3 ms·

This is a pretty bold move, but I like the intent behind it. Hopefully Mozilla can pull it off without causing any problems for normal users. Presumably it wil

by rossng 11y ago

This is a pretty bold move, but I like the intent behind it. Hopefully Mozilla can pull it off without causing any problems for normal users. Presumably it will all be synced with their plans to launch a free CA[1] in the near future. [1] https://letsencrypt.org/ https://letsencrypt.org/

NeutronBoy 11y ago
One thing I've never been able to figure out from Let's Encrypt's website - will you be able to get a certificate, without hosting your own instance? Or will it be limited to servers you can actually install their program on? Also, I assume they'll get the root CA included by all major vendors/browsers?
- 15155 11y ago
  > will you be able to get a certificate, without hosting your own instance > limited to servers you can actually install their program on They did a bit of Q&A on HN or Reddit a while back, and it seems like you can use them in various capacities, but you'll certainly be able to get your certs signed without using their suite (and use them with the software of your choosing). > Also, I assume they'll get the root CA included by all major vendors/browsers? IIRC they're having another CA cross-sign.
- teraflop 11y ago
  You need to be able to prove ownership of a domain in order to get a certificate. CAs already require this; the "lets-encrypt" command line tool just implements a challenge-response protocol for doing it automatically. But you could implement the same protocol yourself, as long as your platform allows you to either serve the response from a well-known path at the desired domain, or add it as a TXT record in DNS.
- schoen 11y ago
  You don't have to run the Let's Encrypt client, but you do have to be able to do things to prove that you control the domain. Currently the Let's Encrypt client assumes that it's being run on the same machine on which domain control will be proved (though not necessarily the same machine where the cert will eventually be deployed). Someone could write another client application which gives instructions to complete the challenges manually, which is a feature that's occasionally requested. The CA will be cross-signed by IdenTrust, which is accepted by mainstream browsers, so those browsers will also accept the certs we issue.
  - NeutronBoy 11y ago
    Specifically I'm thinking about current procedures to verify domains - either it's through your registrar (in which case you're golden), or an alternative like adding a specific key to a TXT record, or uploading a particular file to the domain root.
  - vtlynch 11y ago
    So you don't have to run the Let's Encrypt client? I was under the impression you did because without running the client there was no way to communicate with the Let's Encrypt service? Or do you mean, you can have multiple servers and only need to run the client on one of them?
    - schoen 11y ago
      I mean that you need to run some client software, but it doesn't have to be the client software we're writing. Other people can implement ACME, for example in hosting provider infrastructure or in server software or other configurations. There could be an ACME client where the verification steps indicated to the user are performed manually rather than automatically. You could probably even speak ACME with curl, although quickly generating valid JSON objects that contain valid cryptographic signatures might be a bit challenging. :-) It's also right that you can have multiple servers and only run the client on one of them, if you're willing to copy key material from one server to another.
      - vtlynch 11y ago
        Ah gotcha! Thanks for clarifying.

by rossng 11y ago

NeutronBoy 11y ago

One thing I've never been able to figure out from Let's Encrypt's website - will you be able to get a certificate, without hosting your own instance? Or will it be limited to servers you can actually install their program on? Also, I assume they'll get the root CA included by all major vendors/browsers?

15155 11y ago
> will you be able to get a certificate, without hosting your own instance > limited to servers you can actually install their program on They did a bit of Q&A on HN or Reddit a while back, and it seems like you can use them in various capacities, but you'll certainly be able to get your certs signed without using their suite (and use them with the software of your choosing). > Also, I assume they'll get the root CA included by all major vendors/browsers? IIRC they're having another CA cross-sign.
teraflop 11y ago
You need to be able to prove ownership of a domain in order to get a certificate. CAs already require this; the "lets-encrypt" command line tool just implements a challenge-response protocol for doing it automatically. But you could implement the same protocol yourself, as long as your platform allows you to either serve the response from a well-known path at the desired domain, or add it as a TXT record in DNS.
schoen 11y ago
You don't have to run the Let's Encrypt client, but you do have to be able to do things to prove that you control the domain. Currently the Let's Encrypt client assumes that it's being run on the same machine on which domain control will be proved (though not necessarily the same machine where the cert will eventually be deployed). Someone could write another client application which gives instructions to complete the challenges manually, which is a feature that's occasionally requested. The CA will be cross-signed by IdenTrust, which is accepted by mainstream browsers, so those browsers will also accept the certs we issue.
- NeutronBoy 11y ago
  Specifically I'm thinking about current procedures to verify domains - either it's through your registrar (in which case you're golden), or an alternative like adding a specific key to a TXT record, or uploading a particular file to the domain root.
- vtlynch 11y ago
  So you don't have to run the Let's Encrypt client? I was under the impression you did because without running the client there was no way to communicate with the Let's Encrypt service? Or do you mean, you can have multiple servers and only need to run the client on one of them?
  - schoen 11y ago
    I mean that you need to run some client software, but it doesn't have to be the client software we're writing. Other people can implement ACME, for example in hosting provider infrastructure or in server software or other configurations. There could be an ACME client where the verification steps indicated to the user are performed manually rather than automatically. You could probably even speak ACME with curl, although quickly generating valid JSON objects that contain valid cryptographic signatures might be a bit challenging. :-) It's also right that you can have multiple servers and only run the client on one of them, if you're willing to copy key material from one server to another.
    - vtlynch 11y ago
      Ah gotcha! Thanks for clarifying.