Happy birthday to Let’s Encrypt !
Huge thanks to everyone involved in making HTTPS available to everyone for free !
That’s very great news! Thank you for all the good work!
Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as “it’s not as secure as a traditional CA”.
It’s sad that these arguments are still being shared. It was the same arguments years ago from people that would just assume that a free cert was inherently unsafe.
I’d love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs
Lots of people shitting on stories of people who buy certs.
You do still have to buy a cert if you want one for a .onion. Let’s encrypt still doesn’t support it :(
I’m also having to manually cert every 3 months for my emby instance. It’s a minor inconvenience, but I’m definitely tempted to just buy a yearly.
Emby?
I’m sad to say that all my sites where http only until 10 years ago
Well, you usually had to pay extra back then!
A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.
I love it when companies are too stubborn to update their costs despite the necessity changing over the years.
My previous employment kept buying microsoft office license keys despite us already moving to 365. They probably did it out of habit when buying new computers. Needless to say I have a cardstack of license keys at home lol. Granted it’s for Office 2013 but I don’t really need the latest version for basic document processing.
Private sector is more efficient my ass
It doesn’t say on the website but on their anniversary day they are giving away unlimited ssl certs!
Well, they do rate limit
And my parents still buy SSL certs because that’s just what they know 🤢
My last cert renewal was $20 for 3 years. That’s less than a dollar a month, not exactly breaking the bank.
It’s been a bit since I’ve asked them, but they certainly complained about the cost before. Almost as much as the hosting itself for sure.
Today it’s just more or less stupid to buy SSL you can get one extremely easy for free from Let’s Encrypt or Google Trust…
Yeah, I uh…I think that’s kinda what this whole conversation here is about
I’ve tried explaining to them before, but they think that it’s a scam because it’s free lol
SSL Certs were so god awful before certbot that it’s hard to explain now that it’s so easy and free.
Also fucking expensive
Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let’s Encrypt.
I probably need more positivity in my life 😂
Can anyone fill me on this? Why is it so significant?
HTTPS certs used to be very expensive and technically complicated, making it out of reach for most smaller orgs. Let’s Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.
It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn’t have been so omnipresent.
And it shouldn’t have been, SSL PKI is an intentionally rigged architecture. It’s intended for nation-states to be able to abuse it.
I’d like much more some kind of overlay encryption over HTTP based on web of trust and what not. Like those distributed imageboards people were trying to make with steganography in emotion.
It’s a trap. Everybody is already in it and it has already been activated, so - the discussion would be of historical interest only.
And it changed the Internet, for good and a lot.
Man I love let’s encrypt, remember how terrible ssl was before the project landed?
When you have to use it, then yes. But in general standard technologies of today are mostly rigged.
Crazy times. Nowadays it’s weird when a website doesn’t have https. Back then it was pretty much big companies only. And the price of a wildcard certificate…
Except for neverssl.com
Triggering the launch of captive portals for public Wi-Fi users everywhere yayy
That website says it will never use SSL, but it definitely just connected over https with a valid certificate when I went there.
That’s odd. Try httpforever.com instead.
Nice yeah that site actively rejects https connections.
I just use an IP address, they always resolve http and I can type 1.1.1.1 faster.
I always had to fill out multiple pages of forms to get those free 1 year “trial” certs from startssl.
Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$
Luckily, wildcard certs are insecure and should be avoided.
Wildcard certs are perfectly fine. Your own instance lemm.ee is using one right now.
Obviously there could be issues if subdomains are shared with other sites, but if the whole domain is owned by 1 person, what does it matter?
If one system is somehow compromised, the attacker could effectively impersonate all the systems on your entire domain if they had the wildcard cert. Maybe it’s not a huge deal for individuals but for companies or other organisations it could be extremely dangerous.
If someone wanted a wildcard cert at work I would be very cautious before I even considered issuing one. Unfortunately there are a few wildcard certs on our domain, but those are from before my time.
I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.
And if you remember, that this whole shebang was only started, because Snowden revealed that the NSA spied on all of us, it’s getting much much darker.
People behave as if having a green lock icon were enough to consider you’re safe.
People behave as if there were not multiple cases of abuse of PKI.
People behave as if all those whistleblowing cases exposing widespread illegal activities by the state were not treated as normal, except those exposing them being chased and vilified.
What I’m trying to say is that we’re past the stage where techno-optimism about the Internet made sense. They just say in the news that abusing you is good, and everybody just takes it.
Remember they wanted like $75 for certs? The gall.
Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.
Damn! That’s definitely a “I’m old” moment for me. I still remember when I first heard about the concept and I remember setting it up the first time on a self hosted project (which seemed harder back then).
Awesome project!
Underrated. Stuff rocks.
