Slashdot Mirror

← Back to Stories (view on slashdot.org)

"Let's Encrypt" Project To Issue First Free Digital Certificates Next Month

Posted by samzenpus on from the protect-ya-neck dept.

An anonymous reader writes: Let's Encrypt, the project that hopes to increase the use of encryption across websites by issuing free digital certificates, is planning to issue the first ones next month. Backed by the EFF, the Mozilla Foundation, the Linux Foundation, Akamai, IdenTrust, Automattic, and Cisco, Let's Encrypt will provide free-of-charge SSL and TSL certificates to any webmaster interested in implementing HTTPS for their products. The Stack reports: "Let's Encrypt's root certificate will be cross-signed by IdenTrust, a public key CA owned by smartphone government ID card provider HID Global. Website operators are generally hesitant to use SSL/TLS certificates due to their cost. An extended validation (EV) SSL certificates can cost up to $1,000. It is also a complication for operators to set up encryption for larger web services. Let's Encrypt aims to remove these obstacles by eliminating the related costs and automating the entire process."

12 of 97 comments (clear)

  1. StartSSL ? by Anonymous Coward · · Score: 5, Informative

    StartSSL has already been doing this. I believe Let's Encrypt real goal is to make the deployment and unkeep easier?

    1. Re:StartSSL ? by bitwise+counselor · · Score: 5, Informative

      StartSSL has already been doing this. I believe Let's Encrypt real goal is to make the deployment and unkeep easier?

      StartSSL offers free certificates for non-commercial use only, and they charge more than a certificate from another CA to revoke your certificate ($24.90 ATM).

    2. Re:StartSSL ? by viperidaenz · · Score: 4, Informative

      letsencrypt doesn't plan on offering wildcard certs initially. They may do so later.

      Why this /. post links to a no-name news website instead of https://letsencrypt.org/ I don't know... that information was readily available in their FAQ.

    3. Re:StartSSL ? by Anonymous Coward · · Score: 3, Interesting

      StartSSL are free for commercial use. The don't charge to revoke their paid EV certs. The revocation thing really is a bad policy but to be fair you can get around it by just applying for a new cert for a different subdomain - and they encourage you do this in their documentation. The certs are valid for the domain itself and the subdomain need not exist. Non-EV certs are typically only employed for encryption rather than validation purposes so this is a fine solution as long as you host your site on the domain itself.

    4. Re:StartSSL ? by Lennie · · Score: 3, Informative

      "So now there is another option: The Chinese CA WoSign offers free SSL certificates which are valid for 2 years and may contain up to 100 domains each (multi-domain/SAN/UCC)"

      https://buy.wosign.com/free/
      https://www.ohling.org/blog/20...

      --
      New things are always on the horizon
    5. Re:StartSSL ? by Martin+Blank · · Score: 3, Informative

      They do some basic research on the domain to see if there are commercial aspects. I've had two domains that are entirely non-commercial turned down because they were allegedly found to be commercial. (When I protested, they had me go back through the validation process and then let them pass.)

      --
      You can never go home again... but I guess you can shop there.
  2. Grand opening! by Krishnoid · · Score: 4, Funny

    Let's Encrypt, a division of Shell Company, LLC., a wholly-owned subsidiary of Totally Not The NSA, Inc.

    1. Re:Grand opening! by Frobnicator · · Score: 5, Informative

      Let's Encrypt, a division of Shell Company, LLC., a wholly-owned subsidiary of Totally Not The NSA, Inc.

      You seem to misunderstand the purpose and nature of these certificates. While it is fun as a joke, that isn't what it is for.

      These certificates never have been meant to protect against either government agencies or against employers. It has always been known by security geeks that any intermediate actor in the chain can eavesdrop and can intercept the connection. That is not what they protect against. They protect by revealing the links in the chain.

      SSL is intentionally vulnerable for those implementing a MitM attack, and many businesses and schools implement this. Quite a few major networking products have simplified MitM down to the point of simply hitting a checkbox. One of the biggest corporate reasons for this is to enable caching.

      SSL is absolutely vulnerable to being (eventually) deciphered by anyone who eavesdrops, and is vulnerable to being modified by any person holding a matching cert for any point on the certificate's security chain. There are many accounts that major governments already have copies of those critical points.

      So what does it offer? The most immediate benefits are replay prevention and an integrity guarantee. Imagine if an attacker recorded a session of you logging into your bank and transferring funds. Without replay protection, and with no other replay protections by the bank, an attacker could replay the transaction over and over and over again, draining your bank account. Since both client and server theoretically offer unique session keys for each session they cannot be replayed. The integrity guarantee is also important, meaning that once your connection is established, those monitoring your connection cannot modify it without it being detected. The integrity guarantee is fairly weak and easily subject to MitM exploits unless properly configured with EV certificates or using two-way TLS and requiring mutual authentication. Basically you can detect all the links in the chain, but if one of those links is already compromised that isn't the protocol's fault. If someone inside your trust chain is intercepting and re-encoding your messages, the protocol won't stop it; all it will show is the person is a link in the authentication chain.

      It also offers moderate degree of protection for authentication that the host you are connecting to matches who they claim to be; that is, with a TLS or SSL connection to example.com, if you know the certificate, then you have an authentication chain that the site matches. Just like the integrity guarantee, the protocol shows you all the links and nothing more. You still need to watch out for weak links. If one of the links in the certificate chain includes your corporate proxy or school's servers then you should assume that link in the chain is compromised, which is the most common MitM attack.

      The protection most people think of -- the protection from eavesdropping -- is only a very weak protection and not guaranteed by the protocol. The encryption adds a cost to any eavesdroppers not part of the security chain, but for most of the encryption protocols that protection is minimally overcome with a large budget.

      --
      //TODO: Think of witty sig statement
    2. Re:Grand opening! by tattood · · Score: 3, Interesting

      When you submit a CSR (Cert Signing Request), you generate the private key and keep it private; all you submit to the CA is the public key, which they sign. They never see the private key.

      If this were really run by the NSA, they could quite easily create their own signed certificate and install it on a SSL decryption proxy, and then they can SSL man-in-the-middle your website to see what your website is doing. Since the "fake" signed certificate is signed by the same CA that the real one is, nobody would know the difference unless you look at the cert's serial number and fingerprint.

      --
      WTB [sig], PST!!!
  3. Re:cacert.org? by lart2150 · · Score: 5, Informative

    cacert.org is not trusted by Windows, OS X, Mozilla, and others where Let's Encrypt will be thanks to a crossed sign cert. cacert.org's root certificate is also using md5 still so it's unlikely that it's current root cert ever will or should be trusted. lets encrypt will do all of the work of creating and renewing certificates with the use of their command line tool.

  4. Re:Shared hosting by Jason+Levine · · Score: 4, Informative

    If you're on shared hosting, you should get off ASAP. I used to have a few sites on shared hosting and we'd either a) be impacted by other users using too many resources or b) be threatened with disconnection by the host for using too many resources. The sites were small and not using that much in the way of resources, but shared hosting is tossing a thousand people into a pool and then kicking out the ones who try to swim the slightest bit. The hosts can do this because they know that there's a line of people ready to jump in to take the place of those kicked out.

    Instead of going the shared hosting route, get a Virtual Private Server. It won't set you back that much. I pay $34 a month - and that's for managed hosting, unmanaged is much cheaper if you're comfortable managing the server yourself. Yes, this is more money than the $2 a month for "unlimited" space/bandwidth shared hosting, but you'll actually get what you pay for instead of being crammed together with a thousand other sites on an overloaded server.

    (You could get a Dedicated Server, but these cost a lot more and only make sense for the biggest of websites. Get a VPS first and if your site grows to the point that it needs a dedicated box, then congrats.)

    --
    My sci-fi novel, Ghost Thief, is now available from Amazon.com.
  5. Maybe it will be enough ... by EagleRider70 · · Score: 3, Funny

    Maybe it will be enough to get you guys at Slashdot to do it! ;-)