Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

It's hard to complain about a slight deadline miss from an incredible project offering free stuff.

Precisely the problem. Real companies mostly prefer to use paid solutions because they have comfort and confidence in knowing there is a business and backing behind it. At least I know I do. I never got the whole developer complex wanting and even expecting everything for free. Seems hypocritical and counter-entrepreneur.

Also for what's worth, I've been deploying Let's Encrypt into production recently using Caddy and (on-demand) TLS and while it works, the rate limits being reset weekly is really scary and VERY VERY easy to hit. I know myself and my clients would be willing to pay for Let's Encrypt Pro (higher rate limits, etc). Take our money.

That's not Let's Encrypt's role to play though. As a user, I'd be much more skeptical of an LE cert'd site than a Verisign cert'd site. That's not a knock on LE, that's just recognizing a higher barrier to entry. Let's Encrypt's goal is to get everyone encrypted, not necessarily to ensure everyone is who they say they are.

And as a fellow person who does real business at times, I often prefer paid products because I know I can get support from the company backing it. I don't think Let's Encrypt will replace the entire CA industry, and I don't think it should. (As tyingq says, monocultures are bad.)

> not necessarily to ensure everyone is who they say they are

How does Verizon (to take your example) ensures this? They have the same zero verification process for the non-EV cert.

At bare minimum, getting a cert almost anywhere else requires a credit card.

This is not something which helps to decide whether the target website is what they claim to be.

I can use my CC to buy faccebook.com, and I will get it (again, outside of EV).

I may then be tracked by Interpol for fraud, but to the end user this does not change anything: Verizon has issued a certificate for my faccebook.com

IYAM, any major web property such as google, facebook, credit card issuers, etc. should buy up all the most likely typo-ed versions of their domains so that this doesn't happen.

The average user is going to blame Facebook anyway if they get duped into logging in at faccebook.com, and it goes to protecting their brand (trademarks are weakened if the owner doesn't defend them).

They do, and if they don't, they end up like the White House a few years ago when whitehouse.<I forgot the TLD> was bought and an almost exact replica was created, according to Rule 34.

My point is that you can buy any site from a CA and no verification is done, exactly as with Let's Encrypt.

Even with an EV there is no guarantee that the requester is genuine ("best effort" to check)

With EV the checks basically care about:

1. Does this entity exist, e.g. it's in an official government business directory and the address details match what was specified 2. Use a third party directory (e.g. Dunn & Bradstreet) to look up this entity, and phone them. Ask to talk to some specific role at the company e.g. "Head of the IT department" and then confirm the details with that person.

This involves actual humans, albeit basically call centre employees, looking at paperwork, making telephone calls, that sort of thing. I guess you could label it "best effort" but to me that signifies much less.

For Americans a surprise problem with EV is that your country doesn't _have_ a central business directory. Each State runs its own directory, most businesses are registered in Delaware, regardless of their actual home state.

https://stripe.ian.sh/ has a completely genuine Stripe, Inc. EV certificate, issued to a Stripe, Inc. just not the one that's famous.

I can get a prepaid VISA card at any convenience store

With no billing address, though, right?

So, Verisign is an interesting example.

Verisign sold their certificate business a long time ago to Symantec.

Symantec had a contract with a Korean company "CrossCert" in which Symantec would issue certificates (including "Verisign" certificates) based on CrossCert's validation.

We don't actually know what CrossCert's validation practices were, because during investigation of problematic certificates Symantec found that CrossCert wouldn't give them the paperwork they should have been keeping to track this work so that it could see what they'd done. It had never asked to see that paperwork previously (over years of the relationship) and had simply accepted a Korean auditor's finding that everything was fine without really inspecting anything itself or letting anybody know about this arrangement with CrossCert.

Did you know about? When you see "Verisign" do you think "Or, you know, maybe some Korean company, but that's fine?"

Never mind, this scandal eventually resulted in Symantec exiting the CA business late in 2017, and today "Verisign" certificates are issued by DigiCert, another company you've probably never heard of.

For any medium or large company, the $200-ish cost of a commercial wildcard certificate is a non problem. I think let's encrypt is mostly useful for small businesses and individuals, who can live with these limits.

I think it's not the cost the issue, but the peace of mind brought by the automatisation of the process of certificate renewal.

This where LE is for me different from usual cert providers.

True but you can buy a 7y commercial wildcard cert. That also offers some peace of mind. You still have to worry about renewing it in many years but on the other side you are not exposed to a job breaking or an api changing.

Nope.

Currently (today, 21 February 2018) the limit is 39 months, starting 1 March 2018 the limit becomes 825 days. These limits are set down in the Baseline Requirements, which are rules agreed between the Certificate Authorities and Browser vendors (in practice mostly OS vendors) at their standing meeting. Chrome at least actually implements these in software, ie leaf certificates which seem to have a longer lifetime are simply invalid and don't work.

In practice commercial CAs tend to sell products as 1 year, 2 year or 3 year, and then they use the extra days in the BRs to let you "keep" the extra days if you renew early, so that you don't feel the need to wait until the last minute to renew to get maximum value.

If you're in business, you need a process so that you are not likely to forget dates. Tax filing deadlines, other regulatory reporting, etc. Certificate expiration can just be part of that.

It's not really that hard. I manage a dozen+ certs manually, I get reminder emails 30 days before they expire, and it takes literally a few minutes to submit a new CSR. I could autmate it even more than I do, but https://xkcd.com/1205/

Me too, the rate limit is preventing me to keep on using LE.

I am a little worried about the monoculture LE is creating.

I don't have any bright and practical ideas to fix that, however. Short of some other consortium making an equivalent, but with different tech underneath.

For TLS certificate authorities, a monoculture is way better than the alternative.

I'm thinking of some critical flaw in ACME, or CA outage, bad cert push, etc. I get your point, but I think there's a legit risk here.

this is the second delay

Reply on news.ycombinator.com