Hacker News Reader

Comment by po1nt | Hacker News Reader

Let's encrypt is a single point of failure for a large percentage of the internet.

No, it's not. You can always switch to a different SSL provider. There are other free ones (as mentioned in other comments).

However, thinking about how to make your own setup more robust without having to manually change configuration when one SSL provider stops working is a good exercise. I wonder if you can just get your server's private key signed by multiple SSL providers, and serve multiple certificates to clients, and whether all browsers handle that correctly.

Nothing is a point of failure if you can switch but that's not really true unless you have fail-over.

If LE was to go nope right now, how fast could you move your stack from LE?

You can't use multiple SSL certificates as redundancy. You could probably create something bespoke with a Load Balancer and SSL offloading but that's just more overhead for really nothing.

Just picture the massive load spikes on other SSL providers in that moment. And the fact that even those might not work, as their backends might rely on LE SSL 3rd party services for ID checking or something.

If you couldn't switch, that would be a monopoly. But single point of failure is when you put all your fruit in one basket. Airplanes have redundant systems, even though you can always buy new components. But it's much harder to change them mid-flight.

Ok, but that would just be your own website having a single point of failure, not that Let's Encrypt is a single point of failure. Otherwise you could call every certificate authority a single point of failure.

Hot take, but in general single points of failure are less of an issue than it seems because usually outages simply aren't that common. Meanwhile maintaining whole infrastructure to avoid single point of failure is often very expensive.

In theory this sounds great, but you only realize how much do you rely on a single point of failure, once it fails. Just see github outages or even electricity outages at your home.

> electricity outages at your home

I haven't had one in 20 years, which kinda proves my point.

Reply on news.ycombinator.com