This is a most excellent place for technology news and articles.
Happy birthday to Let's Encrypt !
Huge thanks to everyone involved in making HTTPS available to everyone for free !
I worked for a company we had 300 websites, the boss wanted to buy certs. I told him about Lets Encrypt. He loved the idea it saved us a bunch of money. I suggest we donate $100 to them. Hes says "NO F-ing way!".
Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as "it's not as secure as a traditional CA".
I'd love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs
I'd also argue that the fact that it's 100% automated and their software is open source makes it objectively more secure. On the issuing side, there's no room for human error, social engineering, etc.
It's sad that these arguments are still being shared. It was the same arguments years ago from people that would just assume that a free cert was inherently unsafe.
That's very great news! Thank you for all the good work!
A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.
TLS certificates have huge margins, so web hosts love selling them.
I love it when companies are too stubborn to update their costs despite the necessity changing over the years.
My previous employment kept buying microsoft office license keys despite us already moving to 365. They probably did it out of habit when buying new computers. Needless to say I have a cardstack of license keys at home lol. Granted it’s for Office 2013 but I don’t really need the latest version for basic document processing.
Private sector is more efficient my ass
Lots of people shitting on stories of people who buy certs.
You do still have to buy a cert if you want one for a .onion. Let's encrypt still doesn't support it :(
I’m also having to manually cert every 3 months for my emby instance. It’s a minor inconvenience, but I’m definitely tempted to just buy a yearly.
Why not script it so you don't have to do it manually?
Your advice is sound, my ability to focus on such a task however… lol
Emby?
Same idea as Jellyfin / Plex. Self hosted media server. Plex handles ssl certs for you, Emby doesn’t have an automatic process so I’m having to manually replace it every 90 days
It doesn't say on the website but on their anniversary day they are giving away unlimited ssl certs!
Well, they do rate limit
SSL Certs were so god awful before certbot that it’s hard to explain now that it’s so easy and free.
Man I love let's encrypt, remember how terrible ssl was before the project landed?
I remember the days when each site that wanted to use SSL had to have a dedicated IP.
Crazy times. Nowadays it's weird when a website doesn't have https. Back then it was pretty much big companies only. And the price of a wildcard certificate...
And my parents still buy SSL certs because that's just what they know 🤢
My last cert renewal was $20 for 3 years. That's less than a dollar a month, not exactly breaking the bank.
It's been a bit since I've asked them, but they certainly complained about the cost before. Almost as much as the hosting itself for sure.
Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let's Encrypt.
I probably need more positivity in my life 😂
And it changed the Internet, for good and a lot.
Can anyone fill me on this? Why is it so significant?
HTTPS certs used to be very expensive and technically complicated, making it out of reach for most smaller orgs. Let's Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.
They also made it a open protocol (the ACME protocol), so now there's a bunch of certificate providers that implement the same protocol and thus can work with the same client apps (Certbot, acme.sh, etc). I know Sectigo and GoDaddy support ACME at least. So even if you don't use Let's Encrypt, you can still benefit from their work.
It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn't have been so omnipresent.
And it shouldn't have been, SSL PKI is an intentionally rigged architecture. It's intended for nation-states to be able to abuse it.
I'd like much more some kind of overlay encryption over HTTP based on web of trust and what not. Like those distributed imageboards people were trying to make with steganography in emotion.
It's a trap. Everybody is already in it and it has already been activated, so - the discussion would be of historical interest only.
