I am amazed that Let's Encrypt has been around for 10 years.
I have used it for many years, but certainly not 10.
I still want to find time to deploy my own CA, but for most external-facing things, I just use Let's Encrypt, and I'm very pleased to be able to do so.
Rob Carlson
in reply to Neil Brown • • •Hugo Mills
in reply to Neil Brown • • •I, too, use Let's Encrypt.
And some day, I'd like to get back all the time that I used to spend generating my own CA, before LE came on the scene.
James Wells
in reply to Neil Brown • • •cacert.org
Welcome to CAcert.org
cacert.orgNeil Brown
in reply to James Wells • • •Amber
in reply to Neil Brown • • •Overview — Dogtag PKI documentation
www.dogtagpki.orgNeil Brown
in reply to Amber • • •JamesB
in reply to Neil Brown • • •Dustin Rue
in reply to Neil Brown • • •Shiri Bailem
in reply to Neil Brown • • •Neil Brown
in reply to Shiri Bailem • • •Shiri Bailem
in reply to Neil Brown • • •Shiri Bailem
in reply to Shiri Bailem • • •Neil Brown reshared this.
Jonathan McDowell
in reply to Shiri Bailem • • •silverwizard
in reply to Neil Brown • •Neil Brown
in reply to silverwizard • • •@silverwizard within the framework of the current approach, LE turned money for old rope into an easy to deploy, automatable, free convenience, IMHO.
Would it be ideal to change the system? Yes!
silverwizard
in reply to Neil Brown • •Neil Brown likes this.
Shiri Bailem
in reply to silverwizard • • •@silverwizard @Neil Brown has anyone actually established a better system really?
Not going to argue that LE doesn't have it's problems, or even just the underlying SSL system in general.
LE thanks to ease and being free without much "competition" it has the crucial problem of hosting far too high a proportion of the the certs for the whole internet.
SSL in general has the problem of CAs getting hacked and issuing fraudulent certs.
Only improvement I can think of in that security at all is maybe double-certified certificates? (require you to go through two wholly separate providers with the same key to have a valid key and requiring both to sign for any updates to go through and maybe a certificate chain for whenever it changes hands)
Beyond that it's always a cludge, people aren't going to check them themselves, they're not going to manage certificates themselves... so you just have a preauthed group of keys installed in your system, trust them to be above board, and then trust the providers of those keys to be above board. Honestly shocked we haven't had more issues, but that's kinda how security goes.
silverwizard
in reply to Shiri Bailem • •Shiri Bailem
in reply to silverwizard • • •silverwizard
in reply to Shiri Bailem • •Shiri Bailem
in reply to silverwizard • • •silverwizard likes this.
Jima
in reply to Neil Brown • • •Neil Brown
in reply to Jima • • •@jima
Neil-scale and enterprise-scale are very different beasts :)
Jima
in reply to Neil Brown • • •Roger Lipscombe
in reply to Neil Brown • • •there's nothing particularly technically complicated about deploying your own CA.
Here's mine: github.com/rlipscombe/elixir-c… (because OpenSSL has terrible UX).
The complicated bits are keeping the private keys safe, auto-renewal, deploying the root certs to your various devices, etc.
But if you want _other_ people to access your servers, you're pretty much restricted to Let's Encrypt (or spending money), because they're not gonna install random root certs.
GitHub - rlipscombe/elixir-certs: Certificate Authority, in Elixir, using 'x509' library
GitHubNeil Brown
in reply to Roger Lipscombe • • •@rogerlipscombe
No, indeed. I've done it before, and just need to find the time to set it up again, secure it, and perhaps automate distribution.
(Yes, only for me accessing my own stuff!)