- cross-posted to:
- selfhosted@lemmy.world
- cross-posted to:
- selfhosted@lemmy.world
Happy birthday to Let’s Encrypt !
Huge thanks to everyone involved in making HTTPS available to everyone for free !
You must log in or register to comment.
That’s very great news! Thank you for all the good work!
Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as “it’s not as secure as a traditional CA”.
I’d love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs
I’m sad to say that all my sites where http only until 10 years ago
Lots of people shitting on stories of people who buy certs.
You do still have to buy a cert if you want one for a .onion. Let’s encrypt still doesn’t support it :(
I’m also having to manually cert every 3 months for my emby instance. It’s a minor inconvenience, but I’m definitely tempted to just buy a yearly.
It doesn’t say on the website but on their anniversary day they are giving away unlimited ssl certs!
Well, they do rate limit
A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.
I love it when companies are too stubborn to update their costs despite the necessity changing over the years.
My previous employment kept buying microsoft office license keys despite us already moving to 365. They probably did it out of habit when buying new computers. Needless to say I have a cardstack of license keys at home lol. Granted it’s for Office 2013 but I don’t really need the latest version for basic document processing.
Private sector is more efficient my ass
Sleeping too well lately? Consider this:
If LetsEncrypt were to suffer a few weeks outage, how much of the internet would break?
If you have a fully automated setup. Youll have 30 days to mitigate the fallout.
Can anyone fill me on this? Why is it so significant?
HTTPS certs used to be very expensive and technically complicated, making it out of reach for most smaller orgs. Let’s Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.
It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn’t have been so omnipresent.
And it shouldn’t have been, SSL PKI is an intentionally rigged architecture. It’s intended for nation-states to be able to abuse it.
I’d like much more some kind of overlay encryption over HTTP based on web of trust and what not. Like those distributed imageboards people were trying to make with steganography in emotion.
It’s a trap. Everybody is already in it and it has already been activated, so - the discussion would be of historical interest only.
And my parents still buy SSL certs because that’s just what they know 🤢
My last cert renewal was $20 for 3 years. That’s less than a dollar a month, not exactly breaking the bank.
Today it’s just more or less stupid to buy SSL you can get one extremely easy for free from Let’s Encrypt or Google Trust…
I’ve tried explaining to them before, but they think that it’s a scam because it’s free lol
Yeah, I uh…I think that’s kinda what this whole conversation here is about
SSL Certs were so god awful before certbot that it’s hard to explain now that it’s so easy and free.
Also fucking expensive
Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let’s Encrypt.
I probably need more positivity in my life 😂
Underrated. Stuff rocks.
Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.
And it changed the Internet, for good and a lot.
Let’s Encrypt is amazing, but are there any equally trustworthy alternatives people could switch to if something bad happens to it?
They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it’s so difficult and expensive.
Well, it’s difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.
Correct me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.
The impact is serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.
It doesn’t improve encryption compared to a self-signed cert though.
If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It’s effectively allows MITM for any certificate. Worse, it’s not even limited to certificates under that CA. The browser has no way of knowing there’s 2 “valid” certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is a possibility).
Certificate pinning might save things, since that will force the same certificate as was previously used, but I’m not sure this is a common default.
If it begins to enshitify, someone will quickly take up the helm. It’s become so core now that someone like Cloudflare would just be like “We do this now.”
Cloudflare sort of provides this now by being a MITM to secure your site between your server and the end user. But this requires you and your end user to trust Cloudflare.
And fwiw the ACME protocol is open so anyone can implement it. I believe even the ACME software that EFF sends out allows you to choose your server with some configuration.
Maybe ZeroSSL
They don’t offer wildcard certs, but otherwise I think they are.
I wanna say acme.sh defaults to them.Never used them, but they state at https://zerossl.com/features/acme/ that their free acme certs include wildcards.
Yes, seems you are right. Not sure where I got the impression.
Unrelated, when I researched this I saw that acme.sh, zerossl, and a bunch of other acme clients are owned by the same entity, “Stack Holdings”/“apilayer.com”. According to this, zerossl also has some limitations over letsencrypt in account requirements and limits on free certificates.
By using ZeroSSL’s ACME feature, you will be able to generate an unlimited amount of 90-day SSL certificates at no charge, also supporting multi-domain certificates and wildcards. Each certificate you create will be stored in your ZeroSSL account.
It is suspicious that they impose so many restrictions then waive most on the acme api, where they presumably could not compete otherwise. On their gui they allow only 3 certificates and don’t allow multi-domain at all. Then even in the acme client they somehow push an account into the process.
[…] for using our ACME service you have to create and use EAB (External Account Binding) credentials within your ZeroSSL dashboard.
EAB credentials are limited to a maximum per user/per day. [This might be for creating them, not uses per credential, unsure how to interpret this.]
This all does make me slightly worry this block around apilayer.com will fall before letsencrypt does.
Other than letsencrypt and zerossl, this page also lists no other full equivalents for what letsencrypt does.
