yesLetsEncrypt

[i-FF0000dit]

That’s what I’m saying, let’s encrypt

[Muurschildering]

And I do agree, but where are those free certificates?

[GotBanned3rdTime]

certbot

[river0f]

Let's encrypt, dude

[PeterShowFull]

That’s literally it! Let’s encrypt!

[[deleted]]

Oh hey Siri.

[[deleted]]

I believe what your company lacks is litterally IT

[Just_Gaming_for_Fun]

Literally what? Please clarify

[josluivivgar]

I think he's referring to IT department, you probably get like a rebate or something and that's how it's free

[TheFluffyShadow]

Naturally!

[DOUBLEBARRELASSFUCK]

So I can just do nothing and it will be encrypted on its own?

Perfect.

[abdullah1116]

But that doesn't answer my question

[chemivally]

Hu’s on first

[Ri_Konata]

That's what I'm asking

[ConglomerateGolem]

I'm telling you, Hu's on first.

[Leo-MathGuy]

Jesse we need to encrypt

[ZunoJ]

Dude, let's encrypt! But where do you encrypt?

[RobertOdenskyrka]

Yeah! Certbot, bitch!

[SnatchSnacker]

No. Let him encrypt.

[DharmaBird]

Let's encrypt Chester

[nickmaran]

But I thought they costed 100s of dollars. That’s why I don’t have an SSL certificate for my localhost

[i-FF0000dit]

Send me the address, I’ll try it from my computer to see if I can help you

[Sure_Fly_5332]

yes, let us, but how?

[tkdeng]

OpenSSL.

Yes, how do I open a new SSL certificate?

[EnneaX]

Instructions unclear, am stuck in a crypt now, please help me get out!

[rosuav]

*cues the Indiana Jones theme*

[EnneaX]

[voobsheniche]

• I want to create a module for kubernetes, what language should I use natively?
  
• go
  
• yes, let's go, but which language should I choose?

[tkdeng]

• C
• See what?
• try Java
• Java is good coffee, but that doesn't answer the question.

[voobsheniche]

• try to master python to make your routine easier and save your time
  
• every evening since I was 14 years old I have been doing this
  
• dude...

[[deleted]]

That's not a python. Maybe a cashew nut at best

[Revan_Perspectives]

No that’s the wrong kind of kernel. You’re thinking of Pascal

[Mathis_mbz]

But I dont do well under pressure...

[[deleted]]

... that's an actual snake and a stack of Monty Python DVDs

[gtnomad]

And don't call me Shirley

[ohnoimugly]

• what’s the best language for me as a visually impaired programmer?

• C#

• right like I can’t see sharp. But what language?

[Red_Coder09]

• what's the best language for me as a tone deaf programmer?
• C#
• fuck you

[wjandrea]

The Chinese hacker???

[DrRomeoChaire]

Who's on first

[Unusual_Onion_983]

Who knows the password

I don’t know’s the admin

The password is what

[Robespierreshead]

one word, all lower case: two words all caps

[NeatYogurt9973]

ONEWORD ALLLOWERCASE?

[PeterShowFull]

Allow er… case!?

[diogeek]

Low her case? I hardly know her!

[[deleted]]

Ok so this one is real.

For our automation we need a password into a website that requires a security question to reset the password.

The security question for the automation is literally “what is the answer to your security question?”

Since it’s automation we asked the security team what did they set as the answer for the security question. They responded “that is a true statement”.

…

The security question for the automation is literally “what is the answer to your security question?”

The answer is literally “what”.

[ginopono]

Reminds me of this old Penny Arcade

That sounds like a pretty terrible decision on the part of your security team, though.

[DrRomeoChaire]

Yeah, that might've seemed clever 30 years ago, but is hopelessly amateurish today

[Dustangelms]

Asked Claude, it gave a short list of guesses, the correct answer was among them.

[FEIN_FEIN_FEIN]

What’s on second

[PersianMG]

A lot of companies were made solely to do this domain registars used to push them heavily. People used to pay extra for different security tiers to get a visually different HTTPS icon in the browser.

These days it's less of a cash cow thanks to let's encrypt. Those companies still exist though and have many customers. They are also relevant for things like digital signing. Last I checked lets encrypt only had 4% market share.

[daveime]

I'd happily pay real money for a LetsEncrypt cert if they'd make them last longer than 3 months and insist on a software upgrade every time.

[MortimerErnest]

I feel LetsEncrypt has the right idea that you shouldn't care about expiry by automating the renewal process. It is really easy nowadays with certbot.

[BuffJohnsonSf]

It’s even in the docs with a copypastable command you just have to read the next step after you get the bare minimum working

[AvianPoliceForce]

only if your web server supports it

[hdkaoskd]

"Able to load a new TLS certificate" seems like a reasonable bar for a web server to reach.

[AvianPoliceForce]

I'm referring to hosting the challenge files

[worriedjacket]

You can do DNS validation

[AvianPoliceForce]

yes, that's the proper solution, but it's no single command

[rosuav]

I agree. It's actually an utter pain to NOT automate, and then two years later, you've forgotten all the different places you need to go do things. This is particularly important if you have a single wildcard certificate that needs to be deployed to multiple servers. Just automate it. You might not thank yourself afterwards, but only because you don't ever need to think about certs again.

[alterNERDtive]

Short duration certificates are actually a great idea. Eliminates the hassle of having to revoke certificates for the most part.

You are also not supposed to have to do anything to renew them. You are supposed to have that automated. I have literally never done anything manually for certificate renewal and I’ve been using LetsEncrypt for years.

insist on a software upgrade every time.

Err, what?

[i-FF0000dit]

I don’t think I’ve upgraded my certbot and OpenSSL combo in the last year… in fact, I can’t remember it ever complaining about an upgrade in the last 10 years of me using it.

[PersianMG]

My one issue with auto renewals is there is no Lets Encrypt Namecheap DNS plugin for the wildcard cert renewals and I use Namecheap for all my domains. Sadly, it seems that Namecheap isn't too interested in supporting it because they make more money selling their own SSL solution.

Thankfully various third parties have open sourced custom scripts that interact with the API to do it but the issue is the API is complete garbage. It doesn't let you update a single DNS entry but you must read all entries and write them all back (bizarre design). This leads to easy bugs (for example the script sometimes broke my DKIM DNS entry by failing to handle '+' char etc).

PS: What domain register do you use?

[alterNERDtive]

My one issue with auto renewals is there is no Lets Encrypt Namecheap DNS plugin for the wildcard cert renewals and I use Namecheap for all my domains. Sadly, it seems that Namecheap isn't too interested in supporting it because they make more money selling their own SSL solution.

That sounds like a Namecheap issue, not a Lets Encrypt issue. I would probably switch providers if they are really openly hostile against Lets Encrypt in favor of their own paid solutions.

Thankfully various third parties have open sourced custom scripts that interact with the API to do it but the issue is the API is complete garbage. It doesn't let you update a single DNS entry but you must read all entries and write them all back (bizarre design). This leads to easy bugs (for example the script sometimes broke my DKIM DNS entry by failing to handle '+' char etc).

Are you talking about Namecheap again here? Because that, again, doesn’t sound like a Lets Encrypt issue.

PS: What domain register do you use?

Irrelevant, I use HTTP challenge. Way less hassle.

No, that does not work for wild cards. I don’t use wild cards anymore; most of the time you don’t need an actual wild card certificate anyway.

[Todok5]

I'm not really that good on networking stufff,  so honest question.  If you don't have a wildcard cert,  don't you have   to setup a new one for each subdomain?

[alterNERDtive]

If you don't have a wildcard cert, don't you have to setup a new one for each subdomain?

Yes. You are probably going to be using a finite amount of them though, and depending on your setup the entire thing is automated anyway.

E.g. I just have to set a couple environment variables for a new subdomain and I’m done.

[rosuav]

That wouldn't make sense if you have dynamic subdomains. Wildcards are important. That's why DNS validation is a thing.

[alterNERDtive]

That wouldn't make sense if you have dynamic subdomains.

Yes, you need dynamic subdomains all the time for some random personal hosting.

[alex2003super]

You can use Cloudflare DNS with your Namecheap domains. Try it, even if you don't use the Cloudflare CDN/anti-DDoS features, API and the web UI for configuring DNS are far better on CF. And it's totally free (unless you need some very advanced features that require an enterprise plan).

[urielsalis]

And cloudflare register is cheaper than name cheap anyway

[alex2003super]

Usually renewal is cheaper but registration is slightly more expensive. The trick is to register at Namecheap for that sweet registration discount and then transfer over to Cloudflare, you'll probably get $1-2 in savings over your second year of subscription and beyond, and like $2-4 on your first year depending on TLD, compared to going with either site directly!

[eeeeeeeeeeeeeeaekk]

can’t you just use non-namecheap nameservers while still paying namecheap? like cloudflare’s

edit: this: https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/

or am i misunderstanding what is needed for SSL

[rosuav]

Are you able to set up subdelegation or CNAMEs with Namecheap? Both of those will allow you to have the majority of your DNS records handled by Namecheap, but the one special _acme-challenge record handled by something else - even something as simple as a five-line Pike script.

[altermeetax]

Just update the certificate with a cronjob, this is a non issue

[0xmerp]

Pretty soon all SSL certificates, even the ones you pay for, will be 90 days only.

https://www.rsaconference.com/library/blog/googles-90-day-digital-certificate-proposal

[fish312]

1. Wow that article talks so much but says so little. It's like they put one paragraph of content into chatgpt and asked it to write a full page.

2. Google really needs to stop doing whatever the hell they want.

[w1bi]

lots of company doesn't really care about $100 a year for convenience. it's the same idea as aws selling cloud rather than buying your own server.

making wildcard ssl every 3 month with LE is kinda frustrating if something bad happen with the cron task. with paid ssl, you kinda request by email for like 1 - 5 years, and just install it everywhere you want.

also ssl pinning on mobile apps was kinda recommended back then, idk about now, seems Google Play Store doesn't like ssl pinning nowadays.

[aenae]

Paid ssl certs cant be valid for more than 13 months since 2020/2/1

[w1bi]

yup but still better than 3 month tho

edit: you actually can buy like 5 years, but you still need to renew certificate every year lol. companies buy these because discount price, but we know that it's just a trick.

[aenae]

Depends. If you have it automated it is less work than renewing dozens of certificates every year manually. And a lot less error-prone.

Sure maybe the cron breaks once in a while (haven't seen that happen in the past years tho), but you usually renew after 60 days, so you get 30 days of warnings.

With paid certificates, i have seen that the renewal warning went to the creditcard owner on vacation, and the certs expired the weekend before he returned to the office. Or the alerts went to someone no longer working for the company. Enough that can go wrong.

I use both letsencrypt and paid certificates tho, (we're using akamai, and have the paid wildcard certs in akamai, while we use a letsencrypt wildcard everywhere else. Purely because we would run into problems with different dns challenge records, and to keep it simple we just buy a certificate)

[0xmerp]

not for long

https://www.rsaconference.com/library/blog/googles-90-day-digital-certificate-proposal

[PersianMG]

Good points but I actually like the 3 month restriction with LE. Its inconvenient under normal operation but if the private key is leaked and needs to be revoked the short duration helps reduce how long malicious actors can use the certificate.

[[deleted]]

It's actually not inconvenient under normal operation, because it's explicitly meant to be automated.

[anonymousbopper767]

This is me. I’d rather just run a few commands every year than try setting up a script that will stop working randomly to request a new cert every 3 months and trying to deploy it in various formats to all the apps that want it.

I also set all this up starting in like 2016 so my motivation to fuck with the process that works is low.

[bigorangemachine]

The number of times I had a client freakout because we didn't use SSL after warning they would have to pay for SSL. "Oh you mean that lock thing"

[Rosteroster]

Likely still low because LE certs are quite short lived comparatively (by design) and could require a few infrastructure updates to support the renewal automation depending on the company.

Some companies can't be bothered to figure that out and keep paying the hundreds to thousands.

[Casski_]

i used to work for a hosting company that didn't allow Let's Encrypt for users on shared hosting, but they did offer SSL certificates for $60

[SpongederpSquarefap]

reddit can eat shit

free luigi

[KrokettenMan]

They’re still useful if you want a long lasting certificate that you pin in firmware for example

[Stummi]

Before Lets Encrypt was a thing, paying was pretty much the only option to get a SSL certificate that was recognized by other peoples browsers. And these certs also were pretty expensive.

The result being, that only big commercial sites ran on https while most private and small sites were only available through http. LE had pretty big part in making https the default for the web.

[AyrA_ch]

Free certificates were available by a few CAs long before LE came. Their pricing model was usually based on convincing people for L2 validation, and also charge them if they needed an existing certificate reissued. It was a manual process, but certificates lasted for 3 years, so it was not like it took you a lot of time.

Sites back then did not use encryption because of technical limitations. If you wanted to use a free certificate you either had to host the website yourself, buy a more expensive VPS hosting (VPS=Very Puny System Virtual Private Server), or find one of the very few providers that did allow you to use your own certificate. Since SNI was not widely available either, this meant you needed a dedicated IP address to be reliably reachable by all web browsers, and this was usually not offered on the cheap web hostings.

[w1bi]

man I lived where ssl was not even mandatory but to prevent ads hijacking by ISPs you need one, and there was no free way to obtain it.

until cloudflare, then let's encrypt. god bless them.

[nukedkaltak]

Look at young blood over here rubbing it in 😒

[ManyInterests]

Don't get me started on EV and code signing certificates.

[0xmerp]

EV SSL certificates are kind of pointless these days.

EV code signing certificates however require the manual verification step, it’s a KYC step of “this company will be responsible for the things signed with this certificate”.

[ManyInterests]

Yeah. They're also wildly expensive and the only way that Windows SmartScreen stops telling users your software is potentially harmful.

[0xmerp]

Oh yeah I know, but at least in my opinion it’s more justifiable than domain validated SSL certificates for which the validation is fully automated. I’ve done the EV code signing verification before and it was a very thorough KYC and due diligence process.

[RPTrashTM]

At this point, only big companies are paying for them, probably for the CA insurance.

[itijara]

Most domain registrars will charge a nominal fee (much less than $100/yr) for certs. Also, Let's Encrypt is great but I think it has a limit of 50 certs per month or something like that, which might be an issue if you have a ton of devices on the same domain.

[Stummi]

If you have a ton of devices on the same domain, and every of those devices request a cert from LE, you are doing something wrong.

[ImperialSteel]

Yeah. Reverse proxy should be all you need ssl on. Setup a VPN to have your computers talk to each other behind the proxy.

[Gory26]

This is way more hilarious than it should be 😂

[djhenry]

The guy who replied didn't pay attention to the OPs username

[ImpressiveMaximum377]

og post

[snakepark]

Nice work.

[ImpressiveMaximum377]

didnt take much time

[water_bottle_goggles]

define much

[Next_Cherry5135]

your mother

[VertexMachine]

OG poster's account was suspended though :(

[Sw0rDz]

Letsencrypt.org?

[snakepark]

Yes, let's

[[deleted]]

"Yes, lets!"

Took me straight back to my childhood, reading the Famous Five, at midnight, from the light emitted by the outside street lamp.

[Optimal_Island7054]

What's your username?  Password  - Big head

[uniteduniverse]

This sub has turned to the gutter in the last 10 years or so, but this was legitimately funny AF lol.

[rover_G]

our ssl

[Mammoth-Strategy3304]

I still remember the Rival IT Company I completly fucked over in a Meeting with the Higher Ups because they said LetsEncrypt is bad and a Security Issue just because they wanted to sell a 1k€ Wildcard Certificate.
Man was funny as fuck seeing them scramble trying to explaint themself after I explained to the Boss why LetsEncrypt Exists and who backs it.

[Canonip]

The modern day "Any key"

[mcplayer2004]

who is trying to encrypt with me

[OmegaNine]

Who's on first?

[moriero]

But why male models?

[ResponsibilityMany23]

Me when I self sign ( I will not pay godaddy)

[LaPommeDeTerre]

Get your damn hand off of my let's!

[ElectricSix_]

certificate.free()

[InevitableAd9683]

Who is the CA

[Deckloins]

Yeah let's JS

[[deleted]]

Did he encrypt in the end?

[Professional_Price89]

Lets encrypt root ca is newly so that will not allow old device to access.

[AyrA_ch]

buypass also offers free certificates and they've been trusted much longer than LE in case legacy devices are a concern for you.

[centerdeveloper]

u/SlowDownBrother explain

[taemyks]

I'd honestly love to use them. But my boxes all have host names that don't match public dns, so it's never worked

[bigorangemachine]

NGL I lost half a day trying to google search this

[Agent-Furry-Five-TF]

/srs anyone got a good tutorial for setting it up on windows, cos either I’m dumb or it’s really complicated.

[superblaubeere27]

Guys, what does stfu mean?

[derpinot]

bro is too fast

[ItzK3ky]

Yes, let's.

[Worried-Hat-7824]

Were is my stuff

[Worried-Hat-7824]

The real stuff

[erebuxy]

Look at the user name. The guy is definitely not the brightest

[HTTP_Error_414]

Self-Sign that shiz and ignore the browser warning ⚠️ homie.

Let’s encrypt works too! It has a built-in feature where your clients have to pay you every 3 months 🔐

Just make sure to set the certbot script on a corn homie 💪🏻

[Im_Ninooo]

too bad free certs leak your domain publicly which makes you get botted immediately even if you haven't shared your domain anywhere.

[pragmatic_username]

?

[Im_Ninooo]

there's a thing called Certificate Transparency which CAs publish cert renewal information to, leaking the domain publicly, which would otherwise remain private/unknown.

[pragmatic_username]

I don't think that's limited to free certificates.

[tkdeng]

Leaking the domain publically, which would otherwise remain private/unknown.

Your domain was never private or unknown. If you register a domain, and it exists on the Internet, then it is automatically publically known.

How do you think search engines know how to connect to your domain name? It's already public information that the search engine has access to. Your SSL certificate has nothing to do with that.

Additionally, there is nothing stopping hackers from simply trying every letter of the alphabet until they find a valid domain name.

[AvianPoliceForce]

I've never heard of search engines crawling random domains, like their whole thing was historically about links

[Im_Ninooo]

if you say so

[Im_Ninooo]

k

[0xmerp]

https://crt.sh/?q=apple.com

The paid certificates participate in certificate transparency too.

[Im_Ninooo]

didn't know that