j4cob

4 ms·

1.
by j4cob 5y ago
Wow, thank you for all of your work on Sensei's Library! It made a huge impression on me in ~2003, and has really helped me understand Go better and get stronger. I work on Let's Encrypt. I'm glad you find the service useful!
2.
ETS Isn't TLS and You Shouldn't Use It(eff.org)
224 points by j4cob 8y ago|109 comments
3.
by j4cob 8y ago
Folks may also be interested to read this useful summary of issues around locally installed roots: https://github.com/njh/dymo-root-ca-security-risk/blob/maste...
4.
by j4cob 8y ago
The implicit threat model here is "no one outside your machine can do something to you to make 127.0.0.1 traffic route elsewhere." It's true that software running on your machine can make copies of things and send them elsewh
5.
by j4cob 8y ago
FYI, OpenSSL has a new flag that makes the "-extensions" part somewhat simpler, but most people won't have it in their copy yet: https://github.com/openssl/openssl/pull/4986
6.
by j4cob 10y ago
For your use case, I'd recommend that you either combine them using SAN certificates, as one commenter suggested, or issue them over the span of a few weeks. Processing rate limit requests is one of the few non-automated tasks we do, a
7.
by j4cob 10y ago
(Let's Encrypt engineer) > large organisations (I'm sure there are more than 20 sites run under .mit.edu sites by different teams who wouldn't want to share multi-name certificates); This is why we've added a form to
8.
by j4cob 10y ago
(Let's Encrypt engineer) Token bucket is a good idea, and I agree that it would make the user experience of hitting rate limits less onerous. We implemented sliding windows because they were straightforward to implement based on our lo
9.
by j4cob 10y ago
FWIW, cPanel just announced Let's Encrypt integration with their AutoSSL feature: https://blog.cpanel.com/announcing-cpanel-whms-official-lets...
10.
Let's Encrypt Enters Public Beta(eff.org)
9 points by j4cob 11y ago|1 comments
11.
by j4cob 11y ago
This was a performance decision. Cross-signing the root instead of the intermediate would mean that web servers would have to include both the root and the intermediate in the chain they serve, rather than just the intermediate. That would