How Big Will the Impact of Lets Encrypt Be?



  • Linux.com gets philosophical looking at the Let's Encrypt initiative positing that LE might be the single biggest advancement in end user security of the decade.

    This week the project takes a huge step toward that future with its Public Beta. After issuing more than 25,000 certificates during the Private Beta, anyone can now get a certificate for free. Our Security Director Emily Ratliff participated in the Private Beta and reports that “the whole Let's Encrypt process took much less time than getting and installing an SSL certificate in the traditional manner. It is also much less error prone since it is more automated with fewer steps.”



  • Definitely going to be a big impact. LE is going to seriously shake things up.



  • Let's Encrypt isw certainly much easier than traditional SSL certificate methods. The part that is going to be a game changer is the fact that each request creates a single certificate. This means a single request with multiple domains can be done. This will replace all of the UCC certs people use for things like email.

    No more of this:
    https://i.imgur.com/L27efaL.jpg



  • I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.



  • I've used StartSSL before. It's rather a significant pain. What surprises me more is that StartSSL never decided to just be more user friendly.



  • I have been buying them from NameCheap with my domains, just $1.99 each when you purchase a domain.



  • LetsEncrypt is super easy. Especially if you are running Linux systems... Generate cert, and in some cases, it can automagically configure Apache for you. Right now, I've got one cert up on my NGinx box at home, and another cert up on my [email protected] Server.



  • @anonymous said:

    I have been buying them from NameCheap with my domains, just $1.99 each when you purchase a domain.

    You can get SSL from GoDaddy for similar prices when you get it new. It is the renewal where they make profit.



  • @johnhooks said:

    I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.

    Start SSL is not easy compared to setting up Let's Encrypt. I use StartSSL in a number of places also. It is a solid choice, but Let's Encrypt will completely change things once they work out the kinks and get the automagic plugins for other systems besides Apache on Debian.



  • Just finished setting this up on my owncloud server. It took maybe 5 minutes... The only problem is it is an old version of CentOS (6.5) so it is running an outdated version of Python. I really need to update that to the newest version.



  • @coliver said:

    Just finished setting this up on my owncloud server. It took maybe 5 minutes... The only problem is it is an old version of CentOS (6.5) so it is running an outdated version of Python. I really need to update that to the newest version.

    That was supposedly fixed according to the github issue. If not there is a simple workaround to get Python 2.7 on your system. That workaround is how I found out what was missing in a core CentOS 7 install.



  • @JaredBusch said:

    @coliver said:

    Just finished setting this up on my owncloud server. It took maybe 5 minutes... The only problem is it is an old version of CentOS (6.5) so it is running an outdated version of Python. I really need to update that to the newest version.

    That was supposedly fixed according to the github issue. If not there is a simple workaround to get Python 2.7 on your system.

    Yep, they threw an error telling me to please update. Then said to just add the --debug flag to the command. Worked well after that.



  • @JaredBusch said:

    @johnhooks said:

    I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.

    Start SSL is not easy compared to setting up Let's Encrypt. I use StartSSL in a number of places also. It is a solid choice, but Let's Encrypt will completely change things once they work out the kinks and get the automagic plugins for other systems besides Apache on Debian.

    OH most definitely. I haven't used it yet but the how to made it look really simple. I guess I'm just more surprised there aren't more websites with ssl since it's available for free already.

    This is awesome though, esp since it can be scripted or used with an orchestration tool.



  • They are also talking about an easy to use auto-renew tool. Although looking at some of the command flags you could easily do this now without much issue.



  • @johnhooks said:

    @JaredBusch said:

    @johnhooks said:

    I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.

    Start SSL is not easy compared to setting up Let's Encrypt. I use StartSSL in a number of places also. It is a solid choice, but Let's Encrypt will completely change things once they work out the kinks and get the automagic plugins for other systems besides Apache on Debian.

    OH most definitely. I haven't used it yet but the how to made it look really simple. I guess I'm just more surprised there aren't more websites with ssl since it's available for free already.

    This is awesome though, esp since it can be scripted or used with an orchestration tool.

    SSL is not easy yet. Once Let's Encrypt is solid, I highly suspect that Apache and NginX will eventually update to have SSL enabled by default. That is the kind of far reaching impact that I expect out of Let's Encrypt.



  • @johnhooks Yepp! Just link /path/to/your/cert.crt to /etc/letsencrypt/live/your.domain.local/cert.pem and the same for the key / privkey.pem and set it to run every 30 to 60 days. And do your /happy dance.

    I haven't see anything about this though... Is it available for Python on Windows or is it still strictly Linux only?



  • @dafyre said:

    @johnhooks Yepp! Just link /path/to/your/cert.crt to /etc/letsencrypt/live/your.domain.local/cert.pem and the same for the key / privkey.pem and set it to run every 30 to 60 days. And do your /happy dance.

    I haven't see anything about this though... Is it available for Python on Windows or is it still strictly Linux only?

    You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.



  • @coliver said:

    You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.

    I am going to be doing that sometime this week in fact.



  • @JaredBusch said:

    @coliver said:

    You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.

    I am going to be doing that sometime this week in fact.

    Yep, I was looking at it earlier. The PEM keys look like they should be compatible with the Windows Certificate store.



  • @coliver said:

    @JaredBusch said:

    @coliver said:

    You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.

    I am going to be doing that sometime this week in fact.

    Yep, I was looking at it earlier. The PEM keys look like they should be compatible with the Windows Certificate store.

    Then the issue becomes scripting it in such a way that it can be automated on Windows too... Especially since the cert lifetime is only 90 days.



  • @dafyre said:

    @coliver said:

    @JaredBusch said:

    @coliver said:

    You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.

    I am going to be doing that sometime this week in fact.

    Yep, I was looking at it earlier. The PEM keys look like they should be compatible with the Windows Certificate store.

    Then the issue becomes scripting it in such a way that it can be automated on Windows too... Especially since the cert lifetime is only 90 days.

    Yep, that is a concern. I can probably work up a short script on Linux to move the files to a Windows box. Then write a powershell script to replace a certificate file and private key. I'm not sure if you can interact with the certificate store with powershell though.



  • @coliver said:

    @dafyre said:

    @coliver said:

    @JaredBusch said:

    @coliver said:

    You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.

    I am going to be doing that sometime this week in fact.

    Yep, I was looking at it earlier. The PEM keys look like they should be compatible with the Windows Certificate store.

    Then the issue becomes scripting it in such a way that it can be automated on Windows too... Especially since the cert lifetime is only 90 days.

    Yep, that is a concern. I can probably work up a short script on Linux to move the files to a Windows box. Then write a powershell script to replace a certificate file and private key. I'm not sure if you can interact with the certificate store with powershell though.

    It looks like it is possible... http://blogs.technet.com/b/scotts-it-blog/archive/2014/12/30/working-with-certificates-in-powershell.aspx

    Not sure what version of Powershell that is yet... I just glanced over the article and don't see any requirements... I would assume At least PS 3.0 (Article was written Dec 30, 2014)



  • When is ML going to have SSL? There is really not any reason not to do it. Either StartSSL for a 1 year cert of Let's Encrypt.

    Either way, @Minion-Queen , just (make your minions) do it.



  • @JaredBusch said:

    When is ML going to have SSL? There is really not any reason not to do it. Either StartSSL for a 1 year cert of Let's Encrypt.

    Either way, @Minion-Queen , just (make your minions) do it.

    Out of curiosity what is the driver for ML to be encrypted? It isn't highly sensitive data and your password shouldn't be the same as anywhere else. I could understand from a reputation point-of-view but I don't, necessarily, see the technical one.



  • @coliver To protect our login information



  • @anonymous said:

    @coliver To protect our login information

    Right, but why? Do you use your login information for other more secure websites? That is a bad practice even when both websites are using encryption.



  • @coliver said:

    @JaredBusch said:

    When is ML going to have SSL? There is really not any reason not to do it. Either StartSSL for a 1 year cert of Let's Encrypt.

    Either way, @Minion-Queen , just (make your minions) do it.

    Out of curiosity what is the driver for ML to be encrypted? It isn't highly sensitive data and your password shouldn't be the same as anywhere else. I could understand from a reputation point-of-view but I don't, necessarily, see the technical one.

    Because it is entirely possible to tie me to something by dropping a logging mechanism on anything on the internet through which my traffic passes on the journey to and from my computer and ML.

    This is one of the core reasons that Let's Encrypt even exists. Secure everything as it flies around the internet.

    Yes, ML is a public forum and a lot of user information is public by that very nature. But that does not mean everything should be public to every device on the way.

    I am more public than most as I purport (muhaha, am I really Jared Busch?) to use my real name here and not a pseudonym.



  • Case in point... I work for a BIG IT department, where I don't have control over the Firewall, etc, etc. Anything I say can be read by the IPS system at the edge of the campus network, unless it is SSL encrypted (they can do MITM attacks to decrypt that, but they aren't right now).



  • @JaredBusch said:

    @coliver said:

    @JaredBusch said:

    When is ML going to have SSL? There is really not any reason not to do it. Either StartSSL for a 1 year cert of Let's Encrypt.

    Either way, @Minion-Queen , just (make your minions) do it.

    Out of curiosity what is the driver for ML to be encrypted? It isn't highly sensitive data and your password shouldn't be the same as anywhere else. I could understand from a reputation point-of-view but I don't, necessarily, see the technical one.

    Because it is entirely possible to tie me to something by dropping a logging mechanism on anything on the internet through which my traffic passes on the journey to and from my computer and ML.

    This is one of the core reasons that Let's Encrypt even exists. Secure everything as it flies around the internet.

    Yes, ML is a public forum and a lot of user information is public by that very nature. But that does not mean everything should be public to every device on the way.

    I am more public than most as I purport (muhaha, am I really Jared Busch?) to use my real name here and not a pseudonym.

    I have no argument with encrypting everything (I am a supporter of it) but couldn't you be logged by a lower protocol even if the above traffic is encrypted?



  • @dafyre said:

    Case in point... I work for a BIG IT department, where I don't have control over the Firewall, etc, etc. Anything I say can be read by the IPS system at the edge of the campus network, unless it is SSL encrypted (they can do MITM attacks to decrypt that, but they aren't right now).

    Really big ones tend to end the SSL at the wall so that they can see what is inside.