Slashdot Mirror
"Let's Encrypt" Project To Issue First Free Digital Certificates Next Month
An anonymous reader writes: Let's Encrypt, the project that hopes to increase the use of encryption across websites by issuing free digital certificates, is planning to issue the first ones next month. Backed by the EFF, the Mozilla Foundation, the Linux Foundation, Akamai, IdenTrust, Automattic, and Cisco, Let's Encrypt will provide free-of-charge SSL and TSL certificates to any webmaster interested in implementing HTTPS for their products. The Stack reports: "Let's Encrypt's root certificate will be cross-signed by IdenTrust, a public key CA owned by smartphone government ID card provider HID Global. Website operators are generally hesitant to use SSL/TLS certificates due to their cost. An extended validation (EV) SSL certificates can cost up to $1,000. It is also a complication for operators to set up encryption for larger web services. Let's Encrypt aims to remove these obstacles by eliminating the related costs and automating the entire process."
StartSSL has already been doing this. I believe Let's Encrypt real goal is to make the deployment and unkeep easier?
I wonder how this differs from the existing free offerings provided by cacert.org.
Let's Encrypt, a division of Shell Company, LLC., a wholly-owned subsidiary of Totally Not The NSA, Inc.
Why should I trust that?
“He’s not deformed, he’s just drunk!”
If you're on shared hosting, you should get off ASAP. I used to have a few sites on shared hosting and we'd either a) be impacted by other users using too many resources or b) be threatened with disconnection by the host for using too many resources. The sites were small and not using that much in the way of resources, but shared hosting is tossing a thousand people into a pool and then kicking out the ones who try to swim the slightest bit. The hosts can do this because they know that there's a line of people ready to jump in to take the place of those kicked out.
Instead of going the shared hosting route, get a Virtual Private Server. It won't set you back that much. I pay $34 a month - and that's for managed hosting, unmanaged is much cheaper if you're comfortable managing the server yourself. Yes, this is more money than the $2 a month for "unlimited" space/bandwidth shared hosting, but you'll actually get what you pay for instead of being crammed together with a thousand other sites on an overloaded server.
(You could get a Dedicated Server, but these cost a lot more and only make sense for the biggest of websites. Get a VPS first and if your site grows to the point that it needs a dedicated box, then congrats.)
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Slashdot could cough up the money for an SSL cert. So why isn't all Slashdot traffic encrypted then?
Maybe it will be enough to get you guys at Slashdot to do it! ;-)
How do they verify you're not hijacking a Web site? What if you block HTTPS (there's no https server!) and submit CSR, and it tries to verify a cookie on the associated HTTP site, which you're MITM and so replace by inserting your cookie?
Support my political activism on Patreon.
I prefer the VPS route, just because it gives some separation of data between myself and others. A shared hosting provider may have things (mis)configured to where a simple change in directory might allow another user access (if not modification) to my stuff, especially if they happen to find a way to get a shell.
Of course, VPSes are not perfect -- they can get hacked, but one has the ability to add 2FA and other items if need be.
Of course, there is one drawback... a lot of VPS sites don't allow you to set a cap on bandwidth used, so a DDoS might cost one dearly in money.
Which is fine, because you never share your private key with them anyway.
Probably why they're building tools that work with apache and nginx to automate the certificate bollocks.
I don't see how cost is an issue nowadays. At $5 a year anyone with a domain name and hosting can easily afford that. EV's are $150 a yr, not cost prohibitive for those that need them. Let's Encrypt doesn't even support EV so not sure why it is even brought up as a comparison.
The convenience of Let's Encrypt is nice however I don't see how most people can take advantage of this. It is a proxy daemon running on the server. So it needs to be installed and configured by the administrator of said server. It also takes over port 443 as a proxy adding extra overhead but more importantly a layer of insecure transmission.
I would like to see it (and I'm sure we will) as a cPanel and Plesk addon so users can easily add their certificates to their servers current configuration. Then I will see it as being very useful to the majority of people that don't have SSL certificates already installed. Since it is not the cost, but ease of use.
There are problems with shared hosting, but this isn't one of them. That's a problem with specific shared hosting vendors. HostGator for one will install a cert for you that you bought somewhere else, or at least they used to.
VPSs have exactly the same situation. You end up on an overloaded host with other VPSs hogging CPU and bandwidth like crazy, and they hate you if YOU use too much.
Where the VPS wins is that you have your own IP, so other users can't get that IP blacklisted (unless the whole block gets blacklisted).
Which is why you choose a VPS provider who offers unlimited bandwidth. They exist, and they are the only safe VPSs to run.
VPS has the same problem as shared hosting amongst the majority, especially the 'cheap' VPS. Shared hosting == VPS and Shared Hosting is way more resource-friendly to the hosting company.
A good VPS is nicer to have than a shared host because you're (generally) not locked to a specific operating system or software stack but if you're just doing static or simple PHP content you may be better off with a good shared host than a similar cost VPS.
Custom electronics and digital signage for your business: www.evcircuits.com
There is still the problem of shared hosting where they force you to use their own certificates which aren't free.
If you're referring to HostGator and their ilk:-
You can rent an SSD based VPS in the country of your choice, and host half a dozen sites on it for around the same price (each). If you need cPanel maybe you shouldn't be thinking about running a site that needs SSL.
P.S. Real "unlimited" is only available on services run by the Easter Bunny and Santa Claus - as you'll find out if you ever get any real traffic on those cheap shared hosting sites.
a lot of VPS sites don't allow you to set a cap on bandwidth used
Can you expand on that please? What VPS manages to over-ride basic Linux bandwidth and quota tools - and what mechanism enables them to do this? Certainly I've never had any problems setting quota and limiting bandwidth for virtual hosts on any of our VPS - across a wide range of different providers. Likewise QoS.
Regular SSL certificates aren't that expensive. The EV certs are a ripoff. Unfortunately, Lets Encrypt will not support EV.
http://lowendbox.com/?s=unmetered&searchsubmit=Find
That's not the full truth, it's Bullshit. Yes there are no shortage of companies claiming to offer unlimited and unmetered. But claims and reality are different things. Try testing it (or read the fine print). If you like I'm happy to prove that to you any time you like. I'll supply the public key, you supply the ssh login and configure the proxy, and I'll see how many hours it takes before your default web page gets changed to a notice from your unlimited/unmetered host or they choke your bandwidth to a trickle.
And yes - I've used the VPSCheap offer - it took two hours before they choked the unmetered 1000MB bandwidth down to 15MB and sent us a warning email. Maybe you didn't read the weasel fineprint (VPSCheap.NET INC makes no warranties of any kind, expressed or implied for services we provide.)on the Terms of Service or simply failed to check your facts. It's not unreasonable - bandwidth isn't free, what's unreasonable is offering something they won't deliver.
Warning: they won't honor the 30 days money back when they fail to deliver either.
Before you cry "you must of been doing something illegal"... a promise is a promise. And no, just OpenStack and virtualbox images from our e2, and video streams from remote monitoring sites - all perfectly legal.
P.S. Google isn't a real university, and just because you can read a web page doesn't make you less uninformed.
Where the VPS wins is that you have your own IP
How many people can have a VPS at the same time when we're already essentially out of IPv4 addresses?
Because historically, ad networks have not supported TLS. Running HTTP ads on an HTTPS site will get blocked as "mixed active content". The first major ad network to deploy TLS was Google AdSense in September 2013, roughly thirteen years after SSL/TLS entered the public domain. Slashdot used to offer subscriptions and make HTTPS available to subscribers, but those are no longer available for some vague reason.
The ad network that Slashdot uses would have to support HTTPS first.
... a free PSK.
now we need to go OSS in diesel cars
Seriously? What are they contributing? Proprietary blobs? Screen Doors?
Can these certs be used for S/MIME authentication, or could they be used to generate personal certs for S/MIME?
We're started using S/MIME extensively at my office, and I'd like to be able to do it at home... it seems significantly easier than using PGP.
- chrish