Slashdot Mirror
The EFF's 'Let's Encrypt' Plans Wildcard Certificates For Subdomains (letsencrypt.org)
Long-time Slashdot reader jawtheshark shares an announcement from the EFF's free, automated, and open TLS certificate authority at LetsEncrypt.org:
Let's Encrypt will begin issuing [free] wildcard certificates in January of 2018... A wildcard certificate can secure any number of subdomains of a base domain (e.g. *.example.com). This allows administrators to use a single certificate and key pair for a domain and all of its subdomains, which can make HTTPS deployment significantly easier.
58% of web traffic is now encrypted, Let's Encrypt reports, crediting in part the 47 million domains they've secured since December of 2015. "Our hope is that offering wildcards will help to accelerate the Web's progress towards 100% HTTPS," explains their web page, noting that they're announcing the wild card certificates now in conjunction with a request for donations to support their work.
58% of web traffic is now encrypted, Let's Encrypt reports, crediting in part the 47 million domains they've secured since December of 2015. "Our hope is that offering wildcards will help to accelerate the Web's progress towards 100% HTTPS," explains their web page, noting that they're announcing the wild card certificates now in conjunction with a request for donations to support their work.
Comment removed based on user account deletion
I just don't see why it has to wait until January of 2018 to implement.
Let's call such certificates EV certificates
Sorry, I have to ask, are you just playing dumb in some failed attempt to be "funny" or "sarcastic", or are you really just ignorant about how these sorts of digital certs actually work?
Are you really unaware of the differences between Domain Validated Certificates and Extended Validation Certificates? Are you unaware of how they're obtained? Are you unaware of how modern browsers indicate the use of such certificates to the browser's user?
I really hope you're just trying to joke around, but failed miserably.
Obviously these certs aren't as secure as other certs, and the purpose of the short expiry is to put a hard limit on any exposure to 90 days. I agree it's annoying and this is why I haven't made an attempt to use these certs yet. Although being able to create a wildcard cert is interesting indeed. At least I will only need to have one cert reissued every 90 days instead of five.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Yes, where I have used them I have automated the renewal process, but still what the fuck is the point of wasting my time with that shit?
I'm trying to figure out how an automated process wastes your time. Can you explain?
The Daddy casts sleep on the Baby. The Baby resists!
LOL! It's very clear that you have never actually used Let's Encrypt. It supports the subject alt name extension so that one cert can be used for multiple hosts.
Fuck, just look at Slashdot's cert, if you're browsing this site using HTTPS. The Let's Encrypt provided cert I'm seeing used here has a CN of slashdot.org, but it also supports these names:
So I don't know what the fuck you're doing talking about "5 certs". You must not know, either!
I know the quality of the people around here has really decreased over time, but you're taking it to a whole new level of incompetence.
Please, at least have some small idea about what you're talking about before you start shitting out nonsense!
Letsencrypt will continue to lack any credibility until they abandon this retarded policy.
Dude, you are lacking credibility here if you don't understand why long-lived certs are a problem for security. For small businesses, the main reason not to do a short cert, given letsencrypt's cron jobs, is for a wildcard cert, which is expensive, and now that is being solved. For personal websites, wildcards are generally not used. Enterprises have the option of syncing their client and server certs, for authentication purposes, or buying a long-lived cert.
FYI, Google can afford whatever it wants and has been using 90-day certs for a while too. You should write to them and tell them they lack credibility on Internet security. :P
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
At least I will only need to have one cert reissued every 90 days instead of five.
There are certainly some cluster-type cases where a wildcard will be handy, but in general people have used wildcard certs to make key management easier. Now that we have cron jobs/an API to do key management, I am more inclined to have multiple certs running all over the place, to isolate a break. CAA and DANE records integrated with Let's Encrypt will smooth over the potential downsides of everybody having tons of certs.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Been using wildcard certs for over a decade. Why this is news?
If they want to improve things change it so a company only needs to buy for one top level domain (mycompany.com) and any depth of subdomains from that can use the cert (mycompany.com, test.mycompany.com, env1.qa.mycompany.com, etc...).
I'm afraid that to the average user, there is no difference. The little "green" label or "locked" icon continues to indicate that the certificate is valid and the user has little reason, and not many resources, to verify that they are dealing with a validated but fraudulent, SSL certificate. Even automated tools that mirror content, such as for git repositories or software repositories, can be fooled by such certificates.
> The little "green" label or "locked" icon continues to indicate that the certificate is valid
I need to revise this. Some browsers provide additional indicators that a certificate has "extended validation". But the ordinary user simply does not care nor will they notice.
Seems you like over paying. linode.com has a similar vps for $5/mo. $10/mo doubles that...
Don't blame me, I voted for Kodos
The reason for short-lived certificates is that certificate revocation does not work and is broken beyond repair.
The majority of browser users will click past any warnings about certificates without thinking about it. So I think you are correct.
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
100% https...3 times...Internet, Intranet & Extranet supported via VPN...gotta keep the vendors happy.
LetsEncrypt is a good idea because it makes certificates accessible to a wider range of users. I've been doing systems engineering work for quite a while, but haven't really concentrated on web stuff. When I got involved with a public-facing web project at work lately, I noticed there really is a lot to the TLS system and certificates once you get beyond internally-trusted certificates. Most places did the legwork for certificate acquisition years ago, but setting something up from scratch requires that you know a little bit about how things work, and it costs money. Even the cheap CAs want a few hundred for a wildcard certificate - so if LetsEncrypt allows people to use HTTPS by removing the cost factor, then this is a good move. They already make the issuing process much simpler than going through a traditional CA.
The only thing I do see happening is the "regular" CAs charging more for real, verified certificates, and the whole trust factor possibly being diluted:
- Real CAs that do validation will see that it's now free to get any kind of certificate and raise their prices...creating a kind of "trustworthy TLS" system in parallel with the "free and easy" one. It's reasonably easy to stand up a PKI and hand out certificates from a technical perspective, but the process around how the PKI is operated is the thing that actually creates trust.
- The whole TLS system and the chain of trust is based on the fact that CAs don't just issue certificates to anyone who asks. This will probably force anyone wanting to do things like take payments into EV certificates where they previously could have gotten away with DV ones. DV certificates only validate that you have control over the domain, and EV ones are only issued after the CA does reasonable legwork to make sure you're an authority in your organization.
The certificate guarantees that if you were trying to connect to fraud.com that you in fact connected to fraud.com and there is no man in the middle. It works as intended, you simply don't know what it does. No cert guarantees that once you connect to TrumpUniversity.biz Donnie won't screw you deeply.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Obviously you don't work in a corporate environment that is totally isolated from the internet. Both outgoing and incoming traffic not allowed unless absolutely necessary. Certainly no cron jobs allowed to pull things down when they like.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
*I* have such systems deployed and would love to read your solution for this problem of isolated/insular nets that require Internet access for authentication.
slashdot: A failed experiment.
This is great, I had no idea, these existed... Thanks.
The word "miserably" is overused.
In Soviet Washington the swamp drains you.
Cool story bro. What else do you predict will come to pass? Will you be my oracle?
i think the news is that you won't have to spend beaucoup bucks per year for such a certificate.
AC #54769865 probably believes that a web browser ought to be showing the same sort of interstitial before a cleartext HTTP site or an HTTPS site using a domain-validated certificate that it shows before an HTTPS site using a self-signed certificate. This interstitial would make it clear that the user is visiting the website of an entity other than an established business.
The certificate guarantees that if you were trying to connect to fraud.com that you in fact connected to fraud.com
Then what makes it clear to Bank of America account holders that "bankofarnerica.com" (that's ARNERICA) isn't the site they're looking for?
A fucking cron job is tedious? Seriously? It's copy and paste for fuck sakes. The only problem I have is reusing the certs in programs that you paste the cert and key instead of pointing to the files. One of these days I'll figure out the sed syntax and do that through automatic post processing script when renewing certs automatically. It'll take 5 minutes to google the sed syntax and test it out. Maybe 10 and reused on many servers. Tedious? Umm, no.
You have two options on an air-gapped network:
A. Every two months, sneakernet CSRs to a machine that isn't air-gapped, run the ACME DNS challenge on that machine, and sneakernet the certificates back to the air-gapped network. The one thing you can't do if both the server and the client are air-gapped is OCSP.
B. Set up an internal certificate authority, and deploy its root certificate throughout the internal network. This may fail in Android 7, which distrusts user-installed root certificates unless each application's publisher explicitly opts in to trusting user-installed root certificates.
Why not just fucking use cacert.org?
Last I heard is that they didn't have the finances to do the sort of third-party auditing that the CA/Browser Forum requires.
Let's Encrypt offers certificates for as long as your automatic renewal cron job continues to run, provided that your domain also remains paid-up.
Since the 1990s, the world has realized that actually, we want to have all our web traffic encrypted. Why? Because with the advent of wifi, launching a MITM attack is too easy. There are plenty of good reasons to encrypt traffic, which is why everyone uses ssh, not telnet.
"Trust" turned out to be not a big of problem as everyone feared. Most of the time when I go to Amazon.com, it really is the real Amazon. In fact, it's never not been the real Amazon. However, it still is a real problem, and once traffic is encrypted, we'd also like to be able to know that websites are who they claim to be. It has never been a solved problem, though.
"First they came for the slanderers and i said nothing."
Isn't an isolated network that you have exclusive control over pretty much an ideal case for using your own root?
CAs are a necessary evil when you expect to deal with 3rd parties, because they've managed to get themselves trusted by a variety of vendors and you haven't; but if it's all your stuff, you can set it to trust your root and call it a day.
You can also go away, advertising. Anybody can get Let'sEncrypt certificates for free for their domain, that's the whole point.
There is no fucking need for EVERYONE to be running HTTPS.
Good-bye
300ms? That's for the network latency on some CAs alone. Checking revocation, if at all possible since many CAs simply don't have the infrastructure up and running, can take several seconds to verify the entire chain which often contains 3-5 chained certificates, if the CA doesn't respond, this could easily be a full minute before your certificates have been verified without even a proper response on the condition.
If Google were concerned about latency, they could simply do the lookups on their end and cache the results.
Custom electronics and digital signage for your business: www.evcircuits.com
Amazon Lightsail, and Digital Ocean both offer $5/mo tiers as well. (20 GB SSD, 512 MB RAM, 1 TB transfer).
Good-bye
In those cases any outside certificates are useless since you can't verify trust. You only need to have an Internal CA system for those sorts of setup.
Custom electronics and digital signage for your business: www.evcircuits.com
I prefer the break-early model of LetsEncrypt. Set up your test system with free LetsEncrypt certs and then test the cron script (one-liner) for renewing. Also, the certbot client has a dry-run feature so you can check what it's going to do if you do want to do proper testing.
With long expiry dates, you'll never get around to automating renewal and then you'll probably forget all about it and/or move to a different job and not care. Someone is then left with a ticking time-bomb of embarrassment for a domain cert running out and probably no available test system (oh, that service hasn't been touched since Fred left - no we don't know how to re-create it for test).
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe