4 ms·

We are desperately looking forward to this being available so we can SSL all our dev sites and still be able to test them on our phones (which are a bit hard to

We are desperately looking forward to this being available so we can SSL all our dev sites and still be able to test them on our phones (which are a bit hard to get one's own CA cert onto).

michaelt 11y ago
It sounds like Lets Encrypt is going to require a site to be publicly available for them to give out a cert for it. They'll tell you to put a certain file at a certain location to demonstrate that you control the domain. So unfortunately it'll only help with your dev sites if they're available on the public internet.
- teddyh 11y ago
  No, that is only one of the four methods of proving domain ownership; see the ACME protocol specification: https://letsencrypt.github.io/acme-spec/#rfc.section.6 https://letsencrypt.github.io/acme-spec/#rfc.section.6
  - schoen 11y ago
    However, the methods described there that don't involve a domain validation step all specify prior ACME usage; that is to say that at least the first time you get a cert from an ACME CA with policies akin to those described here, you must always complete a DV step with DVSNI or Simple HTTP (which do require a publicly-visible server with a publicly-visible domain name).
    - teddyh 11y ago
      What about the method in section 6.4: DNS? That certainly does not require either a prior ACME usage or a publicly-visible server.
      - schoen 11y ago
        That's a good point. I don't expect the Let's Encrypt CA will be willing to help keep servers (or certs issued to them) a secret -- for example, the certs are likely to be published in Certificate Transparency! -- but you're right that the ACME DNS challenge doesn't require the server to be publicly accessible and doesn't even require the underlying subject name to exist in the publicly-visible DNS.
- davidgerard 11y ago
  The particular use case is the exposed external version that we can test on a phone, so that's fine :-)
ptman 11y ago
Until letsencrypt goes live: https://buy.wosign.com/free/ https://buy.wosign.com/free/
- davidgerard 11y ago
  So ... who are they and why should I trust them?
  - ptman 11y ago
    No reason to trust them, but your browser most likely does.
    - davidgerard 11y ago
      Point :-)

We are desperately looking forward to this being available so we can SSL all our dev sites and still be able to test them on our phones (which are a bit hard to get one's own CA cert onto).

michaelt 11y ago

It sounds like Lets Encrypt is going to require a site to be publicly available for them to give out a cert for it. They'll tell you to put a certain file at a certain location to demonstrate that you control the domain. So unfortunately it'll only help with your dev sites if they're available on the public internet.

teddyh 11y ago
No, that is only one of the four methods of proving domain ownership; see the ACME protocol specification: https://letsencrypt.github.io/acme-spec/#rfc.section.6 https://letsencrypt.github.io/acme-spec/#rfc.section.6
- schoen 11y ago
  However, the methods described there that don't involve a domain validation step all specify prior ACME usage; that is to say that at least the first time you get a cert from an ACME CA with policies akin to those described here, you must always complete a DV step with DVSNI or Simple HTTP (which do require a publicly-visible server with a publicly-visible domain name).
  - teddyh 11y ago
    What about the method in section 6.4: DNS? That certainly does not require either a prior ACME usage or a publicly-visible server.
    - schoen 11y ago
      That's a good point. I don't expect the Let's Encrypt CA will be willing to help keep servers (or certs issued to them) a secret -- for example, the certs are likely to be published in Certificate Transparency! -- but you're right that the ACME DNS challenge doesn't require the server to be publicly accessible and doesn't even require the underlying subject name to exist in the publicly-visible DNS.
davidgerard 11y ago
The particular use case is the exposed external version that we can test on a phone, so that's fine :-)

ptman 11y ago

Until letsencrypt goes live: https://buy.wosign.com/free/ https://buy.wosign.com/free/

davidgerard 11y ago
So ... who are they and why should I trust them?
- ptman 11y ago
  No reason to trust them, but your browser most likely does.
  - davidgerard 11y ago
    Point :-)