot.eff.org/
        Joeboy 9y ago
        FWIW I just tried the automatic tooling. First observation is that my email (which was already using LE) still seems to be working, which is honestly surprising but I suppose I should be pleased. My website still seems to redirect a couple of times before ending up back at the unencrypted version. TBF, nothing's conspicuously broken so far so no immediate damage. I'll go back and try to sort it out when I have some more time / enthusiasm. Update: I got it working. I still maintain that it was largely pointless, not zero-effort, and puts the difficulty of running a webserver further into the domain of stuff that's only likely to be undertaken by professional / commercial entities, and that that's a bit of a pity. Update2: Shit, I broke some other stuff :-(
Hamuko 9y ago
I don't really see the difference between it and other certification. Surely I need to configure my servers regardless. Also, sometimes doing a bit of server work is rewarding on its own.
- annabellish 9y ago
  The main difference in my experience is that LE's short certificate expiry dates force you to automate certificate renewal, while traditional certificates usually don't even offer automation and so require you to take time to explicitly renew them.
- betageek 9y ago
  My problem is with the crusade to make everything HTTPS - normal HTTP involved no ongoing setup, and didn't put the ongoing functionality of your website in someone else's hands. As I've said above, LetsEncrypt is sponsored by corporations and could disappear tomorrow.
  - AluminiumPoint 9y ago
    Do you live in some parallel universe where we do not have mass surveillance, nation states or internet providers modifying traffic or unencrypted wifi at coffee shops? Your attitude is irresponsible. HTTPS is not a luxury, it is a requirement.
  - poizan42 9y ago
    Let's Encrypt is currently sponsored by 53 different corporations and organizations, including Google, Facebook and Cisco. I'm not seeing it disappearing anytime soon.
  - rootlocus 9y ago
    I'm pretty confident your services will disappear long before LetsEncrypt does.
  - Hamuko 9y ago
    My HTTPS web server requires no on-going setup. And the on-going functionality is in a lot of people's hands, since I don't host the server in my own house with my own fixed Internet connection.
oldcynic 9y ago
I set it up, once, it gets automatically renewed indefinitely. Haven't had to change a CC number, or trip over any of the usual selection of billing and renewal gotchas. Fits my definition of free, even after valuing my time as non-zero!
- betageek 9y ago
  Again, HTTP had no ongoing cost, HTTPS has an ongoing cost
  - heheocoenev 9y ago
    What ongoing cost? This is absurd. It’s $0, the automation is free, and the config is free. Stop spreading FUD.
  - billpg 9y ago
    So I can stop paying those bills the web-hosting company keeps bugging me about?
    - Joeboy 9y ago
      Yes, you can host your own server and use your home internet connection. This is the whole issue really - the web was designed as a decentralized, anarchistic, read/write thing, and it's subsequently become a thing where it's increasingly difficult to participate unless you're doing so on a professional basis or relying on somebody else's professional services. Maybe this is just how it has to be, but for people who can remember a couple of decades back it's pretty depressing. (btw I've used LE both in my day jobs and for some personal stuff, and I very much appreciate its existence).
      - dwighttk 9y ago
        so I can stop paying those home internet connection bills that keep stacking up every month?
dsacco 9y ago
It took me 10 minutes to setup Let’s Encrypt on my web server. It was the first and only time I’ve had to do it. I’m pretty sure I spent more time setting up Apache’s configuration than I did Let’s Encrypt’s.

> We’ve seen programs such as Let’s Encrypt that bring the price of domain name public key certificates down to a base of free Only free if you value your time at $0.

robert_foss 9y ago

It is very easy to set up in a permanent fashion.

betageek 9y ago
Your definition of permanent is different to mine. LetsEncrypt relies on corporate sponsorship that could disappear at any time, then where would you be? Back to jumping through the same hoops you had to jump through before
- tialaramex 9y ago
  Nah, there are two things going on here, and they're separate 1. The Let's Encrypt service from ISRG, which is a charity and so obviously if the donations dried up and somehow we didn't fix that then eventually (maybe a year or more) it would go away. This is also true for Wikipedia and the EFF in the most obvious direct sense, but it's true for all commercial services you rely on too, Youtube, Facebook, Hacker News, all could go away if their owners decide there isn't enough money any more. 2. ACME and other certificate automation. These are protocols, in ACME's case IETF Standards Track protocols, for how we can validate control over a name and issue certificates to an applicant. These don't vanish if ISRG goes away. For example loads of cPanel users already don't use Let's Encrypt, they have a single button "Yes, I want free certificates" feature, and Comodo (the root CA behind that) is taking a slice out of the cPanel license fees.
- jmull 9y ago
  Your worst case scernaio is so mild: nothing lost. Why not use LetsEncrypt until it’s no longer available?
  - eadmund 9y ago
    > Your worst case scernaio is so mild: nothing lost. Not really. With Let's Encrypt available, the browser makers are now talking about penalising all HTTP sites. Next year, or the year after that, they could decommission Let's Encrypt (or start charging), and suddenly we'd all see what had been lost: it'd no longer be possible to set up an unpenalised site for free. Personally, I believe that an IP cert should be issued along with one's IP address, and a hostname cert should be issued along with one's domain name.
  - pbhjpbhj 9y ago
    If LE goes down, your cert expires and doesn't update, then your website visitors get the "unsafe site banner" and have to navigate instigation of an override to even see your pages. My small business page's cert got messed up (by Plesk, or the hosting provider I suspect) and the page went offline. If your site being essentially unavailable to customers isn't a major consequence I don't know what is.

StavrosK 9y ago

Indeed, otherwise they have negative cost. The Let's Encrypt API has saved me so much money by letting me automate certificate generation, it's crazy. No more having to install new certificates by hand every year!

betageek 9y ago
HTTP has a zero ongoing cost, HTTPS has a non-zero ongoing cost.
- edent 9y ago
  Not for me. When I set up a new domain & hosting, I checked the box which said "Enable Lets Encrypt" and it was done instantly. I haven't had to manually renew it.
  - Joeboy 9y ago
    That's nice for you, but that's not how it is for other people.
    - ryukafalz 9y ago
      The tooling around Let's Encrypt is designed to make it possible to do that. If you're not dead set on using a specific web server, there are web servers with Let's Encrypt support out of the box[0]. And if you're using Apache or Nginx, Certbot[1] can configure Let's Encrypt support for them automatically. It's not the "one-click install" you'd get with some other software, but it's pretty close. [0] https://caddyserver.com/ https://caddyserver.com/ [1] https://certbot.eff.org/ https://certbot.eff.org/
      - Joeboy 9y ago
        FWIW I just tried the automatic tooling. First observation is that my email (which was already using LE) still seems to be working, which is honestly surprising but I suppose I should be pleased. My website still seems to redirect a couple of times before ending up back at the unencrypted version. TBF, nothing's conspicuously broken so far so no immediate damage. I'll go back and try to sort it out when I have some more time / enthusiasm. Update: I got it working. I still maintain that it was largely pointless, not zero-effort, and puts the difficulty of running a webserver further into the domain of stuff that's only likely to be undertaken by professional / commercial entities, and that that's a bit of a pity. Update2: Shit, I broke some other stuff :-(

Hamuko 9y ago

I don't really see the difference between it and other certification. Surely I need to configure my servers regardless. Also, sometimes doing a bit of server work is rewarding on its own.

annabellish 9y ago
The main difference in my experience is that LE's short certificate expiry dates force you to automate certificate renewal, while traditional certificates usually don't even offer automation and so require you to take time to explicitly renew them.
betageek 9y ago
My problem is with the crusade to make everything HTTPS - normal HTTP involved no ongoing setup, and didn't put the ongoing functionality of your website in someone else's hands. As I've said above, LetsEncrypt is sponsored by corporations and could disappear tomorrow.
- AluminiumPoint 9y ago
  Do you live in some parallel universe where we do not have mass surveillance, nation states or internet providers modifying traffic or unencrypted wifi at coffee shops? Your attitude is irresponsible. HTTPS is not a luxury, it is a requirement.
- poizan42 9y ago
  Let's Encrypt is currently sponsored by 53 different corporations and organizations, including Google, Facebook and Cisco. I'm not seeing it disappearing anytime soon.
- rootlocus 9y ago
  I'm pretty confident your services will disappear long before LetsEncrypt does.
- Hamuko 9y ago
  My HTTPS web server requires no on-going setup. And the on-going functionality is in a lot of people's hands, since I don't host the server in my own house with my own fixed Internet connection.

oldcynic 9y ago

I set it up, once, it gets automatically renewed indefinitely. Haven't had to change a CC number, or trip over any of the usual selection of billing and renewal gotchas. Fits my definition of free, even after valuing my time as non-zero!

betageek 9y ago
Again, HTTP had no ongoing cost, HTTPS has an ongoing cost
- heheocoenev 9y ago
  What ongoing cost? This is absurd. It’s $0, the automation is free, and the config is free. Stop spreading FUD.
- billpg 9y ago
  So I can stop paying those bills the web-hosting company keeps bugging me about?
  - Joeboy 9y ago
    Yes, you can host your own server and use your home internet connection. This is the whole issue really - the web was designed as a decentralized, anarchistic, read/write thing, and it's subsequently become a thing where it's increasingly difficult to participate unless you're doing so on a professional basis or relying on somebody else's professional services. Maybe this is just how it has to be, but for people who can remember a couple of decades back it's pretty depressing. (btw I've used LE both in my day jobs and for some personal stuff, and I very much appreciate its existence).
    - dwighttk 9y ago
      so I can stop paying those home internet connection bills that keep stacking up every month?

dsacco 9y ago

It took me 10 minutes to setup Let’s Encrypt on my web server. It was the first and only time I’ve had to do it. I’m pretty sure I spent more time setting up Apache’s configuration than I did Let’s Encrypt’s.