6 ms·

Let's Encrypt issues 35 certs every second

48 points by dfern 3y ago

tracker1 3y ago
Let's Encrypt has definitely been a net positive to the internet as a whole. I do wish more services/tools had cleaner integration. I've switched to mostly using Caddy for personal web and reverse proxy chores as it's just much easier to deal with imo.
- Kraftwurm 3y ago
  Caddy ist just awesome. I regularly wonder why most online tutorials don't use it. Because it just works and is so much easier to work with than all the alternatives.
  - tracker1 3y ago
    True enough... I often with replace docker-compose examples that use a complex nginx config with a 5 line Caddyfile for Caddy instead.
  - BrandoElFollito 3y ago
    Fully agree. The community is usually very nice to work with (especially mholt).
- hbcondo714 3y ago
  > I do wish more services/tools had cleaner integration I just had a positive experience with adding a Let's Encrypt SSL cert at Fly.io[1] for hosting my new PWA on a custom domain[2]. It was literally a one-line command to run but no DNS challenge [1] https://fly.io/docs/app-guides/custom-domains-with-fly/#adding-the-certificate https://fly.io/docs/app-guides/custom-domains-with-fly/#addi... [2] https://github.com/hbcondo/revenut-app https://github.com/hbcondo/revenut-app
johnea 3y ago
And somehow having one of these prevents your website from being "illegitimate"...
- notatallshaw 3y ago
  It prevents the data between you and the requester from being read or tampered with in-transit. Before HTTPS was popular, I used to see ISPs inject tracking JavaScript or ads into arbitrary websites for their "customers". So, in some sense yes, this preserves a legitimate version of your website for the requester.
  - ralph84 3y ago
    And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP. Presumably that’s where the snark is coming from. Clearly the plaintext HTTP was less secure than self-signed certs but browsers perpetuated the “trusted” cert cartel.
    - Wingy 3y ago
      Having a certificate from a CA like LE proves that you don't have a local MITM. The MITM would have to also somehow get between LE's servers and the website in order to get a trusted certificate. A self-signed certificate does not have that guarantee.
    - danShumway 3y ago
      > And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP This is largely because putting a huge red alert in front of plaintext HTTP pages would provoke a huge backlash from anti-HTTPS factions on the Internet. HTTP pages should have a big red alert on them, and browsers are very slowly but surely moving in a direction of being HTTPS by default and HTTPS-only in the limited instances where it's possible. Arguably even in that world, a site claiming that the connection is secure and then offering a bad certificate is more worrying than a site that never claims the connection is secure in the first place. But ideally, eventually, we hope that the vast majority of the web is using certificates, and that visiting an HTTP-only page should be a rare event, possibly with some kind of warning in front of it. Browsers have at the very least gotten rid of the SSL green padlock and have de-emphasized certificate origin in their presentation, and HTTP-only pages at least get labeled as insecure in modern browsers. That's a step in the right direction. But yeah, it's tough to treat HTTP-only pages the way they should be treated because a bunch of Internet users who dismiss MITM attacks will cry murder if browsers do so. And of course absent a bunch of infrastructure and pinning capabilities and authentication mechanisms that don't exist for browsers, under current usage self-signed certificates don't really prove anything about the security of your connection.
eatsyourtacos 3y ago
As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?
- thisgoodlife 3y ago
  You can automate the process. Try certbot.
  - eatsyourtacos 3y ago
    I know it can be automated even more, but in my situation it's just not practical even having to release to a lot of (disconnected) machines.
    - fsmv 3y ago
      You should use a reverse proxy server so you only have the cert on one machine. I actually made one for myself in go that's been pretty fun. You can try it if you want (https://github.com/fsmv/daemon https://github.com/fsmv/daemon) but you should be able to set it up with apache or nginx as well.
- hotpotamus 3y ago
  I've used Namecheap for a long time and switched my company over to them recently. They're not exactly the latest hotness, but they work for me.
- tracker1 3y ago
  It really comes down to automation... I've mostly used Caddy as a host and reverse-proxy for personal stuff, as well as in a couple workplace projects, the support for named domains is well baked in, and there are extensions for plugging into various dns providers if you want broader wildcard options.
- BrandoElFollito 3y ago
  You should give it a try to Caddy. You won't have anything to manage, everything is done for you behind the scenes. Use it as a reverse proxy to your services
dt3ft 3y ago
How much longer can this service remain free?
- hulitu 3y ago
  As long as the CIA pays for it. See https://en.m.wikipedia.org/wiki/Crypto_AG https://en.m.wikipedia.org/wiki/Crypto_AG
jiggawatts 3y ago
To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free. A Raspberry Pi could serve this. Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually. The reality is that they are pure rent-seekers, charging $50 for something that can be provided for free from a fanless hobby computer. I just want everyone to have some perspective next time you go buy a wildcard certificate for a thousand dollars, which differs from a normal certificate by just four bytes. Count the dollars per byte.
- x86a 3y ago
  To be fair, I doubt bandwidth has ever been a significant cost driver for CAs
  - jiggawatts 3y ago
    Greed has been the cost driver, which is why plugging "*.domain.com" into the subject field instead of "domain.com" costs 10x more money. DigiCert for example is owned by private venture capitalists. They expect as much rent-seeking as possible to get a return on their investment.
- ehPReth 3y ago
  Cool. But what do the HSMs, auditing, etc, etc, etc that the BRs (https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-v2.0.0.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...) and root store policies require cost on top of “just some bytes”? FreeFreeFreeCerts (https://bugzilla.mozilla.org/show_bug.cgi?id=233458 https://bugzilla.mozilla.org/show_bug.cgi?id=233458) or Honest Achmed’s certificate authority (https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959) won’t make it in today’s world, nor yesterday’s. Let’s Encrypt’s financials are public and they aren’t running it off a singular Raspberry PI, nor anything like it - because they can’t; nor would it responsible to, at least on, say, a HSM or key seperation level. Not to say, though, that traditional CAs aren’t rent seeking bloated greedy pieces of shit - because they absolutely are. I’m happy Let’s Encrypt found the funding and will (and the all important cross-sign) to take off and curb stomp the incumbent CAs around a bit. I still cringe every time I see an OV certificate in the wild.
hackeraccount 3y ago
That's all?

48 points by dfern 3y ago

Let's Encrypt has definitely been a net positive to the internet as a whole. I do wish more services/tools had cleaner integration. I've switched to mostly using Caddy for personal web and reverse proxy chores as it's just much easier to deal with imo.

Kraftwurm 3y ago
Caddy ist just awesome. I regularly wonder why most online tutorials don't use it. Because it just works and is so much easier to work with than all the alternatives.
- tracker1 3y ago
  True enough... I often with replace docker-compose examples that use a complex nginx config with a 5 line Caddyfile for Caddy instead.
- BrandoElFollito 3y ago
  Fully agree. The community is usually very nice to work with (especially mholt).
hbcondo714 3y ago
> I do wish more services/tools had cleaner integration I just had a positive experience with adding a Let's Encrypt SSL cert at Fly.io[1] for hosting my new PWA on a custom domain[2]. It was literally a one-line command to run but no DNS challenge [1] https://fly.io/docs/app-guides/custom-domains-with-fly/#adding-the-certificate https://fly.io/docs/app-guides/custom-domains-with-fly/#addi... [2] https://github.com/hbcondo/revenut-app https://github.com/hbcondo/revenut-app

johnea 3y ago

And somehow having one of these prevents your website from being "illegitimate"...

notatallshaw 3y ago
It prevents the data between you and the requester from being read or tampered with in-transit. Before HTTPS was popular, I used to see ISPs inject tracking JavaScript or ads into arbitrary websites for their "customers". So, in some sense yes, this preserves a legitimate version of your website for the requester.
- ralph84 3y ago
  And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP. Presumably that’s where the snark is coming from. Clearly the plaintext HTTP was less secure than self-signed certs but browsers perpetuated the “trusted” cert cartel.
  - Wingy 3y ago
    Having a certificate from a CA like LE proves that you don't have a local MITM. The MITM would have to also somehow get between LE's servers and the website in order to get a trusted certificate. A self-signed certificate does not have that guarantee.
  - danShumway 3y ago
    > And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP This is largely because putting a huge red alert in front of plaintext HTTP pages would provoke a huge backlash from anti-HTTPS factions on the Internet. HTTP pages should have a big red alert on them, and browsers are very slowly but surely moving in a direction of being HTTPS by default and HTTPS-only in the limited instances where it's possible. Arguably even in that world, a site claiming that the connection is secure and then offering a bad certificate is more worrying than a site that never claims the connection is secure in the first place. But ideally, eventually, we hope that the vast majority of the web is using certificates, and that visiting an HTTP-only page should be a rare event, possibly with some kind of warning in front of it. Browsers have at the very least gotten rid of the SSL green padlock and have de-emphasized certificate origin in their presentation, and HTTP-only pages at least get labeled as insecure in modern browsers. That's a step in the right direction. But yeah, it's tough to treat HTTP-only pages the way they should be treated because a bunch of Internet users who dismiss MITM attacks will cry murder if browsers do so. And of course absent a bunch of infrastructure and pinning capabilities and authentication mechanisms that don't exist for browsers, under current usage self-signed certificates don't really prove anything about the security of your connection.

eatsyourtacos 3y ago

As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?

thisgoodlife 3y ago
You can automate the process. Try certbot.
- eatsyourtacos 3y ago
  I know it can be automated even more, but in my situation it's just not practical even having to release to a lot of (disconnected) machines.
  - fsmv 3y ago
    You should use a reverse proxy server so you only have the cert on one machine. I actually made one for myself in go that's been pretty fun. You can try it if you want (https://github.com/fsmv/daemon https://github.com/fsmv/daemon) but you should be able to set it up with apache or nginx as well.
hotpotamus 3y ago
I've used Namecheap for a long time and switched my company over to them recently. They're not exactly the latest hotness, but they work for me.
tracker1 3y ago
It really comes down to automation... I've mostly used Caddy as a host and reverse-proxy for personal stuff, as well as in a couple workplace projects, the support for named domains is well baked in, and there are extensions for plugging into various dns providers if you want broader wildcard options.
BrandoElFollito 3y ago
You should give it a try to Caddy. You won't have anything to manage, everything is done for you behind the scenes. Use it as a reverse proxy to your services

dt3ft 3y ago

How much longer can this service remain free?

hulitu 3y ago
As long as the CIA pays for it. See https://en.m.wikipedia.org/wiki/Crypto_AG https://en.m.wikipedia.org/wiki/Crypto_AG

jiggawatts 3y ago

To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free. A Raspberry Pi could serve this. Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually. The reality is that they are pure rent-seekers, charging $50 for something that can be provided for free from a fanless hobby computer. I just want everyone to have some perspective next time you go buy a wildcard certificate for a thousand dollars, which differs from a normal certificate by just four bytes. Count the dollars per byte.

x86a 3y ago
To be fair, I doubt bandwidth has ever been a significant cost driver for CAs
- jiggawatts 3y ago
  Greed has been the cost driver, which is why plugging "*.domain.com" into the subject field instead of "domain.com" costs 10x more money. DigiCert for example is owned by private venture capitalists. They expect as much rent-seeking as possible to get a return on their investment.
ehPReth 3y ago
Cool. But what do the HSMs, auditing, etc, etc, etc that the BRs (https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-v2.0.0.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...) and root store policies require cost on top of “just some bytes”? FreeFreeFreeCerts (https://bugzilla.mozilla.org/show_bug.cgi?id=233458 https://bugzilla.mozilla.org/show_bug.cgi?id=233458) or Honest Achmed’s certificate authority (https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959) won’t make it in today’s world, nor yesterday’s. Let’s Encrypt’s financials are public and they aren’t running it off a singular Raspberry PI, nor anything like it - because they can’t; nor would it responsible to, at least on, say, a HSM or key seperation level. Not to say, though, that traditional CAs aren’t rent seeking bloated greedy pieces of shit - because they absolutely are. I’m happy Let’s Encrypt found the funding and will (and the all important cross-sign) to take off and curb stomp the incumbent CAs around a bit. I still cringe every time I see an OV certificate in the wild.

hackeraccount 3y ago

That's all?