Happy birthday to Let’s Encrypt !
Huge thanks to everyone involved in making HTTPS available to everyone for free !
SSL Certs were so god awful before certbot that it’s hard to explain now that it’s so easy and free.
Let's Encrypt is 10 years old today !
Submitted 2 days ago by pcouy@lemmy.pierre-couy.fr to technology@lemmy.world
Comments
specialseaweed@sh.itjust.works 2 days ago
whome@discuss.tchncs.de 2 days ago
Also fucking expensive
pressanykeynow@lemmy.world 2 days ago
And it changed the Internet, for good and a lot.
somenonewho@feddit.org 2 days ago
Damn! That’s definitely a “I’m old” moment for me. I still remember when I first heard about the concept and I remember setting it up the first time on a self hosted project (which seemed harder back then).
Awesome project!
kaotic@lemmy.world 2 days ago
A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.
dan@upvote.au 1 day ago
TLS certificates have huge margins, so web hosts love selling them.
__matthew__@lemmy.world 2 days ago
Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let’s Encrypt.
I probably need more positivity in my life 😂
jj4211@lemmy.world 1 day ago
Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as “it’s not as secure as a traditional CA”.
bfg9k@lemmy.world 1 day ago
I’d love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs
dan@upvote.au 1 day ago
I’d also argue that the fact that it’s automated and their software is open source makes it objectively more secure. On the issuing side, there’s no room for human error, social engineering, etc.
EnderMB@lemmy.world 1 day ago
It’s sad that these arguments are still being shared. It was the same arguments years ago from people that would just assume that a free cert was inherently unsafe.
0x01@lemmy.ml 2 days ago
Man I love let’s encrypt, remember how terrible ssl was before the project landed?
dan@upvote.au 1 day ago
I remember the days when each site that wanted to use SSL had to have a dedicated IP.
nek0d3r@lemmy.world 2 days ago
And my parents still buy SSL certs because that’s just what they know 🤢
bfg9k@lemmy.world 1 day ago
My last cert renewal was $20 for 3 years. That’s less than a dollar a month, not exactly breaking the bank.
FMEEE@lemmy.dbzer0.com 2 days ago
Today it’s just more or less stupid to buy SSL you can get one extremely easy for free from Let’s Encrypt or Google Trust…
NikkiDimes@lemmy.world 2 days ago
Yeah, I uh…I think that’s kinda what this whole conversation here is about
nek0d3r@lemmy.world 2 days ago
I’ve tried explaining to them before, but they think that it’s a scam because it’s free lol
RoyaltyInTraining@lemmy.world 2 days ago
Let’s Encrypt is amazing, but are there any equally trustworthy alternatives people could switch to if something bad happens to it?
treadful@lemmy.zip 2 days ago
They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it’s so difficult and expensive.
xthexder@l.sw0.com 2 days ago
Well, it’s difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.
fmstrat@lemmy.nowsci.com 2 days ago
If it begins to enshitify, someone will quickly take up the helm. It’s become so core now that someone like Cloudflare would just be like “We do this now.”
CosmicTurtle0@lemmy.dbzer0.com 2 days ago
Cloudflare sort of provides this now by being a MITM to secure your site between your server and the end user. But this requires you and your end user to trust Cloudflare.
And fwiw the ACME protocol is open so anyone can implement it. I believe even the ACME software that EFF sends out allows you to choose your server with some configuration.
dan@upvote.au 1 day ago
I think Cloudflare enshittifying is a bigger risk that Let’s Encrypt.
dan@upvote.au 1 day ago
ZeroSSL, plus a few paid companies support ACME (I know Sectigo and GoDaddy do). Sure, the latter are paid services, but in theory you can switch to them and use the exact same setup you’re currently using with Let’s Encrypt.
Laser@feddit.org 2 days ago
Maybe ZeroSSL
Redjard@lemmy.dbzer0.com 2 days ago
They don’t offer wildcard certs, but otherwise I think they are.
I wanna say acme.sh defaults to them.
laxe@lemmy.world 2 days ago
Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.
JohnyRocket@discuss.tchncs.de 2 days ago
It doesn’t say on the website but on their anniversary day you can get 100% free ssl certs!
zerozaku@lemmy.world 2 days ago
Can anyone fill me on this? Why is it so significant?
NikkiDimes@lemmy.world 2 days ago
HTTPS used to be very expensive and out of reach for most smaller orgs. Let’s Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.
dan@upvote.au 1 day ago
They also made it a open protocol, so now there’s a bunch of certificate providers that implement the same protocol and thus can work with the same client apps (Certbot, acme.sh, etc).
EngineerGaming@feddit.nl 2 days ago
It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn’t have been so omnipresent.
noxy@yiffit.net 2 days ago
Underrated. Stuff rocks.
digdilem@lemmy.ml 2 days ago
Sleeping too well lately? Consider this:
If LetsEncrypt were to suffer an extended outage - say a month, how much of the internet would break?
piccolo@sh.itjust.works 1 day ago
If you have a fully automated setup. Youll have 30 days to migated the fallout.
digdilem@lemmy.ml 1 day ago
It won’t be that simple.
For starters, you’re assuming t-zero response. It’ll likely be a week before people worry enough that LE isn’t returning before they act. Then they have to find someone else for, possibly, the hundreds or thousands of certs they are responsible for. Set up processes with them. Hope that this new provide is able to cope with the massive, MASSIVE surge in demand without falling over themselves.
And that’s assuming your company knows all its certs. That they haven’t changed staff and lost knowledge, or outsourced IT (in which case they provider is likely staggering under the weight of all their clients demanding instant attention) and all that goes with that. Automation is actually bad in this situation because people tend to forget how stuff was done until it breaks. It’s very likely that many certs will simply expire because they were forgotten about and the first thing some companies knows is when customers start complaining.
LetsEncrypt is genuinely brilliant, but we’ve all added a massive single point of failure into our systems by adopting it.
(Yeah, I’ve written a few disaster plans in my time. Why do you ask?)
dan@upvote.au 1 day ago
Shouldn’t be too difficult to swap it out for ZeroSSL. You’d need to remember to update CAA records though.
max55@lemm.ee 1 day ago
That’s very great news! Thank you for all the good work!
crusa187@lemmy.ml 2 days ago
Yay for their glorious, free trusted ssl certs. Love this project!
fiendishplan@lemmy.world 1 day ago
I worked for a company we had 300 websites, the boss wanted to buy certs. I told him about Lets Encrypt. He loved the idea it saved us a bunch of money. I suggest we donate $100 to them. Hes says “NO F-ing way!”.