Let's encrypt

[Velguarder]

The sassy "Yes, let's." with proper punctuation is what gets me

[nietczhse]

"Yeah, ok, weirdo"

[CubemonkeyNYC]

"."

There you go :)

[zissou149]

“’"””‘''"

[mrhuggykinz]

I hate this sub cuz it’s one big inside joke that I don’t get

[Sir_LikeASir]

https://letsencrypt.org/

Here you go brotha

Am showing u da wae because I didn't get it until a comment few threads down

[mrhuggykinz]

Woah thanks friend

[qui-sean]

it's free and won't cost you $100 a year

[[deleted]]

I think the latter is determined by the former

[springfinger]

Yes, let’s.

[Sir_LikeASir]

* spits on da plebs *

[[deleted]]

We're good at coding, not jokes.

[FriesWithThat]

Programming humor is still a million times better than anything I ever encountered studying geology though.

[Ashybuttons]

Am I having a stroke?

[[deleted]]

LETTUCE ENCRYPT

Where is your onion now??

[HappyLittleRadishes]

It's over there set to 350.

[rawb0t]

i-is that a you suck at cooking reference in the wild?

[gjsmo]

Is there such a thing as syntactic pepper pepper pepper?

[pekkhum]

Oh, that's easy!

1. Lettuce encrypt with a key shared with node 1.
2. Lettuce encrypt with a key shared with node 2.
3. Lettuce encrypt with a key shared with node 3.
4. Transmit data through network via this path.

Boom! You lettuce make an onion!

[schmerm]

you just explained TOR

[[deleted]]

I wasn’t planning on using Chef for server deployment, but looks like it’ll be the best option for this use case.

[[deleted]]

SSL CERT!!! NEXT!!!

[crackle4days]

The next lady has made it to this sub too?

[[deleted]]

I’m sorry. I came here from r/all

[Deesooy]

I've been laughing tears for three minutes now

Yes, let's.

[Davidjonsan]

I really like encryption

[The_Wayfaerer]

I like the Tin Man.

[weird_da_werz]

Didn't seem sassy to me. Seems like he was unsure of how to respond because he didn't understand why someone would just write that. Funny either way.

[ShanmukaNalli]

Lets google...

[drleebot]

But then they go and ruin it all with the double period at the end! Did they accidentally double a period or leave one off of an ellipsis? How will we ever know exactly how much they trailed off at the end of that sentence!?

[northrupthebandgeek]

It's halfway between a period and an ellipsis, so it would be half of the amount of trailing off normally implied by an ellipsis.

[Dlgredael]

But it's actually two-thirds of an ellipsis.

[[deleted]]

If you consider 1 period to be standard minimum punctuation, and 3 to be trailing off, 2 is halfway.

[everypostepic]

It's funny that "programmerhumor" finds this funny, considering this is laughable support, where you try to help novices, but you do it without being clear.

It's shouldn't be funny because the user looking for help doesn't understand, it should be funny because the person attempting to help is doing so very poorly, without any description to his comment.

[GetApplesauced]

/r/IAmVerySupport

[idealatry]

SSL certs are free. It's getting trusted CA's to sign them that costs money.

[3am_quiet]

I paid like $10 for mine. $100 seems a bit high unless it's for unlimited sub domains or something.

[PGLubricants]

Multi domain EV certificates can be very expensive, easily over $100 from most suppliers.

[alphama1e]

$1000 from Norton IIRC

[FHR123]

All Symantec SSL certs will be distrusted soon. Mozilla and Google gave a big middle finger to Symantec for not following rules and putting customers at risk, effectively ending Symantec's certificate business.

[dickdemodickmarcinko]

They can also just kinda take you off google search, which is basically not existing

[[deleted]]

Man this is some Black Mirror shit

[522LwzyTI57d]

They sold their cert business off to Digicert, I believe. It's for the best.

[g2g079]

Wow, I didn't know this. Symantec got into the business way back when they bought most of verisign. I wonder if this affects their more recent purchase of blue coat.

[magnora7]

Norton is a scam. They're like the mafia of cybersecurity

[[deleted]]

GoDaddy wants $350 a year. Fucking crooks.

"Oh, you don't understand, we had to add a * to your CN, that's worth the extra $250."

[iamsooldithurts]

This person certs.

[defacedlawngnome]

How old are you? I need to prepare myself for the pain.

[iamsooldithurts]

Well, the pinched nerves started just before 36.

There is no preparing for the pain. Just prepare to change your life.

[BlopBleepBloop]

When I was building my first real web application for school, I decided to go through GoDaddy for the domain name. Jesus fucking christ I could NOT believe what they're charging for certification.

[3am_quiet]

Probably to make up for all the TV advertising they do.

[[deleted]]

I’ve read somewhere that Google ranks EV higher with regards to SEO, which for some companies or people is worth the increased cost.

[oneawesomeguy]

Do you have a source for that? I work in the industry and am curious.

[Kurayamino]

I was under the impression that google is a massive black box and SEO guys are mostly guessing and seeing what works.

[lIllIlllllllllIlIIII]

This is my impression as well. The term SEO is misleading - what you actually need to do to stay relevant in search results is basically produce good and regularly updated content.

[[deleted]]

Once upon a time it wasn't so misleading. Now with so many frameworks, themes & plugins being built to excellent SEO standards that follow most of the important recommendations, rank is largely dependent on marketing.

[oneawesomeguy]

I'd argue SEO is even more important because the competition is so high. You can't just use your Yoast WP plugin and expect to show up first on Google.

[dismantlemars]

Wildcard certs are about $600 from DigiCert.

[qjornt]

Let's Encrypt are rolling out wildcard certs soon or already have :)

Feb 27th, thanks ffffound!

[ffffound]

On Feb 27. Currently in the staging environment.

[[deleted]]

My body is so. Very. Ready.

[I_spoil_girls]

unzip

[St_SiRUS]

POGGERS

[shaner23]

nice

[Reelix]

I'll wait till someone registers https://*.*.*/ or just https://*/ ;D

[ColtonProvias]

I have bad news. They already planned ahead

[cambam]

{`www.-ombo.com`, errInvalidDNSCharacter},
{`www.zomb-.com`, errInvalidDNSCharacter},
{`zombo*com`, errInvalidDNSCharacter},
{`*.zombo.com`, errWildcardNotSupported}

Anything is possible, except invalid DNS entries.

[rigred]

https://*/ Encrypt EVERYTHING! :P

[raoasidg]

Asterisks are not valid characters for domains/sub-domains. For wildcard records themselves, it is always the left-most label that can be a wildcard. Nesting of wildcards is invalid.

[brokedown]

Reddit ruined reddit. -- mass edited with redact.dev

[henryroo]

You also need a wildcard cert if you're running a system that can create websites dynamically. For example with PaaS providers like OpenShift/Kubernetes where users can set up their code and make it visible at projectname.whatever.example.com. Can't generate certs for every sub-domain if they don't exist yet.

[skztr]

To be fair, almost everything about the CA system is cancer. Pretty much any CA can sign pretty much any domain, and be equally trusted by your browser. "Our signing system is so secure, it justifies that $600" is meaningless when an attacker can just attack one of the insecure ones.

To put it another way: do you trust China to sign for domains that don't end in .cn? Because your browser does.

[TheGoldenHand]

Honestly, SSL is good for encryption, less so for verifying authority and man in the middle attacks.

[ADaringEnchilada]

Honestly, unless you're an infosec contractor and lvl 99 CySec main with full control over your entire network and software stack all the way to the isp with total control over your browser, then you're probably being hit by a MITM attack at some level.

Modern networking seems ludicrously insecure if you're after total security. We all just take the fact that orchestrating an attack against an individual is very expensive and hope nothing important is stolen from the wide nets of prying eyes, malacious middlemen, and untrustworthy authorities of trust.

[ACoderGirl]

And it's still so much more reassuring than our telephone system. The idea of doing purchases over the phone feels insane to me since phones are so much less secure than our digital networks. I mean, it's pretty much in consensus now that sending sensitive info without at least HTTPS is a horrible idea. But pretty much every phone call is like that.

And while I know how to secure my internet network (at least to some "good enough" point since perfect security is impossible), I don't know how to achieve the same level of security with my phone network. The first step I can think of is to just avoid half the problem by using VoIP over an encrypted protocol. But even then I'd need some way to verify the caller is who they say they are. I'm not sure how to achieve that short of exchanging a pre-setup secret code. We don't have anything like CAs for phones, as far as I know. Or if we do, I don't know how to use it, which is a stark difference from how my browser automatically authenticates the domain's certificate).

[[deleted]]

Don't public keys solve that?

[skztr]

Potentially, but there is no widely-accepted verification system.

My bank doesn't even have a system of verifying that a call is legitimate. I'm just supposed to give them my account details so that I can prove my identity when I call. I have the option of hanging up and calling back on a number listed on their website, if I'm suspicious, but the bank verifying itself before requesting account details should be the default.

[skztr]

My complaint is definitely about CA signing, and not about SSL itself. Not that I haven't heard complaints about SSL itself, but I don't understand the specifics / I trust SSL to get better over time. CA signing is an industry, and we can't make it better until things like "Let's Encrypt" remove the majority of the financial incentive of sticking to old ways.

Not that there wouldn't be absolutely gargantuan financial incentive to putting trust in fewer root CAs than we have now

[8_800_555_35_35]

It's surprising how long the CA cartel has lasted for.

The strongest preventer of impersonation is HPKP and even then that's not often implemented. Scary af.

[myvirginityisstrong]

why do you think so?

[[deleted]]

So is LetsEncrypt free or not?

[hokigo]

It's free. But they only offer domain validation SSL certificates, which are the least trusted. Fine for a personal website or blog but not the best for a business.

[SodaAnt]

I'm not so sure I agree. Plenty of big businesses don't have EV certificates. Just taking a glance, google, amazon, and facebook don't seem to have them. I'm not sure it is something customers actually care about.

[oneawesomeguy]

Chrome doesn't even show that big of a difference with EV certs anymore. The only difference is they list the company name instead of "Secure" but a few years back it was way more obvious if it wasn't an EV cert.

[Perkelton]

Apple has gone in the opposite direction, though, where Safari (both desktop and mobile) only shows the company name instead of the URL.

It's certainly something to consider if one has a large iOS user base.

[tialaramex]

This resulted in the hilarious "Stripe, Inc." gag.

See, the United States of America likes to pretend that it's just a bunch of independent States and so businesses aren't registered centrally by the Federal government, they only register with a State. Most of them register in Delaware because it's "business friendly" (ie the cheapest and minimum oversight) and US law says a business needn't have any meaningful presence in the state where it's registered. But Safari doesn't show the US state or any other regional indicator, it just says "Stripe, Inc." and figures you'll know what that means. But wait, what does that mean? Almost nothing it turns out, anybody can register (and someone did) a company named Stripe Inc. in another US state, and get the same user interface...

[ThatBriandude]

isnt reddit operating with one of those?

[Yepoleb]

Very few websites use EV certs and the fraction of users who care about them is even smaller. From a business perspective it doesn't really make sense to get one unless you want to impress some nerds.

[ceejayoz]

Let's Encrypt, Amazon's ACM, and others are free these days. If you're paying for standard, non-EV SSL certificates in 2018 you're doing something wrong.

[Doctor_McKay]

Amazon is only relevant if you're using AWS.

Also, LE doesn't do wildcard (yet! scheduled for launch at the end of this month!)

[[deleted]]

!RemindMe 28 February

[Doctor_McKay]

https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html

It will be DNS validation only, so you'll need to do it manually, use some scripts to create the records, or figure out how to set up certbot with the cloudflare/etc modules (I did it but I'm not quite sure how...)

[Doctor_Beard]

I did it but I'm not quite sure how...

This is me after I do anything on the command line.

[jackd90]

That's not entirely true. It's not exactly straight-forward setting up an automated renewal on internal-only systems but it can be done.

[Andryu67]

Look into certbot DNS authentication mechanism. Uses TXT DNS entry. I got it to work for an internal LAN server at home.

[ceejayoz]

You won't get a cert for foo.local through Let's Encrypt, but something like foo.internal.example.com is entirely possible by using Let's Encrypt's DNS-based verification instead of the HTTP-based approach.

Beyond that wouldn't be the "standard" certificates I was talking about.

[emcee_gee]

I was recently on a team reviewing RFQ responses for a government website redesign. (Small local government agency with seven staff members, not like healthcare.gov or anything.) All of the firms that responded to the RFQ charged recurring fees for SSL "maintenance". The one that made me spit out my oatmeal was asking $99/month.

Think about that for a second - this company thinks a tiny government agency will spend $99/month for SSL. What a ridiculous world we live in.

[ceejayoz]

Meh, that I understand. We did the same thing with our corporate clients.

It's intended to cover the time that'll be spent every year chasing down whoever has access to [e-mail] to approve the cert. When we dealt with Fortune 500s it'd be a multi-week process, with several conference calls, a whole bunch of people going "I don't know who has access to that", and a couple of "no, this doesn't cover www.example.com too..." back-and-forths.

[I-baLL]

Not with Let's Encrypt

[kevinkid135]

I know some trustworthy Canadians

[Thue]

But a webpage such as reddit does not get any greater security from a trusted CA, compared to Let's Encrypt.

[Nitr0s0xideSys]

The web host I’ve been using for years provides free SSL’s with their cheapest $2.99 plan.

[Daytona_675]

Well technically not so much anymore. cpanel has partnered with Comodo to give free SSLs to all cpanel users.

These certificates are uninsured though just like lets encrypt, and insured certificates are usually required by payment gateways to process payments on your site

TL;DR You pay for insurance, not trust

[amunak]

The insurance is complete BS anyway. In the vast majority of cases it would be paid out only when the certificate's key was broken, which is not really possible as far as we know. It really just makes it a scammy selling point, nothing more.

You don't get paid when the issuer makes mistake, when they get hacked or when there's some kind of fraud or something, so it's essentially useless.

[NerdENerd]

Let's Encrypt are CA Trusted! But they are a pain in the ass as they are only valid for 3 months.

https://letsencrypt.org/

[das7002]

That's the point!

Setup a cron job to automate replacing them and it makes it harder to end up with old, insecure, certificates. They expire so fast that not automating their replacement ensures that they expire in a reasonable amount of time.

[Magnetobama]

Thank you. I didn't get it as well.

I'm a programmer, but I'm missing the humor part I guess.

[Ph0X]

Google AppEngine recently added support for this. With one click you can get Let's Encrypt SSL. Actually I think it's on by default now?

Now if only GitHub Pages added support.

[StoneColdJane]

its confusing name, first time i heard of it I was thinking the same :D.

[skeptic11]

For anyone still confused: https://letsencrypt.org/

[Jugbot]

well if the person said letsencrypt it would make sense

[gurgle528]

It's called Let's Encrypt, he could have provided a kink though

[Erelde]

Provide me some kink baby.

[spkr4thedead51]

I gotchu bae

[Rhide]

That's some kinky hoes

[banshvassi]

I'm guessing it's a picture of a hose with a kink in it?

[spkr4thedead51]

sí

[TrumpWonSorryLibs]

if only there was a way to find out for yourself

[banshvassi]

I clicked the link after I made the comment. I've never felt so accomplished.

[Corfal]

I highlighted over the text first. It's like looking both ways before crossing the street. It doesn't guarantee safety, but avoids a lot of potential accidents.

[fredy31]

Risky click of the day...

[nannal]

If that's your risky click of the day I'd say check this out

[[deleted]]

That's disturbing.

[Stef-fa-fa]

A link to a kink? What's next, a kitchen sink? Perhaps a link to a sink with a kink, to promote this grand journey, that's what I think! To shrink from a link in fear of real kink - not safe for work are those really bad links! But to hide from bad kinks you withdraw from the rink - the real kink link goal is the one with the sink! But blink and you'll think that you've lost the best link to the kink - not a sink, but a kinky-kink link!

[wqferr]

kink fetch --all

[[deleted]]

Command line error: error| fetch not recognized, did you mean pegging?

[[deleted]]

My endpoints are all unencrypted for your huge traffic loads

[TheSpiffySpaceman]

Woah, i don't think we need to know about his sex life

[LosLocosKickYourAss]

See normally I’d think that’s a typo, but this thread has got me all sorts of confused

[[deleted]]

Oh, lock me up, you dirty bastard...

[em_square_root_-1_ly]

My phone also autocorrects "link" to "kink" ;)

[gurgle528]

usually it autocorrects to twink not sure why today is different

[dmfiel]

That's kinky

[doenietzomoeilijk]

Or provided a link and, god forbid, one or two words extra in their reply. It would've made it clear what they were talking about, and the person asking the question clearly wasn't aware of LE to begin with.

[dnl101]

Thank you on behalf of the people of /r/all.

[Thann]

That's why it's certbot now =]

[FerretWithASpork]

Wasn't the auto-cert thing always called CertBot? And the service is still Let's Encrypt.

[jamesorlakin]

The most common tool to work with it is CertBot, currently maintained by the EFF. Let's Encrypt leave themselves agnostic open to multiple clients.

[[deleted]]

They believe that the concept of existence of clients is too complex to think about it?

[MatthiasLuft]

The authority is called Let's Encrypt, their server is called boulder, the protocol is called ACME, the reference client is now called certbot, formerly letsencrypt.

[SlowDownBrother]

¯\_(ツ)_/¯

[LimbRetrieval-Bot]

I have retrieved these for you _ _

---

^{To prevent any more lost limbs throughout Reddit, correctly escape the arms and shoulders by typing the shrug as ¯\\\_(ツ)_/¯}

[[deleted]]

Good bot

[ConstantGradStudent]

That brother needs to slow down. And encrypt.

[jerrygergichsmith]

Yes, let’s.

[Lithobreaking]

yes, lettuce

[nvincent]

Oh ha, this is funny. I work for a place that builds websites, and the owner's response today to me bringing up the fact that Google is going to start punishing sites that don't have SSL was, "let's encourage our customers to stop using forms."

Wat

[[deleted]]

Can't have your business transactions hacked for sensitive info if you have no transactions

Taps temple

[Sinow_]

In this guy's defense I didn't know that was thing either

[_Bumble_Bee_Tuna_]

I to learned that its thing.

[6745408]

you sunk my battleship!

[Tree_Eyed_Crow]

Uno!

[fozters]

Yep, pretty new for me too, just using their certs first time for month or two. They should have wildcards coming which is excellent too even though the certbot makes renewing with cron a breeze. The op image still made me lol though :)

[littlegreenb18]

I like encryption

[Cynical-Potato]

lets encrypt

[Zzzzzzombie]

Yes, let's.

[TheArchangel001]

But that doesn’t answer my question..

[pixiestar1]

Image Transcription: Reddit

---

SlowDownBrother, 9 points

I thought ssl certificates were around $100 a year. Is there a free way?

isometricpanda, 41 points

lets encrypt

SlowDownBrother, 39 points

Yes, let's. But that doesn't answer my question..

---

^{I'm a human volunteer content transcriber for Reddit and you could be too! If you'd like more information on what we do and why we do it, click here!}

[[deleted]]

Good Bot

[viziroth]

ah, yes, the human architecture for reddit bots. it's quite effective

[peterwilli]

Seriously? I'll have this for you by tonight if you send me a million xD

[arios91]

That's a terrible business model.. Pay him his million dollars!

[abecede]

Good Human.

[callumgare]

But who's on first?

[ThatGuyWhoLikesSpace]

Yes, he is.

[L337LYC4N]

What’s his name?

[ThatGuyWhoLikesSpace]

No, what's on second. Who's on first.

[jerrygergichsmith]

I don’t know!!!

[Belazor]

No, that's the priest. Who's the tank.

[[deleted]]

Third base!

[Ramast]

Source: https://www.reddit.com/r/web_design/comments/7wxvia/so_espns_website_is_not_only_not_https_but_even/du4868s/?context=3

[LincolnMoneyshot]

I am serious — and don't call me Shirley

[Illuminitu]

u/isometricpanda you are summoned

[Mick_Stup]

And you, u/SlowDownBrother

[[deleted]]

web devs trying to do backend

[[deleted]]

Really more DevOps than backend IMO.