Letsencrypt letsencrypt.org to offer free SSL

Andy · Nov 20, 2014

letsencrypt.org
Summer 2015
Sounds interesting. Thoughts @eva2000 ?

Andy · Nov 27, 2014

You probably overlook this @eva2000

eva2000 · Nov 27, 2014

Just found it.. interesting indeed

looks like from the info on their site it's for apt-get (Debian/ubuntu) How It Works so I assume they expect the default Debian Apache or Nginx setup APT repository type installs/structure for it to automate ?

Also letsencrypt/lets-encrypt-preview · GitHub confirms it's for Ubuntu and Apache and Thoughts on RPM builds? · Issue #15 · letsencrypt/lets-encrypt-preview · GitHub

Also no support for Wildcards for letsencrypt.org yet Do you support Wildcard Subdomain · Issue #66 · letsencrypt/lets-encrypt-preview · GitHub

So for now I'd probably stick with my US$39/yr Wildcard SSL certificates + Centmin Mod LEMP Nginx SPDY SSL

For convenience and price letsencrypt sounds easy to setup, but if you had 30 subdomains to cover with https, you'd need to setup 30 certificates versus 1x SSL wildcard certificate

eva2000 · Jan 17, 2015

Nice blog commentary The Problems with the Let's Encrypt Project · raindog308

eva2000 · Aug 8, 2015

letsencrypt schedule has been delayed and pushed back Updated Let's Encrypt Launch Schedule

We can’t wait to see websites turn on TLS with Let’s Encrypt. Trust is our most important asset, however, and we need to take the necessary time to make sure our systems are secure and stable.

We’ve decided to push our launch schedule back a bit to give us time to further improve our systems. Our new schedule is:

First certificate: Week of September 7, 2015

General availability: Week of November 16, 2015

In the ten weeks between these two dates we’ll gradually issue more and more certificates. We’ll start by issuing a small number of certs to whitelisted domains and expand our issuance as we gain confidence in our systems (stay tuned for instructions on getting your domains added to our early-access whitelist). When it’s time for general availability we will open up our systems to all requests.

A cross-signature will be in place before general availability. This will allow certificates from Let’s Encrypt to validate automatically for the vast majority of consumers. Prior to cross-signing, browsers will not accept our certificates as valid unless a user has installed our root as trusted.

I want to thank our staff, partners, sponsors, and contributors. We’re making great progress, despite this delay, and it’s all possible due to their hard work.
Click to expand...

rdan · Aug 8, 2015

How is it possible that letsencrypt.org site using Nginx with HTTP/2 draft 14? :/

eva2000 · Aug 8, 2015

RoldanLT said: ↑

How is it possible that letsencrypt.org site using Nginx with HTTP/2 draft 14? :/
Click to expand...

i believe they could be behind a proxy like Google PageSpeed's service with custom headers or something

rdan · Aug 8, 2015

eva2000 said: ↑

Google PageSpeed's service
Click to expand...

I think that service is already closed?

eva2000 · Aug 8, 2015

RoldanLT said: ↑

I think that service is already closed?
Click to expand...

yeah closed August 3, 2015 Turndown information for PageSpeed Service | PageSpeed Service | Google Developers

It could be using another http/2 enabled web proxy as well.

But yeah can't wait to have http/2 added to Nginx

eva2000 · Aug 8, 2015

okay found what they're using - they're using Akamai services https://blogs.akamai.com/2015/02/with-http2-akamai-introduces-next-gen-web.html

When will HTTP/2 be available?

Today!

If you are using an up to date Firefox or Chrome, or are running Internet Explorer on an early release of Windows 10, the odds are that you have been using HTTP/2 (or h2 for shorter) for the past couple of months without realizing it. HTTP/2 Draft 14 has been pushed out and is active on a number of domains. For example, I am drafting this blog post using Chrome on Google Docs happily beaming at the fact that my keystrokes and mouse clicks are shuttling back to Google over HTTP/2. Some other samples to look at:

HTTP/2: the Future of the Internet | Akamai

Let's Encrypt

Google

HTTP/2 is live on our network and is rolling out towards general availability in 2015
Click to expand...

eva2000 · Aug 21, 2015

Hmm read Everyone can make their website HTTPS for free | _ck_ says... and didn't know that letsencrypt intend to expire SSL certificates every 90 days ! so you need to regenerate them every 3 months !

I have like 80+ subdomains covered on SSL wildcard certificates. I am not re-generating 81 letsencrypt certs every 3 months

rdan · Aug 21, 2015

eva2000 said: ↑

expire SSL certificates every 90 days !
Click to expand...

That's really bad.

eva2000 · Aug 21, 2015

from Maximum (and minimum) certificate lifetimes? - Issuance and Renewal - Let's Encrypt Community Support

At launch all certificates will have a lifetime of exactly 90 days. Post launch we will possibly offer more options, but they will likely be on the shorter side rather than the longer side. Part of the rationale for the 90 day number is that when certs are renewed only once a year, a lot can change. The person in charge might forget how to do it, or leave the organization, or change email addresses, etc. A shorter lifetime will hopefully encourage people to automate the renewal process, and we'll provide tools to help with that.
Click to expand...

eva2000 · Aug 26, 2015

more hoops to go through What's the difference between LetsEncrypt and Traditional CA? - Issuance and Renewal - Let's Encrypt Community Support

We also have a precaution that other DV CAs generally don't, where we won't issue a certificate for a domain name that has an existing cert from another CA unless the applicant can prove that they control the key that's the subject of the existing cert. So for example, if there were an existing domain like example.com that had an existing and valid cert in use from Example CA, we would not be willing to issue a new cert for example.com unless the applicant could prove that they had the key that was the subject of the cert issued by Example CA.
Click to expand...

eva2000 · Aug 27, 2015

eva2000 · Aug 29, 2015

Ta da SSL - Letsencrypt SSL certificate on Centmin Mod Nginx HTTP/2 | Centmin Mod Community

eva2000 · Aug 30, 2015

More from Seth at EFF/letsencrypt at Seth Schoen - Let's encrypt! — GNU MediaGoblin

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Letsencrypt letsencrypt.org to offer free SSL

Andy Active Member

Andy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Attached Files:

letsencrypt-client-00.png

letsencrypt-client-01.png

letsencrypt-client-manual-00.png

letsencrypt-290815-00.png

letsencrypt-290815-01.png

letsencrypt-290815-02.png

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Letsencrypt letsencrypt.org to offer free SSL

Andy Active Member

Andy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Attached Files:

letsencrypt-client-00.png

letsencrypt-client-01.png

letsencrypt-client-manual-00.png

letsencrypt-290815-00.png

letsencrypt-290815-01.png

letsencrypt-290815-02.png

eva2000 Administrator Staff Member

.