Let's Encrypt
letsencrypt.org
Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report.

Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

  • kaotic@lemmy.worldEnglish
    0·
    8 months ago

    A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.

    • pagenotfound@lemmy.worldEnglish
      0·
      8 months ago

      I love it when companies are too stubborn to update their costs despite the necessity changing over the years.

      My previous employment kept buying microsoft office license keys despite us already moving to 365. They probably did it out of habit when buying new computers. Needless to say I have a cardstack of license keys at home lol. Granted it’s for Office 2013 but I don’t really need the latest version for basic document processing.

    • dan@upvote.auEnglish
      0·
      8 months ago

      TLS certificates have huge margins, so web hosts love selling them.

  • fiendishplan@lemmy.worldEnglish
    0·
    8 months ago

    I worked for a company we had 300 websites, the boss wanted to buy certs. I told him about Lets Encrypt. He loved the idea it saved us a bunch of money. I suggest we donate $100 to them. Hes says “NO F-ing way!”.

  • max55@lemm.eeEnglish
    0·
    8 months ago

    That’s very great news! Thank you for all the good work!

  • jj4211@lemmy.worldEnglish
    0·
    8 months ago

    Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as “it’s not as secure as a traditional CA”.

    • EnderMB@lemmy.worldEnglish
      0·
      8 months ago

      It’s sad that these arguments are still being shared. It was the same arguments years ago from people that would just assume that a free cert was inherently unsafe.

    • bfg9k@lemmy.worldEnglish
      0·
      8 months ago

      I’d love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs

      • dan@upvote.auEnglish
        0·
        8 months ago

        I’d also argue that the fact that it’s 100% automated and their software is open source makes it objectively more secure. On the issuing side, there’s no room for human error, social engineering, etc.

  • __matthew__@lemmy.worldEnglish
    0·
    8 months ago

    Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let’s Encrypt.

    I probably need more positivity in my life 😂

  • DigitalDilemma@lemmy.mlEnglish
    0·
    8 months ago

    Sleeping too well lately? Consider this:

    If LetsEncrypt were to suffer a few weeks outage, how much of the internet would break?

      • DigitalDilemma@lemmy.mlEnglish
        0·
        8 months ago

        It won’t be that simple.

        For starters, you’re assuming t-zero response. It’ll likely be a week before people worry enough that LE isn’t returning before they act. Then they have to find someone else for, possibly, the hundreds or thousands of certs they are responsible for. Set up processes with them. Hope that this new provide is able to cope with the massive, MASSIVE surge in demand without falling over themselves.

        And that’s assuming your company knows all its certs. That they haven’t changed staff and lost knowledge, or outsourced IT (in which case they provider is likely staggering under the weight of all their clients demanding instant attention) and all that goes with that. Automation is actually bad in this situation because people tend to forget how stuff was done until it breaks. It’s very likely that many certs will simply expire because they were forgotten about and the first thing some companies knows is when customers start complaining.

        LetsEncrypt is genuinely brilliant, but we’ve all added a massive single point of failure into our systems by adopting it.

        (Yeah, I’ve written a few disaster plans in my time. Why do you ask?)

        • Zangoose@lemmy.worldEnglish
          0·
          8 months ago

          Piggybacking off this comment because I completely agree with it.

          Did we not learn anything from CrowdStrike? If a comparatively simple fix was able to wipe out half the world, how would something that requires an active choice (where to get certs from) not completely cripple all of our infrastructure?

    • FMEEE@lemmy.dbzer0.comEnglish
      0·
      8 months ago

      Today it’s just more or less stupid to buy SSL you can get one extremely easy for free from Let’s Encrypt or Google Trust…

    • bfg9k@lemmy.worldEnglish
      0·
      8 months ago

      My last cert renewal was $20 for 3 years. That’s less than a dollar a month, not exactly breaking the bank.

    • NιƙƙιDιɱҽʂ@lemmy.worldEnglish
      0·
      8 months ago

      HTTPS certs used to be very expensive and technically complicated, making it out of reach for most smaller orgs. Let’s Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.

      • dan@upvote.auEnglish
        0·
        8 months ago

        They also made it a open protocol (the ACME protocol), so now there’s a bunch of certificate providers that implement the same protocol and thus can work with the same client apps (Certbot, acme.sh, etc). I know Sectigo and GoDaddy support ACME at least. So even if you don’t use Let’s Encrypt, you can still benefit from their work.

      • rottingleaf@lemmy.worldEnglish
        0·
        8 months ago

        And it shouldn’t have been, SSL PKI is an intentionally rigged architecture. It’s intended for nation-states to be able to abuse it.

        I’d like much more some kind of overlay encryption over HTTP based on web of trust and what not. Like those distributed imageboards people were trying to make with steganography in emotion.

        It’s a trap. Everybody is already in it and it has already been activated, so - the discussion would be of historical interest only.

  • jagged_circle@feddit.nlEnglish
    0·
    8 months ago

    Lots of people shitting on stories of people who buy certs.

    You do still have to buy a cert if you want one for a .onion. Let’s encrypt still doesn’t support it :(

  • laxe@lemmy.worldEnglish
    0·
    8 months ago

    Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.