Slashdot Mirror
The EFF's 'Let's Encrypt' Plans Wildcard Certificates For Subdomains (letsencrypt.org)
Long-time Slashdot reader jawtheshark shares an announcement from the EFF's free, automated, and open TLS certificate authority at LetsEncrypt.org:
Let's Encrypt will begin issuing [free] wildcard certificates in January of 2018... A wildcard certificate can secure any number of subdomains of a base domain (e.g. *.example.com). This allows administrators to use a single certificate and key pair for a domain and all of its subdomains, which can make HTTPS deployment significantly easier.
58% of web traffic is now encrypted, Let's Encrypt reports, crediting in part the 47 million domains they've secured since December of 2015. "Our hope is that offering wildcards will help to accelerate the Web's progress towards 100% HTTPS," explains their web page, noting that they're announcing the wild card certificates now in conjunction with a request for donations to support their work.
58% of web traffic is now encrypted, Let's Encrypt reports, crediting in part the 47 million domains they've secured since December of 2015. "Our hope is that offering wildcards will help to accelerate the Web's progress towards 100% HTTPS," explains their web page, noting that they're announcing the wild card certificates now in conjunction with a request for donations to support their work.
Damn, I thought I was going to get first post AND call out a dupe, but damnit I was beaten!
1 out of 2 ain't bad.
"Haven't we seen story this before?"
-JG
-- "...I'm a bad guy because I, well, I sing some rock-and-roll songs." M. Manson
Comment removed based on user account deletion
I just don't see why it has to wait until January of 2018 to implement.
Let's call such certificates EV certificates
Sorry, I have to ask, are you just playing dumb in some failed attempt to be "funny" or "sarcastic", or are you really just ignorant about how these sorts of digital certs actually work?
Are you really unaware of the differences between Domain Validated Certificates and Extended Validation Certificates? Are you unaware of how they're obtained? Are you unaware of how modern browsers indicate the use of such certificates to the browser's user?
I really hope you're just trying to joke around, but failed miserably.
Just so you know, in both Chrome and Firefox both DVC's and EVC's will both show up as green lock icons.
" Are you unaware of how modern browsers indicate the use of such certificates to the browser's user? "
Oh, and Donald Trump is a fucking traitor, so there's that.
I pay $15 per month for VPS web hosting at DreamHost and get "Let's Encrypt" certificates for free on my domains and subdomains. Other options included self-signed (free) and Comodo (paid) certificates.
LOL at the ignorance.
EV certificates are your extra tier.
EFF = Electronic Frontier Foundation. I don't see them risking their credibility by freely providing back doors.
You've clearly never applied for a LE certificate if you think they don't check anything.
I can only assume you're trolling.
What the fuck is the point of the ridiculously short expiry? Was it done that way just to inflate the numbers of certs issued just for stories like this?
It just makes no sense. Wastes time and energy.
They could easily "accelerate the Web's progress towards 100% HTTPS" - by fucking issuing certificates with a sensible expiry.
Yes, where I have used them I have automated the renewal process, but still what the fuck is the point of wasting my time with that shit?
Letsencrypt will continue to lack any credibility until they abandon this retarded policy.
Death to CNN. Long live the new flesh.
You neglected to mention that additional information is shown right next to the lock icon for EV certs. For example, both browsers can show a company or organization name, followed by a country code.
It makes sense to show both lock icons as green. In both cases the connection is encrypted, which is perhaps the most basic level of "security" within this context.
It also make sense to indicate that EV connections provide slightly more certainty by showing some additional information, such as an organization name and country code.
I don't know what point you're trying to make, but it's likely a load of bullshit.
It's likely you missed the point, yes.
Are you really unaware of the differences between Domain Validated Certificates and Extended Validation Certificates? Are you unaware of how they're obtained? Are you unaware of how modern browsers indicate the use of such certificates to the browser's user?
I suspect the majority of browser users are unaware of those things.
LOL! It's very clear that you have never actually used Let's Encrypt. It supports the subject alt name extension so that one cert can be used for multiple hosts.
Fuck, just look at Slashdot's cert, if you're browsing this site using HTTPS. The Let's Encrypt provided cert I'm seeing used here has a CN of slashdot.org, but it also supports these names:
So I don't know what the fuck you're doing talking about "5 certs". You must not know, either!
I know the quality of the people around here has really decreased over time, but you're taking it to a whole new level of incompetence.
Please, at least have some small idea about what you're talking about before you start shitting out nonsense!
I'm afraid that to the average user, there is no difference. The little "green" label or "locked" icon continues to indicate that the certificate is valid and the user has little reason, and not many resources, to verify that they are dealing with a validated but fraudulent, SSL certificate. Even automated tools that mirror content, such as for git repositories or software repositories, can be fooled by such certificates.
> The little "green" label or "locked" icon continues to indicate that the certificate is valid
I need to revise this. Some browsers provide additional indicators that a certificate has "extended validation". But the ordinary user simply does not care nor will they notice.
The majority of browser users will click past any warnings about certificates without thinking about it. So I think you are correct.
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
LetsEncrypt is a good idea because it makes certificates accessible to a wider range of users. I've been doing systems engineering work for quite a while, but haven't really concentrated on web stuff. When I got involved with a public-facing web project at work lately, I noticed there really is a lot to the TLS system and certificates once you get beyond internally-trusted certificates. Most places did the legwork for certificate acquisition years ago, but setting something up from scratch requires that you know a little bit about how things work, and it costs money. Even the cheap CAs want a few hundred for a wildcard certificate - so if LetsEncrypt allows people to use HTTPS by removing the cost factor, then this is a good move. They already make the issuing process much simpler than going through a traditional CA.
The only thing I do see happening is the "regular" CAs charging more for real, verified certificates, and the whole trust factor possibly being diluted:
- Real CAs that do validation will see that it's now free to get any kind of certificate and raise their prices...creating a kind of "trustworthy TLS" system in parallel with the "free and easy" one. It's reasonably easy to stand up a PKI and hand out certificates from a technical perspective, but the process around how the PKI is operated is the thing that actually creates trust.
- The whole TLS system and the chain of trust is based on the fact that CAs don't just issue certificates to anyone who asks. This will probably force anyone wanting to do things like take payments into EV certificates where they previously could have gotten away with DV ones. DV certificates only validate that you have control over the domain, and EV ones are only issued after the CA does reasonable legwork to make sure you're an authority in your organization.
CAs haven't been particularly trustworthy for a long time. How many times have we seen CAs compromised or acting in bad faith, such that the browsers had to issue patches removing them from their trusted lists?
The whole idea of centralized certificate authorities is fundamentally broken.
The first obvious concern is that agencies have these keys and can impersonate sites. Given domestic espionage, that wouldn't be a problem limited to these guys, know doubt every provider of certificates has been forced to hand over their root certificates to allow man-in-the-attacks.
The next concern is that encrypted traffic masks alterations performed in man-in-the-middle attacks. That is, you can't tell by looking at the wire that Party A's and Party B's Google results page are not the same when they should be.
We need to get away from web-of-trust and probably any of the current cipher suites too.
The certificate guarantees that if you were trying to connect to fraud.com that you in fact connected to fraud.com and there is no man in the middle. It works as intended, you simply don't know what it does. No cert guarantees that once you connect to TrumpUniversity.biz Donnie won't screw you deeply.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Why not just fucking use cacert.org? let's encrypt do not give a running fuck who use their certificates, even criminals as they have already stated.
This is great, I had no idea, these existed... Thanks.
The word "miserably" is overused.
In Soviet Washington the swamp drains you.
Cool story bro. What else do you predict will come to pass? Will you be my oracle?
AC #54769865 probably believes that a web browser ought to be showing the same sort of interstitial before a cleartext HTTP site or an HTTPS site using a domain-validated certificate that it shows before an HTTPS site using a self-signed certificate. This interstitial would make it clear that the user is visiting the website of an entity other than an established business.
The certificate guarantees that if you were trying to connect to fraud.com that you in fact connected to fraud.com
Then what makes it clear to Bank of America account holders that "bankofarnerica.com" (that's ARNERICA) isn't the site they're looking for?
You have two options on an air-gapped network:
A. Every two months, sneakernet CSRs to a machine that isn't air-gapped, run the ACME DNS challenge on that machine, and sneakernet the certificates back to the air-gapped network. The one thing you can't do if both the server and the client are air-gapped is OCSP.
B. Set up an internal certificate authority, and deploy its root certificate throughout the internal network. This may fail in Android 7, which distrusts user-installed root certificates unless each application's publisher explicitly opts in to trusting user-installed root certificates.
Cool story bro. What else do you predict will come to pass? Will you be my oracle?
Your mother is my oracle.
Let's Encrypt offers certificates for as long as your automatic renewal cron job continues to run, provided that your domain also remains paid-up.
Since the 1990s, the world has realized that actually, we want to have all our web traffic encrypted. Why? Because with the advent of wifi, launching a MITM attack is too easy. There are plenty of good reasons to encrypt traffic, which is why everyone uses ssh, not telnet.
"Trust" turned out to be not a big of problem as everyone feared. Most of the time when I go to Amazon.com, it really is the real Amazon. In fact, it's never not been the real Amazon. However, it still is a real problem, and once traffic is encrypted, we'd also like to be able to know that websites are who they claim to be. It has never been a solved problem, though.
"First they came for the slanderers and i said nothing."
Ever hear the story of the boy who cried wolf?
There are too many warnings, and it's getting harder and harder to tell what they are warning about. You really have to be intentional, and DIG into the warning to tell. This was a valid cert, but it expired yesterday. This is a self-signed cert, and you need to be certain you are at the right place. You went to example.com, but the cert is for www.example.com. You went to example.com, but the cert is for badguy.com. All generate the same warning on the surface, and you have to almost be a cert expert to figure out what the problem is.
I always find it amusing that EFF has such a huge push for SSL Certs yet they make their free Cert CA the hardest of any web issuing CA's on the market to utilize.
sounds great! I might sign up as I have no excuse in 2018, apparently. Would like better linux support though, not just Ubuntu and a few others.
There is no fucking need for EVERYONE to be running HTTPS.
Good-bye
I've been using Ramnode. They offer a $5 tier with similar specs as Linode, but I got the cheaper $15 / year option. It's pretty great, I didn't think I could afford a VPS.
I've been using Dreamhost for years, and I've been pretty happy with them, but to save myself some money I intend to switch over to Ramnode or maybe Linode or maybe one of these other inexpensive VPS hosts. I've been happy to pay extra for Dreamhost's shared hosting features, but I can get them all and more with a VPS, and Dreamhost just does not have competitive VPS prices.
I love this, as until now I had to issue a single certificate for each subdomain.
SAN wasn't possible because:
1. we don't want to leak which customers we have to other customers, each customer gets it's own subdomain
2. moving a VM from one server to another with a different IP would require to change all SAN certificates as we are slightly over the 100 domain-limit
Whose awesome? Your awesome!
Please show some actual evidence of your statements. The only selling to Russia with any credibility was Hillary's uranium deal to the Russians.