4 ms·

Your definition of permanent is different to mine. LetsEncrypt relies on corporate sponsorship that could disappear at any time, then where would you be? Back t

Your definition of permanent is different to mine. LetsEncrypt relies on corporate sponsorship that could disappear at any time, then where would you be? Back to jumping through the same hoops you had to jump through before

tialaramex 9y ago
Nah, there are two things going on here, and they're separate 1. The Let's Encrypt service from ISRG, which is a charity and so obviously if the donations dried up and somehow we didn't fix that then eventually (maybe a year or more) it would go away. This is also true for Wikipedia and the EFF in the most obvious direct sense, but it's true for all commercial services you rely on too, Youtube, Facebook, Hacker News, all could go away if their owners decide there isn't enough money any more. 2. ACME and other certificate automation. These are protocols, in ACME's case IETF Standards Track protocols, for how we can validate control over a name and issue certificates to an applicant. These don't vanish if ISRG goes away. For example loads of cPanel users already don't use Let's Encrypt, they have a single button "Yes, I want free certificates" feature, and Comodo (the root CA behind that) is taking a slice out of the cPanel license fees.
jmull 9y ago
Your worst case scernaio is so mild: nothing lost. Why not use LetsEncrypt until it’s no longer available?
- eadmund 9y ago
  > Your worst case scernaio is so mild: nothing lost. Not really. With Let's Encrypt available, the browser makers are now talking about penalising all HTTP sites. Next year, or the year after that, they could decommission Let's Encrypt (or start charging), and suddenly we'd all see what had been lost: it'd no longer be possible to set up an unpenalised site for free. Personally, I believe that an IP cert should be issued along with one's IP address, and a hostname cert should be issued along with one's domain name.
- pbhjpbhj 9y ago
  If LE goes down, your cert expires and doesn't update, then your website visitors get the "unsafe site banner" and have to navigate instigation of an override to even see your pages. My small business page's cert got messed up (by Plesk, or the hosting provider I suspect) and the page went offline. If your site being essentially unavailable to customers isn't a major consequence I don't know what is.

tialaramex 9y ago

Nah, there are two things going on here, and they're separate 1. The Let's Encrypt service from ISRG, which is a charity and so obviously if the donations dried up and somehow we didn't fix that then eventually (maybe a year or more) it would go away. This is also true for Wikipedia and the EFF in the most obvious direct sense, but it's true for all commercial services you rely on too, Youtube, Facebook, Hacker News, all could go away if their owners decide there isn't enough money any more. 2. ACME and other certificate automation. These are protocols, in ACME's case IETF Standards Track protocols, for how we can validate control over a name and issue certificates to an applicant. These don't vanish if ISRG goes away. For example loads of cPanel users already don't use Let's Encrypt, they have a single button "Yes, I want free certificates" feature, and Comodo (the root CA behind that) is taking a slice out of the cPanel license fees.

jmull 9y ago

Your worst case scernaio is so mild: nothing lost. Why not use LetsEncrypt until it’s no longer available?

eadmund 9y ago
> Your worst case scernaio is so mild: nothing lost. Not really. With Let's Encrypt available, the browser makers are now talking about penalising all HTTP sites. Next year, or the year after that, they could decommission Let's Encrypt (or start charging), and suddenly we'd all see what had been lost: it'd no longer be possible to set up an unpenalised site for free. Personally, I believe that an IP cert should be issued along with one's IP address, and a hostname cert should be issued along with one's domain name.
pbhjpbhj 9y ago
If LE goes down, your cert expires and doesn't update, then your website visitors get the "unsafe site banner" and have to navigate instigation of an override to even see your pages. My small business page's cert got messed up (by Plesk, or the hosting provider I suspect) and the page went offline. If your site being essentially unavailable to customers isn't a major consequence I don't know what is.