Let's Encrypt Developer Preview

https://github.com/letsencrypt/lets-encrypt-preview

by julianj • 12 years ago

141 44 12 years ago

This is going to sound super ungrateful but...

If they already have the CA stuff ready can they just release that? I don't really care about their auto-magical tool which is meant to reconfigure your server for you. Configuring Apache/IIS etc is not that complex, the only reason I don't have a certificate on my private website is because the certificate costs more than the hosting annually (literally).

Plus I'm never going to run this tool even when it is production ready. I don't trust random tools to reconfigure my system, and would prefer to manually follow tutorials so it is easy to undo every change or at least be aware of exactly what changes got made.

vertex-four3• 12 years ago

If they already have the CA stuff ready can they just release that?

While I'm sure they have something ready[0], I'm not sure they have a fully-worked-out policy for running it (required to get into certificate chains), or a production deployment of it, or a third-party vulnerability test of it.

Additionally, ACME verification is a vaguely complicated protocol which will likely need a tool to sign the various messages involved (or you're going to be looking at munging together OpenSSL commands), and you're looking at the developer preview of that.

[0] https://github.com/letsencrypt/boulder

JoshTriplett3• 12 years ago

Plus I'm never going to run this tool even when it is production ready. I don't trust random tools to reconfigure my system, and would prefer to manually follow tutorials so it is easy to undo every change or at least be aware of exactly what changes got made.

Agreed. I can already generate and install a certificate (though I wouldn't mind a standalone tool to make that simpler). I'd like some automated process that renews that certificate, or better yet, certificates that don't expire in the first place.

benburwell• 12 years ago

I'd be happy with automated renewal. Certificates that don't expire seems like a bad idea.

btreecat5• 12 years ago

because the certificate costs more than the hosting annually (literally).

So what you are saying is that because you can get an SSL cert free from startcom, that your hosting provider is paying you?

https://www.startssl.com/?app=1

JshWright• 12 years ago

"Free" if you don't count your time spent dealing with their terrible interface...

masklinn3• 12 years ago

StartSSL's free cert don't support wildcards and the revocation of a cert is $25 per, which can be a problem (it was during Heartbleed).

I understand they also have a pretty bad interface and terrible customer service.

nadams• 12 years ago

I don't think anyone is home:

https://forum.startcom.org/viewforum.php?f=8

After I saw the state of their forums/community I ran, not walked, away from their service. Which is rather scary considering they are a trusted CA...

I think really the only reasonable thing to do is pay $15/yr for any site that other people will use and use your own CA for your personal projects.

Getting CA certs into Android however is whole other issue...

unsignedint2• 12 years ago

And also, you'll need IP addresses for each subdomains hosted, which can rack up costs. Though most of "modern" browsers and OS support SNI, this is less of a problem now.

joshmoz• 12 years ago

The CA itself is not ready yet. When it is, you can use the client in a simple mode to grab a certificate and drop it wherever you want, without automated configuration.

IgorPartola3• 12 years ago

I don't want a tool that I have to run as root and that is going to touch anything in /etc/nginx/.

I do want a tool using which I can do something like:

    $ letsencrypt 'foo.bar.example.com'

which would spit out foo.bar.example.com.key, foo.bar.example.com.cert, and foo.bar.example.com.csr.

I'd also like to have:

    $ letsencrypt --renew foo.bar.example.com

Which would re-generate all these certs. The main problem for me, just like for you, is that domain validation certs are not free (or at least somehow included in the price of the domain registration). This type of tool solves that.

If, on top of this tool, we also get something that lets a person new to ops autogenerate or even autodeploy an nginx vhost with TLS/SPDY support, awesome! But the ability to generate and renew certs from the command line, for free, is what I want and probably what you want too.

amenghra• 12 years ago

I totally agree. You would however need to somehow authenticate that you own foo.bar.example.com (code in email, host something under foo.bar.example.com, a TXT record, etc.).

cgjaro• 12 years ago

Being able to run the tool as non-root so it just spits out the key/cert pair is EXACTLY one of the mode of operations that they said will be available - see http://media.ccc.de/browse/congress/2014/31c3_-_6397_-_en_-_...

flecno• 12 years ago

You should really see http://media.ccc.de/browse/congress/2014/31c3_-_6397_-_en_-_...

Spooky232• 12 years ago

Thank you. This was a really informative, excellent talk.

IgorPartola3• 12 years ago

Does anyone know whether this initiative will provide wildcard certs? Or will this be restricted to single domain certs?

grey-area• 12 years ago

Single domain only, at least initially.

Spooky232• 12 years ago

They will do multi-domain certs, but no wild cards.

Also, you can reissue certs with added SANs

hrjet• 12 years ago

I was looking at the how it works[1] article but it isn't clear to me how the domain is validated.

Couldn't an MITM between the LetsEcnrypt service and the example.com server request a certificate, then respond to the challenge, and then use that certificate later?

Getting a certificate from StartSSL was similar. The only difference was that there was a human involved in the loop (a mail is sent and the user has to copy paste the contents of the email), but in essence, both the services seem vulnerable.

This seems to be an unsolvable bootstrapping problem, unless some sort of physical verification is done.

What am I missing?

[1] https://letsencrypt.org/howitworks/technology/

vertex-four3• 12 years ago

The protocol asserts that you have control over the domain, and over a machine that can be accessed at the domain's A record. If you can make your machine appear to be at google.com from the perspective of LetsEncrypt for the duration of the request process, you can get a cert from them.

This is standard for all domain-validation-only certificate authorities, i.e. the cheapest cert you can get from any given company.

Let's Encrypt Developer Preview

Related Stories