Comment by jiggawatts | Hacker News Reader

Comment by jiggawatts | Hacker News Reader

Parent Full thread

I love your work!

Any chance you could convince Microsoft to add Let's Encrypt as an "integrated" CA in Azure Key Vault? It's absolutely bonkers how much money I have to pay to get a certificate in 2021 for cloud services! E.g.: the App Service certificates are $70/year each or $300/year for a wildcard certificate. That's nuts. Reference: https://azure.microsoft.com/en-us/pricing/details/app-servic...

I strongly suspect the reason Let's Encrypt isn't adopted more widely in cloud services is because there's no margin on a free service. This is why Microsoft, AWS, and GCP all carefully pretend that there are no free options, and make sure that it's a difficult uphill battle to use Let's Encrypt.

E.g.: https://docs.microsoft.com/en-us/azure/key-vault/certificate...

Notice how the document title is literally "Integrating Key Vault with DigiCert certificate authority". Not "Certificate Authority", it's the "DigiCert certificate authority". Apparently, HTTPS is now DigiCert's protocol, they're the gatekeepers, and you have to pay them money to use it.

It boils my blood that 1KB files of random numbers still cost money, and the trolls under the bridge are still taxing everyone for what is now essentially mandatory for all web sites.

If anyone here has a significant account with Azure, please apply some pressure to your Microsoft account manager next time you have coffee with them. This rent seeking for what should be free for everyone has to stop.

>This is why Microsoft, AWS, and GCP all carefully pretend that there are no free options, and make sure that it's a difficult uphill battle to use Let's Encrypt.

Maybe I'm misunderstanding, but GCP HTTPS and SSL load balancers give you certificates for free. They support Google's own CA (pki.goog) as well as Let's Encrypt. Full disclosure I work in GCP, but not on this.

https://cloud.google.com/load-balancing/docs/ssl-certificate...

AWS load balancers also give you managed certificates for free.

Certificates issued from AWS Certificate Manager are — and, I believe, always have been — free. AWS is definitely not rent-seeking on certificates.

Certificates from AWS Certificate Manager are part of the roach motel though - AWS orchestrates the issuance and holds the private keys so you can only use them via AWS services.

But that's what the grandparent was complaining about though? If you're not using the provider's managed services, then nothing is stopping you from running your own ACME client to provision certificates without paying the cloud provider money for certs.

"AWS Certificate Manager supports a growing number of AWS services. You cannot install your ACM certificate or your private ACM Private CA certificate directly on your AWS based website or application."

Free certificates you can't use on EC2 virtual machines are basically worthless, at least for me.

Stop internalising your 1990s architecture limitations! You shouldn't need to pay for a Layer 7 load balancer for an application that doesn't need it. A 1-core web server VM can easily put out 1-2 Gbps of HTTPS traffic. You don't need SSL offload. A crypto accelerator card is not required. You don't need an appliance to do HTTPS. You can have end-to-end HTTPS without additional infrastructure. Both Windows and Linux can do TLS out-of-the-box. You don't need a vendor to give you special permission to have security. There is no need to pay GoDaddy or DigiCert for a certificate.

The vendors are pulling the wool over your eyes, convincing you that your out-of-date thinking is good and proper, and then charging you for the privilege of having the bare minimum security that should be free as standard.

AWS ACM has always been free. ACM has never allowed you to export private keys. However ACM does have a way[1] for you to use ACM keys with EC2 instances: Nitro Enclaves. Nitro Enclaves carve off a little piece of your EC2 instance (memory + VCPU) into an isolated VM that feels a little bit like an HSM or a secure enclave.

[1] https://docs.aws.amazon.com/enclaves/latest/user/nitro-encla...

If it's your own EC2 instance and you're not using a load balancer then why can't you just use Let's Encrypt?

Just use certbot or alternatives, what's the problem?

Holy shit, Azure really charges that much? Does the tls certificate come with some other service or unique feature bundled as part of the cost? AWS basically charges you for the API calls, cents really, and I’m fairly certain GCP is at least as inexpensive if not free. Can you at least export it and take it with you? That’s really the trade off with AWS, private keys aren’t exportable. But it’s so cheap that it’s a non issue. If I want one I can manage myself I can pay or use letsencrypt.

AFAIK Azure do free ones now, I'm certainly using some free certs on Azure.

They're not really free: "This feature is available for customers on an App Service Plan of Basic and above (free and shared tiers are not supported)." They're GoDaddy certificates, and their price is charged back through the App Service pricing.

Similarly, Azure Front Door also has "free" certificates, but they just integrate it into the relatively high cost of the service.

If you want certificates for some other unrelated IaaS or PaaS service... Microsoft says no. They want their margin.

Back to GoDaddy: their attitude is very 1990s, so they sometimes use manual approval for certificates. This makes ARM Templates that normally take minutes to deploy just hang and take hours, or even fail.

Worse, they don't use the DNS address in your request for validation of domain ownership. Instead, they determine the "TLD+1" with some heuristics. Unfortunately, there is no such concept in the Domain Name System itself, so this is unreliable at best. This approach is broken by design and cannot be made to work for many domains. For example, in Australia, App Service Certificates cannot ever be used for subdomains of act.gov.au, nsw.gov.au, and nt.gov.au!

PS: For people who are unaware, the concept of the TLD is at best a fuzzy one, and is decided by the informally maintained Public Suffix list, which is currently managed by Mozilla. It's not an RFC, it's not a standard, and isn't suitable for certificate validation. See: https://publicsuffix.org/

This is one of the key philosophical differences between Let's Encrypt and GoDaddy. When issuing automated, free certificates, manual labour for validation is not a viable approach and hence Let's Encrypt eliminated all such sources of informal, error-prone, manually verified sources. GoDaddy hasn't changed their validation approach in decades, because for $70/year, this kind of inefficiency is acceptable.

To put things in perspective: GoDaddy has a support phone number. For certificates! They're literally 1KB files with two numbers and some text in them. Why do they need support!?

> Why do they need support!?

People manually installing certificates who are unfamiliar with the process. Which, to be fair, is a complex and very technical process if it’s some self-hosted or shared-hosting shell account running an outdated version of cPanel.

I’m kind of shocked that Microsoft has to partner with godaddy and didn’t already have their own CA long before Azure was even a twinkle in some executive’s eye.

Reply on news.ycombinator.com