Slashdot Mirror
Let's Encrypt Is Now In Public Beta (eff.org)
Peter Eckersley writes: As of today, Let's Encrypt is in Public Beta. If you're comfortable running beta software that may have a few bugs and rough edges, you can use it to instantly obtain and install certificates for any HTTPS website or TLS service. You can find installation instructions here.
Almost as good as unicode support here
I am Slashdot. Are you Slashdot as well?
From Introduction:
Because a shared web hosting customer is not root, the hosting provider will have to install Let's Encrypt on behalf of its customers. I plan to open a support ticket with my hosting provider to request installation of Let's Encrypt. What are the most likely objections that a hosting provider might have to enabling this?
They really want you to automate this. From the web site:
Let’s Encrypt CA issues short lived certificates (90 days). Make sure you renew the certificates at least once in 3 months.
Excessive forking causes un-wanted children.
Let's encrypt uses the integrated face system to encrypt data.
Unfortunately, their MAXIMUM length of certificate is 90 days and it ain't getting longer; if anything they want to make them shorter in duration. So anyone who doesn't want to or can't, for whatever reason, run some cronjob on their server to auto-renew their certificates should give these guys a miss. Great shame that they let their "automate everything or GTFO" ideology override many people's legitimate need or desire for annual certificates.
== Jez ==
Do you miss Firefox? Try Pale Moon.
I'm all about free certs - but what kind of general support will there be? The last thing I want to do is tell my mom that her Android tablet can't connect to my web server because Chrome for Android won't trust the connection and won't give her the option to add an exception...
With access to my server's private keys. Who does this sound like a good idea to?
No sir I dont like it.
The hype around Let's Encrypt has been Encryption for Everyone! Here are the 'simple installation instructions' ./letsencrypt-auto --help
$ git clone https://github.com/letsencrypt/letsencrypt
$ cd letsencrypt
$
And to simply grab a cert... ./letsencrypt-auto certonly --webroot -w /var/www/example -d example.com -d www.example.com -w /var/www/thing -d thing.is -d m.thing.is
I understand that the target audience is admins, and that this is beta, but really?
Honest question -- why would you want a cert you have to renew every 90 days? In case it gets stolen? I guess I just don't understand the point.
I don't get why Mozilla appears to treat its users so badly so often.
It's clear in this case that the potential users of this service don't want to jump through hoops just to use it. They don't want to have to run weird software as root on their servers, assuming they even have this much access. They don't want to have to renew their certs every 90 days. They just want something that works, yet it's like Mozilla is going out of their way not to provide a simple solution! It's like they want to make it hard to adopt this otherwise promising service.
We've seen something similar with Firefox. Mozilla has forced awful, unwanted changes on its users again and again and again since Firefox 4. If it isn't some bad UI change, then it's them integrating something unwanted like Pocket, or it's extensions being unnecessarily broken. The users collectively say, "No! We don't want this!" yet get the bad decisions forced on them anyway. It's no surprise that Firefox's share of the market is likely well under 10% now. Users don't like it when software gets worse with each release, and they'll find alternatives.
Then there's Firefox OS. It's like it was designed from the bottom up to provide the worse possible user experience. Seriously, limiting a mobile OS to only "native" apps written using JavaScript/CSS/HTML5 is insane, even to people who are driven by ideology alone! What's the point of providing a user experience that's worse than the early releases of Android and iOS, especially when it's done a decade later?!
I want to see Mozilla be successful. There are some good ideas coming from there. But then the user experience ends up being so terrible in practice. Please, Mozilla, listen to your current and potential future users!
Nothing for windows, kind of a disappointing way for the EFF to severely limit their audience.
I understand that the target audience is admins, and that this is beta, but really?
Have you ever had to generate a certificate request, get it signed by a CA and install it in your web server? Its not rocket science but its certainly tedious with a dense jargon thicket to battle through.
./letsencrypt-auto certonly --webroot -w /var/www/example -d example.com -d www.example.com -w /var/www/thing -d thing.is -d m.thing.is
...is improvement beyond recognition.
Anyway, there's a lot of infrastructure behind that command line that should make it easy for the likes of CPanel, Plesk or maybe even Wordpress to wrap it in a nice point-and-drool dialog.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
Doomed to fail. The people who aren't deploying SSL are also the ones who can't install Git.
Another option would be to add a TXT record with the challenge-response to the DNS. Control of the DNS literally means controlling the domain.
In other words, the CA would translate a DANE record into an X.509 certificate.
Certificates only provide a level of encryption. CAs do not, and cannot, reliably relate identity to any particular cert (although they are terrific at violating privacy.) Comprehensive server compromise can occur without in any way disrupting the most expensive, largest-number-of-bits cert out there. Just ask the NSA, they'll be happy (to jail you for asking.)
The entire CA system from top to bottom is purest scam-and-skim; it smells of organized crime, with a soupçon of irrelevant technical mumbo-jumbo to give it that tasty, easy-to-swallow slipperiness.
There is no reason (other than continuing to pump money into the pockets of the CAs) whatsoever that a correctly constructed certificate should "expire" or otherwise go out of scope, barring actual discontinuation of the protocols they support.
So, hands up. Who has ever forgot to renew a three year cert before it expired?
It happened to me once. Then I put monitors in place in Nagios that monitor and alert on upcoming domain or certificate expirations. Two simple check scripts keep dozens of domains and certificates under a watchful eye and alert me preemptively.
I have no worries.
It works, and fills a need. t is really easy to use. GUI ? Who can possibly care ? If you have to have a GUI to work, you have no business fooling with things that actually require informed decisions.
They don't want to have to run weird software as root on their servers, assuming they even have this much access.
They already run NGINX, lighttpd, or Apache as root so it can listen on ports below 1024 (such as 443, the standard HTTPS port). What makes software "weird software"?
Today I went through the StartSSL process to renew the certificate for a site because it'll more than likely expire before my hosting company has a chance to implement Let's Encrypt. StartSSL isn't really that different from GoDaddy, except for two things: you use a client certificate instead of a password to identify yourself, and verifying domain control and issuing the cert are split into two steps. One e-mail verification to get your individual client cert, another to verify the domain, then paste in the CSR, and a few minutes later, the class 1 domain-validated certificate is siting in your Tool Box. The biggest UI flaw is that the tabs on your user page (Tool Box, Certificates Wizard, Validations Wizard) are arranged in reverse order of how they're used. The second biggest is that the e-mail validation requires you to be aware of tabbed browsing or at least opening your webmail in a new window.
I haven't tried WoSign. Is it any cleaner?
Was looking forward, but 90 day bs and wacked install- you can go comodo and get the top end one with the green bar for $99 a year, easy.
Its a hundred dollar problem, looking at all the shite you have to do with root access and everything else its easier to go commercial.
Say $50 an hour system admin, 1 hour install, then monitoring, its more expensive than comodo.
Thank you for explaining. Consider three different attacks on an HTTP session: passive sniffing, active proxying by a man in the middle, and typosquatting. HTTPS with a self-signed certificate solves the first. HTTPS with a domain-validated certificate solves the first two. HTTPS with an organization-validated certificate solves all three.
Want to send encrypted? Generate a certificate and send away, no problem there either.
This resists passive attacks but not MITM or typosquatting. Traditionally, web browsers that support HTTPS have set the bar at MITM.
Want someone to vouch for you that you are the sender you pretend to be? Ouch, that will be $x - not because it is a prerogative of the rich, but we need to do the following verifications which cost $x.
That depends on whether you define attacks on "the sender you pretend to be" to include typosquatting. The premise of StartSSL, WoSign, and Let's Encrypt is that validation that you are the same person who owns a particular domain costs very little on top of what you are already paying for a domain. Perhaps we disagree on the impact of typosquatting, especially in a hypertext environment when people are more likely to find web sites through hyperlinks in other web documents, such as web search results, news articles, opinion columns, social media, and bookmarks, than through type-in traffic.
Remember banks are relying on the "HTTPS" lock icon and instructing their users to look for it and consider themselves "safe" if it exists.
The two tiers of CA-signed certificate have distinct purposes. Domain validation is suitable for basic validation that the sender is authorized to speak for the owner of a particular domain, whereas organization validation is suitable for further validation that the owner of a domain is also an established business. Domain validation is resistant to MITM attacks, but only organization validation is resistant to typosquatting. A hobbyist operator of a forum or wiki would use the former because he wants his site's login page to be resistant to MITM, but he sees little risk (probability times damage) of typosquatting given that forums rely on bookmarks and wikis rely on search traffic. A bank would use the latter because it sees more type-in traffic and thus more risk of typosquatting.
Wonder if they will be developing a Windows version.
The more I read about this, the more I think they're trying to pull off the long-con: "Let's get a million users, and then flip the pwn switch and sell to the highest bidder."
This is probably why a short renewal period was chosen. If you know that you will need to renew the certificate every 3 months, you will automate the process and it will continue to work indefinitely. No need to worry about forgetting!
The protocol is free and open source. You're free to reimplement it in C.
as in, wtf let's encrypt is.
I think bingoUV's point is that novice users do not know what to look for to tell the difference between DV and EV certificates. The icon is the same either way: a lock for DV or a lock and business name for EV. Novices don't know to look for the business name because they haven't been taught so, as back when TLS proponents were first saying "look for the lock", EV didn't exist.