Let's Encrypt
letsencrypt.org
Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report.

Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

  • jagged_circle@feddit.nlEnglish
    0·
    2 months ago

    Lots of people shitting on stories of people who buy certs.

    You do still have to buy a cert if you want one for a .onion. Let’s encrypt still doesn’t support it :(

    • valkyre09@lemmy.worldEnglish
      0·
      2 months ago

      I’m also having to manually cert every 3 months for my emby instance. It’s a minor inconvenience, but I’m definitely tempted to just buy a yearly.

    • EngineerGaming@feddit.nlEnglish
      0·
      2 months ago

      It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn’t have been so omnipresent.

  • DigitalDilemma@lemmy.mlEnglish
    0·
    2 months ago

    Sleeping too well lately? Consider this:

    If LetsEncrypt were to suffer a few weeks outage, how much of the internet would break?

      • DigitalDilemma@lemmy.mlEnglish
        0·
        2 months ago

        It won’t be that simple.

        For starters, you’re assuming t-zero response. It’ll likely be a week before people worry enough that LE isn’t returning before they act. Then they have to find someone else for, possibly, the hundreds or thousands of certs they are responsible for. Set up processes with them. Hope that this new provide is able to cope with the massive, MASSIVE surge in demand without falling over themselves.

        And that’s assuming your company knows all its certs. That they haven’t changed staff and lost knowledge, or outsourced IT (in which case they provider is likely staggering under the weight of all their clients demanding instant attention) and all that goes with that. Automation is actually bad in this situation because people tend to forget how stuff was done until it breaks. It’s very likely that many certs will simply expire because they were forgotten about and the first thing some companies knows is when customers start complaining.

        LetsEncrypt is genuinely brilliant, but we’ve all added a massive single point of failure into our systems by adopting it.

        (Yeah, I’ve written a few disaster plans in my time. Why do you ask?)

        • Zangoose@lemmy.worldEnglish
          0·
          2 months ago

          Piggybacking off this comment because I completely agree with it.

          Did we not learn anything from CrowdStrike? If a comparatively simple fix was able to wipe out half the world, how would something that requires an active choice (where to get certs from) not completely cripple all of our infrastructure?

  • somenonewho@feddit.orgEnglish
    0·
    2 months ago

    Damn! That’s definitely a “I’m old” moment for me. I still remember when I first heard about the concept and I remember setting it up the first time on a self hosted project (which seemed harder back then).

    Awesome project!

  • max55@lemm.eeEnglish
    0·
    2 months ago

    That’s very great news! Thank you for all the good work!

  • 0x01@lemmy.mlEnglish
    0·
    2 months ago

    Man I love let’s encrypt, remember how terrible ssl was before the project landed?

    • leisesprecher@feddit.orgEnglish
      0·
      2 months ago

      And if you remember, that this whole shebang was only started, because Snowden revealed that the NSA spied on all of us, it’s getting much much darker.

    • Rikudou_Sage@lemmings.worldEnglish
      0·
      2 months ago

      Crazy times. Nowadays it’s weird when a website doesn’t have https. Back then it was pretty much big companies only. And the price of a wildcard certificate…

    • pcouy@lemmy.pierre-couy.frOPEnglish
      0·
      2 months ago

      I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.

      • xthexder@l.sw0.comEnglish
        0·
        2 months ago

        Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$

        • lud@lemm.eeEnglish
          0·
          2 months ago

          Luckily, wildcard certs are insecure and should be avoided.

          • xthexder@l.sw0.comEnglish
            0·
            2 months ago

            Wildcard certs are perfectly fine. Your own instance lemm.ee is using one right now.

            Obviously there could be issues if subdomains are shared with other sites, but if the whole domain is owned by 1 person, what does it matter?

            • lud@lemm.eeEnglish
              0·
              2 months ago

              If one system is somehow compromised, the attacker could effectively impersonate all the systems on your entire domain if they had the wildcard cert. Maybe it’s not a huge deal for individuals but for companies or other organisations it could be extremely dangerous.

              If someone wanted a wildcard cert at work I would be very cautious before I even considered issuing one. Unfortunately there are a few wildcard certs on our domain, but those are from before my time.

              • pcouy@lemmy.pierre-couy.frOPEnglish
                0·
                2 months ago

                Having a certificate for any subdomain has implications for other sibling domains, even without a wildcard certificate.

                By default, web browsers are a lot less strict about Same Origin Policy for sibling domains, which enables a lot of web-based attacks (like CSRF and cookie stealing) if your able to hijack any subdomain