6 ms·

The amount of money I've paid for this... I recon some of these providers are going under soon?

by neals 9y ago

nkkollaw 9y ago
If it was up to me, even right now. This is great news!
shawabawa3 9y ago
> I recon some of these providers are going under soon? I really hope so. The cost to providers is exactly the same for a wildcard and a standard certificate, and yet they costs hundreds of dollars. It's unbelievable it's lasted this long
- hamandcheese 9y ago
  It’s not that unbelievable, what software service are you aware of that is sold at only it’s marginal cost?
  - staticfish 9y ago
    It's not "software" in the historic sense, like buying Photoshop or a paying for hosted Slack service. It's literally a command to generate a certificate from their root CA chain. Yes there's obviously business costs, and they have to employ people to do verification, etc (which they often do a terrible job at), but I think you see what the parent is getting at..
- Paul-ish 9y ago
  Why hasn't competition reduced the price?
eric_b 9y ago
I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).
- Vendan 9y ago
  If you are following the recommended practices, it's every 2 months, and ACME would have to be down for a solid month. I think that's fairly unlikely
- jve 9y ago
  Well you can happily use other CAs if you want to 1. Pay money and 2. manage certs manually. As you did/do it always.
- thaumaturgy 9y ago
  I've been running a modified copy of the dehydrated client (https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated) for, I dunno, a long time now. Since not long after letsencrypt became available. I have my own domain name servers, so it wasn't hard to wire up DNS-01 support. Anyway, the client has been running daily out of a cron job, updating certs on remote servers as they need to be, with very little intervention from me, for well over a year now. It's just about a set-it-and-forget-it setup. Let's Encrypt is intended to be fully automated and you shouldn't have to faff about with it every quarter, it should do its thing all by itself. ...most of the time.
- jjeaff 9y ago
  Really long expiration certs are a security issue. The main reason being that if the cert is compromised, there is a much longer window that it can be exploited. With a 90 day window, even if it is compromised, it will stop working soon. Even in the case that it is compromised and you know it, your only option is certificate revocation. And you are in big trouble if you are relying on revocation because most clients do not keep very up to date with the CRL. Not only for security, but the 90 days is to encourage automation. And most clients like certbot will check everyday, and if the cert is within 30 days of renewal, it attempts to renew. If letsencrypt is down, it will try again the next day. So you have an entire month before an outage would affect you.
- patcheudor 9y ago
  >I'll happily pay money to get a cert that expires in 3 years instead of 90 days. No way. Every time I've worked with an organization with three years expiry it's guaranteed they have no idea, after three years how to even renew the cert. They are effectively longer in many cases than the hiring cycle and for larger organizations can be a complete nightmare. No one wants to invest in time in automation, training, tracking, etc., because it's so far down the road. The 90 day model makes much more sense because it requires automation. In terms of the ACME endpoints being down, I'm not going to say that won't happen but renewal starts 30 days before the cert expires and if Let's Encrypt's ACME endpoints are down for 30 days or longer there's a good chance we are all dealing with something far more dire than cert renewal at that point.
b3lvedere 9y ago
I don't know. Will Letsencrypt also replace EV certificates?
- giobox 9y ago
  Their FAQ says no because the process for issuing EVs can't be automated which given the requirements for Extended Validation makes some sense I guess.

The amount of money I've paid for this... I recon some of these providers are going under soon?

by neals 9y ago

The amount of money I've paid for this... I recon some of these providers are going under soon?

nkkollaw 9y ago

If it was up to me, even right now. This is great news!

shawabawa3 9y ago

> I recon some of these providers are going under soon? I really hope so. The cost to providers is exactly the same for a wildcard and a standard certificate, and yet they costs hundreds of dollars. It's unbelievable it's lasted this long

hamandcheese 9y ago
It’s not that unbelievable, what software service are you aware of that is sold at only it’s marginal cost?
- staticfish 9y ago
  It's not "software" in the historic sense, like buying Photoshop or a paying for hosted Slack service. It's literally a command to generate a certificate from their root CA chain. Yes there's obviously business costs, and they have to employ people to do verification, etc (which they often do a terrible job at), but I think you see what the parent is getting at..
Paul-ish 9y ago
Why hasn't competition reduced the price?

eric_b 9y ago

I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).

Vendan 9y ago
If you are following the recommended practices, it's every 2 months, and ACME would have to be down for a solid month. I think that's fairly unlikely
jve 9y ago
Well you can happily use other CAs if you want to 1. Pay money and 2. manage certs manually. As you did/do it always.
thaumaturgy 9y ago
I've been running a modified copy of the dehydrated client (https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated) for, I dunno, a long time now. Since not long after letsencrypt became available. I have my own domain name servers, so it wasn't hard to wire up DNS-01 support. Anyway, the client has been running daily out of a cron job, updating certs on remote servers as they need to be, with very little intervention from me, for well over a year now. It's just about a set-it-and-forget-it setup. Let's Encrypt is intended to be fully automated and you shouldn't have to faff about with it every quarter, it should do its thing all by itself. ...most of the time.
jjeaff 9y ago
Really long expiration certs are a security issue. The main reason being that if the cert is compromised, there is a much longer window that it can be exploited. With a 90 day window, even if it is compromised, it will stop working soon. Even in the case that it is compromised and you know it, your only option is certificate revocation. And you are in big trouble if you are relying on revocation because most clients do not keep very up to date with the CRL. Not only for security, but the 90 days is to encourage automation. And most clients like certbot will check everyday, and if the cert is within 30 days of renewal, it attempts to renew. If letsencrypt is down, it will try again the next day. So you have an entire month before an outage would affect you.
patcheudor 9y ago
>I'll happily pay money to get a cert that expires in 3 years instead of 90 days. No way. Every time I've worked with an organization with three years expiry it's guaranteed they have no idea, after three years how to even renew the cert. They are effectively longer in many cases than the hiring cycle and for larger organizations can be a complete nightmare. No one wants to invest in time in automation, training, tracking, etc., because it's so far down the road. The 90 day model makes much more sense because it requires automation. In terms of the ACME endpoints being down, I'm not going to say that won't happen but renewal starts 30 days before the cert expires and if Let's Encrypt's ACME endpoints are down for 30 days or longer there's a good chance we are all dealing with something far more dire than cert renewal at that point.

b3lvedere 9y ago

I don't know. Will Letsencrypt also replace EV certificates?

giobox 9y ago
Their FAQ says no because the process for issuing EVs can't be automated which given the requirements for Extended Validation makes some sense I guess.