8 ms·

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I bui

• rokkamokka 10mo ago
  No! Let's encrypt is easily the best thing that's happened for a secure internet the last 10 years.
  • DaSHacka 10mo ago
    And equally as much for a centralized internet...
• johnebgd 10mo ago
  There are extended certificates that did matter in our sales process for some hosted solutions back about 15 years ago if I recall right… no one has ever cared since…
• giancarlostoro 10mo ago
  > It coming from GoDaddy is not a selling point... I just people who use GoDaddy. They were the one company supporting SOPA when the entire rest of the internet was opposed to SOPA. It's very obvious GoDaddy is run by "business-bros" and not hackers or tech bros.
  • dylan604 10mo ago
    This is my feeling as well. Finding out someone uses GoDaddy is a bit of a shibboleth.
• Analemma_ 10mo ago
  I've seen people complain that Let's Encrypt is so easy that it's enabling the forced phaseout of long-lived certificates and unencrypted HTTP. I sort of understand this, although it does feel like going "bcrypt is so easy to use it's enabling standards agencies to force me to use something newer than MD5". Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; that's how it's supposed to work.
  • mschuster91 10mo ago
    > Like, yeah, once the secure way is sufficiently easy to use, we can then push everyone off the insecure way; that's how it's supposed to work. The problem is that this requires work and validation, which no beancounter ever plans for. And the underlings have to do the work, but don't get extra time, so it has to be crammed in, condensing the workday even more. For hobbyist projects it's even worse. That is why people are so pissed, there is absolutely zero control over what the large browser manufacturers decide on a whim. It's one thing if banks or Facebook or other truly large entities get to do work... but personal blogs and the likes?
    • nottorp 10mo ago
      > but personal blogs and the likes? Yep, the result of the current security hysteria/theater is it makes it increasingly difficult to maintain an independent web presence. Yes, I know, you can just use Cloudflare and depend on it...
      • eastbound 10mo ago
        Cloudflare uses HTTP to connect to your website before caching the content. I’ve always found it highly insecure. You could have HTTPS with Letsencrypt, but you need to deactivate Cloudflare when you want to renew (or use the other validation that is complex enough that I didn’t succeed to do it).
        • nottorp 10mo ago
• UltraSane 10mo ago
  I have worked at companies that refused to use LetsEncrypt for the same reason.
• quesera 10mo ago
  There was a time when EV certificates were considered more trustworthy than DV certs. Browsers used to show an indication for EV certs. Those days are long gone, and I'm not completely sure how I feel about it. I hated the EV renewal/rotation process, so definitely a win on the day-to-day scale, but I still feel like something was lost in the transition.
  • trueismywork 10mo ago
    What about OV?
    • ekr____ 10mo ago
      It's never been clear to me what the rationale for OV was, as the UI wasn't even different like EV was.
    • quesera 10mo ago
      I've never seen (noticed) an OV cert in real life, and no business I've ever been responsible for pushed for OV over DV. It was always EV or "huh?"
      • Sesse__ 10mo ago
        Before LE, we did lots of OV (which you generally could get a couple of for free from somewhere). We had to dig up stuff like a heating bill, because evidently that is proof of organizational control to some people.
      • bostik 10mo ago
        I think I've seen one or two, and only because I noticed them as a weird callout in a $LARGE_FINANCE_INSTITUTION infosec bingo sheet. Of course I had to check that they really were running with OV certs. Some of the outfits in that space will be heavily hit by the shortening certificate max-lifetimes, and I do hope that the insurance companies at some point also stop demanding a cert rotation before 90 days to expiry. It's a weird feeling to redline a corporate insurance policy when their standard requirements are 15 years out of date.
• traceroute66 10mo ago
  > has anyone actually commented to you in a negative way about using Let's Encrypt? A friend of mine has had a negative experience insofar as they are working for a small company, using maybe only 15–20 certs and one day they started getting hounded by Let's Encrypt multiple times on the email address they used for ACME registration. Let's Encrcypt were chasing donations and were promptly told where to stick it with their unsolicited communications. Let's Encrypt also did zero research about who they were targetting, i.e. trying to get a small company to shell out $50k as a "donation". My friend was of the opinion is that if you're going to charge, then charge, but don't offer it for free and then go looking for payment via the backdoor. In a business environment getting a donation approved is almost always an entirely different process, involving completely different people in the company, than getting a product or service purchase approved. Even more so if, like Let's Encrypt, you are turning up on the doorstep asking for $50k a pop.
  • jfindper 10mo ago
    >one day they started getting hounded by Let's Encrypt multiple times >trying to get a small company to shell out $50k as a "donation". >Even more so if, like Let's Encrypt, you are turning up on the doorstep asking for $50k a pop. Does your friend have anything to corroborate this claim? Perhaps the email with identifying details censored? I have a received an occasional email mentioning donations. They are extremely infrequent and never ask me for a specific amount. I would be incredibly surprised to see evidence of "hounding" and requests for $50,000.
    • traceroute66 10mo ago
      All the usual phishing checks were done if that's what you're thinking. In terms of the actual mail with identifying details removed, I'd have to go back and ask. I did look before posting here as I thought they had already forwarded it to me, but it was last year, so I have almost certainly cleaned up my Inbox since. I'm not an Inbox hoarder.
  • cjaybo 10mo ago
    “They sent a few emails soliciting donations” isn’t exactly a horror story in my experience. Seems hardly worth mentioning!
• btown 10mo ago
  To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices! https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar...
  • yabones 10mo ago
    Call me old-school, but I really liked how EV certs looked in the browser. Same with the big green lock icon Firefox used to have. I know it's all theatrics at best and a scam at worst, but I really feel like it's a bit of a downgrade.
    • wnevets 10mo ago
      > Call me old-school, but I really liked how EV certs looked in the browser. I agree, making EV Certs visually more important makes sense to people who know what it means and what it doesn't. Too bad they never made it an optional setting.
      • arccy 10mo ago
        i think the point was that EV didn't actually mean anything because the checks were too loose. it's a feel good false sense of security
      • RonanSoleste 10mo ago
        When you request an EV. They call you by the phone number that you give to ask if you requested a certificate. That was the complete extend of the validation. I could be a scammer with a specificity designed domain name and they would just accept it, no questions asked.
        • brians 10mo ago
          Having run an EV issuing practice… they were required to contact you at a D&B listed number or address.
• qwertox 10mo ago
  I once notified Porsche that one of their websites had an expired certificate, they fixed it within a couple of hours by using Let's Encrypt. It surprised me. Let's Encrypt is to the internet what SSDs are to the PC. A level up.
  • mdnahas 10mo ago
    An apt metaphor, … until I read recently on HN that storage on SSDs only last 1 year when unplugged. https://news.ycombinator.com/item?id=46038099 https://news.ycombinator.com/item?id=46038099
    • roelschroeven 10mo ago
      Let's Encrypt certificates last even only 90 days when unplugged.
• xxmarkuski 10mo ago
  I have heard, but do not aggree, that Let‘s Encrypt is risky, because phishing sites use it. It’s implied that other CAs do checks against it.
  • anonymars 10mo ago
    I will say, I have never before this season seen so many seemingly-legit fake web stores. All with their little lock icons in the address bar. I assume LLMs helped kick it into overdrive too
    • array_key_first 10mo ago
      Conflating transport-layer encryption with authenticity is the problem. The former should always be standard, the latter is unrelated and IMO needs a different mechanism.
      • kbolino 10mo ago
        Absent widespread adoption of DNSSEC, which has just not happened at all, I don't see any alternative. The authentication must be done before the encryption parameters are negotiated, in order to protect against man-in-the-middle attacks. There must be some continuity between the two as well, since the authenticated party (both parties can be authenticated, but only one has to be) must digitally sign its parameters. Any competing authentication scheme would therefore have to operate at a lower layer with even more fundamental infrastructure, and the only thing we've really got that fits the bill is DNS. EDIT: A standard exists for this already, it's called DANE, though it has very little support: https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
        • anonymars 10mo ago
          This applies to grandparent too (for the record I largely agree with them) but the issue isn't just "authenticity" but "identification" -- there's no real attestation about who is in on the other end of the site. This identity was once at least somewhat part of the certificate itself.
• winternett 10mo ago
  Many host providers (Those acquired by companies like Web.Com, allegedly) disable all ability to use outside certs since Google made encryption a requirement in Chrome Browser... They do things like blocking containers & SSH to make installing free certs impossible. They also have elevated the price of their own certs (that they can conveniently provide) to ridiculous prices in contrast to free certs their customers can't even use... It would be a huge price-fixing scandal if Congress had any idea of how technology works.
  • Sohcahtoa82 10mo ago
    There are literally thousands of web hosts out there. If your web host is doing something shitty like that, it's trivial to find a new one.
    • winternett 10mo ago
      I'd be happy to hear about a traditional hosting company that allows clients to install lets Encrypt certs if you can name any... Most of my clients don't have budgets big enough for cloud hosting.
      • Sohcahtoa82 10mo ago
        DreamHost allows it. Not only do they just allow you to import any certificate you want, but they literally have a button on the panel to get one from Let's Encrypt for free.
  • selcuka 10mo ago
    > It would be a huge price-fixing scandal if Congress had any idea of how technology works. It's shady, but technically not price-fixing unless they are a monopoly. You are free to take your business to somewhere else.
    • winternett 10mo ago
      If you read into Web.Com, yes, they are quickly becoming a monopoly on host companies. They do not disclose many of the hosting companies they now own. If you can find a company that allows clients to install Let's Encrypt Certs on shared hosting, please let me know.
• hk1337 10mo ago
  The only pain point I had using letsencrypt, and it wasn 100% not their fault, was I tried using it to generate the certificate to use with FTPS authentication with a vendor. Since LE expires every 90 days and the vendor emails you every week when you’re 2 months from expiring, that became a pain point and it wasn’t easier to just by a 1 or 2 year cert from godaddy. Thank goodness that vendor moved to sftp with key authentication so none of that is needed anymore
• accrual 10mo ago
  Seconding the effect of Let's Encrypt on the world of TLS. I remember getting into web applications in the late 2000s and rolling my own certificates/CA and it was a huge, brittle pain. Now it's just another deployment checkbox thanks to LE.
• merpkz 10mo ago
  I have also heard a negative about it being somehow "cheap" and we can "afford" a proper wildcard for our website from managers back in the day, like, few years ago. Never mind the hours wasted every year changing that certificate in every system out there and always forgetting a few. Also a valid point from security people is that you leak your internal hostnames to certificate transparency lists once you get a cert for your "internal-service.example.com" and every bot in existence will know about it and try to poke it. I solved these problems by just not working with people like that anymore and also getting a wildcard Let's Encrypt it certificate for every little service hosted - *.example.com and not thinking about something being on the list anymore.
• rkagerer 10mo ago
  Old browsers on old hardware without its CA baked in.
• dustedcodes 10mo ago
  > The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". Spoken like a true dinosaur. How can a certificate based on open, public and proven secure protocols be cheap? > So my question: has anyone actually commented to you in a negative way about using Let's Encrypt? No, but I personally judge businesses which claim to be tech savvy if they don’t have an ACME issued certificate, because to me that instantly shows I’m not dealing with someone who has kept up with technology for the last 10 years.
  • jjice 10mo ago
    Yeah you've correctly identified the mindset there that the leadership had in my case. They didn't want to upgrade to an in-support version of MySQL either...
• jwr 10mo ago
  Modern browsers are going out of their way to hide every bit of information about the website (including even the URL) — so I don't know how these customers would actually even find out what CA issued the certificate. In Safari, I don't even know how to find that information anymore. When I want to check expiration dates for my own sites, I start Firefox.
  • bob778 10mo ago
    It’s the symbol to the left of the URL > Show Certificate. They even make it available on iOS Safari (Page Info > Connection Security Details), but if it’s expired, you’ll know by the big red warning page.
    • jwr 10mo ago
      I don't have that :-) — what I see when I click the thingamajig on the left side of the URL is a menu with "Hide Distracting Items", "Zoom", "Find" and "Website settings".
      • loloquwowndueo 10mo ago
        For me it’s hidden behind a kebab menu in that thingamajig you described.
        • jwr 10mo ago
          Well, either it isn't there in my Safari (macOS 15.7.2) or I can't find it. I have found "Connection Security Details…" in the "Safari" menu, though. But my point still stands: average users won't see any certificate information without serious effort.
          • loloquwowndueo 10mo ago
            Ah no, i am on iOS 26.
• raxxorraxor 10mo ago
  I only hear justified praises of letsencrypt. Also thanks to the EFF and developers of certbot, which massively improved the toolchain around certificate deployment. Not the favorite activity for admins, but this made processes like certificate renewal/revokation much more convenient. I think the portion of users that check a certificate after the browser treated it as secure is well smaller than 1%, probably well below 0.1%. And I guess these TLS connoisseurs have a positive inclination to letsencrypt as well.
• Keyframe 10mo ago
  has anyone actually commented to you in a negative way about using Let's Encrypt? I couldn't imagine, but curious on others' experiences. One thing I heard recently which might be a valid point - that LE is based in US, which makes it a subject to US laws. Read from that what you will though.
  • dns_snek 10mo ago
    Why is that problematic? They don't have your private keys and their "level of access" is equivalent to any other certificate authority that your browser trusts.
    • anticrymactic 10mo ago
      > Why is that problematic? They don't have your private keys and their "level of access" is equivalent to any other certificate authority that your browser trusts. Let's Encrypt could stop issuing certificates to you, if the administration decided that necessary. This would at least disrupt whatever you were serving. Not that I think this is likely, only possible. I think LE clealy demonstrated the need for a accessible free ACME authority. But it is high time for more alternatives (EU and China at least). FWIW: Everything around public infrastructure should be run decentralized not-for-profit using national resources. Things like DNS Registrars are silly if you think about it. They just buy it from TLD holders anyway.
  • voxic11 10mo ago
    No matter where they were based they would be subject to US laws since they offer services to US peoples. (similar to how everyone here always points out that US companies are subject to EU laws if they offer services in the EU).
• spjt 10mo ago
  > Let's Encrypt was _huge_ in making it's absurd to not have TLS I still find it too much of pain in the ass to deal with to justify for my personal stuff. Easier to just click through the warning every time.
• 1123581321 10mo ago
  I used to deal with a couple people who were against any automatic or free certs. It was part of their jobs to procure the annual certs, look them over, present them to the developers and maintain automatic checks to regularly inspect the certificates. This was partly how they justified their jobs, but they relished the ceremony and being able to tell developers what to do, even if only for a few minutes a year. They repeatedly blocked introduction of LetsEncrypt. Just checked. They’re still using that manually installed cert!
• konfekt 10mo ago
  They may have rendered absurd to not have TLS, but they also rendered certification absurd, in the sense that all you get is little more than encryption: if you care about identity, then the free Let's Encrypt certificate coupled to a domain owner's email address gives you little guarantee. Compare this to the extended validation certificates with personally certified credentials and browsers attesting these by, say, a green address bar (instead of today's flat padlock), that a bank customer expects before entering their login data. Setting up an encrypted web-domain with continual Let's Encrypt certificate renewal has become tedious cargo-culting around the relicts of the idea of a certificate that establishes trust by identity verification. The collapse of identity-based certification is not Let’s Encrypt’s fault. People naturally choose the easiest option, and Let’s Encrypt supplied it. Entrusting a handful of commercial certificate authorities with global identity is dubious on first principles anyway, but at least they tried; yet, for all its flaws, that centralized system has proven more practical than the idealistic, decentralized "web of trust".