How Big Will the Impact of Lets Encrypt Be?
-
Linux.com gets philosophical looking at the Let's Encrypt initiative positing that LE might be the single biggest advancement in end user security of the decade.
This week the project takes a huge step toward that future with its Public Beta. After issuing more than 25,000 certificates during the Private Beta, anyone can now get a certificate for free. Our Security Director Emily Ratliff participated in the Private Beta and reports that “the whole Let's Encrypt process took much less time than getting and installing an SSL certificate in the traditional manner. It is also much less error prone since it is more automated with fewer steps.”
-
Definitely going to be a big impact. LE is going to seriously shake things up.
-
Let's Encrypt isw certainly much easier than traditional SSL certificate methods. The part that is going to be a game changer is the fact that each request creates a single certificate. This means a single request with multiple domains can be done. This will replace all of the UCC certs people use for things like email.
No more of this:
https://i.imgur.com/L27efaL.jpg -
I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.
-
I've used StartSSL before. It's rather a significant pain. What surprises me more is that StartSSL never decided to just be more user friendly.
-
I have been buying them from NameCheap with my domains, just $1.99 each when you purchase a domain.
-
LetsEncrypt is super easy. Especially if you are running Linux systems... Generate cert, and in some cases, it can automagically configure Apache for you. Right now, I've got one cert up on my NGinx box at home, and another cert up on my C@C Server.
-
@anonymous said:
I have been buying them from NameCheap with my domains, just $1.99 each when you purchase a domain.
You can get SSL from GoDaddy for similar prices when you get it new. It is the renewal where they make profit.
-
@johnhooks said:
I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.
Start SSL is not easy compared to setting up Let's Encrypt. I use StartSSL in a number of places also. It is a solid choice, but Let's Encrypt will completely change things once they work out the kinks and get the automagic plugins for other systems besides Apache on Debian.
-
Just finished setting this up on my owncloud server. It took maybe 5 minutes... The only problem is it is an old version of CentOS (6.5) so it is running an outdated version of Python. I really need to update that to the newest version.
-
@coliver said:
Just finished setting this up on my owncloud server. It took maybe 5 minutes... The only problem is it is an old version of CentOS (6.5) so it is running an outdated version of Python. I really need to update that to the newest version.
That was supposedly fixed according to the github issue. If not there is a simple workaround to get Python 2.7 on your system. That workaround is how I found out what was missing in a core CentOS 7 install.
-
@JaredBusch said:
@coliver said:
Just finished setting this up on my owncloud server. It took maybe 5 minutes... The only problem is it is an old version of CentOS (6.5) so it is running an outdated version of Python. I really need to update that to the newest version.
That was supposedly fixed according to the github issue. If not there is a simple workaround to get Python 2.7 on your system.
Yep, they threw an error telling me to please update. Then said to just add the --debug flag to the command. Worked well after that.
-
@JaredBusch said:
@johnhooks said:
I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.
Start SSL is not easy compared to setting up Let's Encrypt. I use StartSSL in a number of places also. It is a solid choice, but Let's Encrypt will completely change things once they work out the kinks and get the automagic plugins for other systems besides Apache on Debian.
OH most definitely. I haven't used it yet but the how to made it look really simple. I guess I'm just more surprised there aren't more websites with ssl since it's available for free already.
This is awesome though, esp since it can be scripted or used with an orchestration tool.
-
They are also talking about an easy to use auto-renew tool. Although looking at some of the command flags you could easily do this now without much issue.
-
@johnhooks said:
@JaredBusch said:
@johnhooks said:
I still can't believe there aren't more people using the free StartSSL certificates. It is kind of a pain to get through the interface, but for the small amount of time it takes, it's a good trade off.
Start SSL is not easy compared to setting up Let's Encrypt. I use StartSSL in a number of places also. It is a solid choice, but Let's Encrypt will completely change things once they work out the kinks and get the automagic plugins for other systems besides Apache on Debian.
OH most definitely. I haven't used it yet but the how to made it look really simple. I guess I'm just more surprised there aren't more websites with ssl since it's available for free already.
This is awesome though, esp since it can be scripted or used with an orchestration tool.
SSL is not easy yet. Once Let's Encrypt is solid, I highly suspect that Apache and NginX will eventually update to have SSL enabled by default. That is the kind of far reaching impact that I expect out of Let's Encrypt.
-
@johnhooks Yepp! Just link /path/to/your/cert.crt to /etc/letsencrypt/live/your.domain.local/cert.pem and the same for the key / privkey.pem and set it to run every 30 to 60 days. And do your /happy dance.
I haven't see anything about this though... Is it available for Python on Windows or is it still strictly Linux only?
-
@dafyre said:
@johnhooks Yepp! Just link /path/to/your/cert.crt to /etc/letsencrypt/live/your.domain.local/cert.pem and the same for the key / privkey.pem and set it to run every 30 to 60 days. And do your /happy dance.
I haven't see anything about this though... Is it available for Python on Windows or is it still strictly Linux only?
You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.
-
@coliver said:
You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.
I am going to be doing that sometime this week in fact.
-
@JaredBusch said:
@coliver said:
You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.
I am going to be doing that sometime this week in fact.
Yep, I was looking at it earlier. The PEM keys look like they should be compatible with the Windows Certificate store.
-
@coliver said:
@JaredBusch said:
@coliver said:
You could make the keys in Linux and move them to a Windows box. They don't seem to support Windows yet though.
I am going to be doing that sometime this week in fact.
Yep, I was looking at it earlier. The PEM keys look like they should be compatible with the Windows Certificate store.
Then the issue becomes scripting it in such a way that it can be automated on Windows too... Especially since the cert lifetime is only 90 days.
