I'll admit I was late to the HTTPS party.
This is a companion discussion topic for the original entry at https://blog.codinghorror.com/lets-encrypt-everything/
This is a companion discussion topic for the original entry at https://blog.codinghorror.com/lets-encrypt-everything/
1 Like
Great post, @codinghorror! Like you, I agree that every website should be encrypted! (My personal website is encrypted with a different free SSL provider, but I’ll look into supporting Let’s Encrypt!)
Just a couple of pointers for those who want to secure a website. If you’re trying to secure your own, personal website (or a website of your company, etc), make sure that your website is as secure as possible!
- Make sure that perfect forward secrecy is enabled for browsers that support it. (In theory, if someone cracks your long term key, they would be unable to get the short-term session keys from previous sessions)
- Make sure that insecure protocols (such as SSL2, SSL3, etc) are not enabled on your web server
- Unless you really need to support Windows XP (or other, older clients), don’t allow any ciphers that use RC4.
- Make sure that the strongest ciphers your server supports is at the top of the list of supported ciphers sent to the client. (Many client apps just use the first compatible cipher they find in the list, instead of looking for the strongest. Make it likely that the client uses the strongest cipher!)
I personally use an external tool to test my sites with (since I’m a first time poster, I’m not going to link directly to it (even though I have no affiliation with that site), but if you type “SSL Test” into your favorite search engine, I suspect you will find something useful)
1 Like
The question I have with the encrypted web is that there can be no intermediate caching which is a big efficiency hit. This is a big issue for anyone with a slow link - eg, the remote, the poor - and bumps up the server requirement to host a busy site. Is there a valid intermediate position like not encrypting images and video? Or should we just get over it?
2 Likes
StartSSL also offers free class 1 certificates, meaning they only verify basic information like domain ownership.
StartSSL’s root certs are installed on all the major platforms.
Their admin interface is pretty painful to use though.
@Doug_Richardson StartSSL is currently in the process of having their root certs distrusted by [Firefox] (https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/) and Chrome as a result of some pretty terrible screw-ups on the part of their parent company, WoSign. So yeah, unfortunately only Let’s Encrypt is left as a provider of free certs.
1 Like
“and particularly after the result of the last election here in the US”
Is this just a platitude to progressives? It is not like this is a new problem.
Encrypted email provider ProtonMail tells it like it is: Donald Trump will control the NSA – what this means for your privacy | Proton
It is tempting to blame all this on Trump and his supporters, but that is taking the easy way out. All Trump does is put a new face on the existing privacy problem, so now it concerns a segment of the population that previously didn’t care as much. ProtonMail users have always come from both the left and right side of the political spectrum. Today, we are seeing an influx of liberal users, but ProtonMail has also long been popular with the political right, who were truly worried about big government spying, and the Obama administration having access to their communications. Now the tables have turned.
The same terror the political right has experienced is now being felt in liberal bubbles such as Silicon Valley for the first time. The left is correct to be terrified of a Trump-led NSA snooping on their communications, especially since Silicon Valley giants like Google and Facebook can be forced to spy on users on behalf of Trump’s NSA. However, this precedent was not set by Trump – he hasn’t even taken office yet. The first major incident of a US tech giant being complicit in US government spying actually took place in 2015 under the Obama administration.
It really seems to some people, doing the right thing (in this case encrypting the web) only makes sense when the wrong thing (mass privacy invasion) is in the hands of who they consider wrong (Trump), rather than anyone’s hands (the power’s that have ALREADY used, furthered, and abused the service, but that’s fine, they like them).
Heck even Snowden concurs when asked about Trump: https://youtu.be/FwOIgOH_S18?t=43m20s
2 Likes
I am a huge fan of encryption. I would like to mention Keybase here, as it is great to encrypt and share files. Give it a try. If you need an invite, hit me on twitter: @grobmeier
Last year we even made a shirt to raise awareness on encryption.
Encryption & TLS are good, but the reliance on a central component like CA’s is a flaw in this scheme i.m.o. DANE can replace CA’s with a DNS record that identifies the certificate of your site. In time this will eliminate the need for CA’s (or atleast significantly reduce it). So please start using it if you are not using it already, and we won’t have to spend/raise money for this sort of thing anymore, hopefully, in the future, someday.
At let’s encrypt I cannot get a certificate with a decent valid period - like a year or two. I cannot simply get a certificate - I have to use automation. I do not want to use automated certificate renewal, because it’s basically “a bunch of scripts” doing it and that type of Software usually stops working after some update and leaves me alone with getting it to work again. I might trust the default “Certbot” but who makes certain that all the other implementations of ACME Protocol are secure and are not compromising my website? having a free CA is great, because certificates were expensive, but with the automation they solved a problem nobody really had.
I’ve always kind of wondered how Let’s Encrypt avoids the shenanigans that got StartSSL in trouble (see Ajedi32’s post above). I figured with an SSL cert service, what you’re paying for is basically some level of identity verification – the point of the cert is to have a trusted 3rd party verify that the person who gets issued a cert is actually the entity that people “expect” to run the site. Trust is hard, and I’m not sure how we can make that happen for free.
If you need to test directly from from desktop rather than through a third party we’ve released a tool called SSLRobot (see https://sslrobot.io) than can quickly scan your SSL configuration. It will warn you about potential issues with your certificates, ciphers or protocol versions.
*** Disclaimer: comment from developer of SSLRobot ***
1 Like
It’s just a shame that places like Google Cloud Computing doesn’t “allow” or offer us lets encrypt by default. Updating the relatively short SSL certificates all the was the reason I didn’t go the Google Cloud way for my websites 
2 Likes
Let’s Encrypt only issues domain validation certificates, so they only have to validate that you control the domain they’re issuing you a cert for. That’s not too hard to automate, relatively speaking. They just ask you to serve some random data from a specified URL on your web server, or place it in a particular DNS record. Then their servers just check for the presence of that random data in the specified location and if it’s there they issue you your cert.
In particular, it’s worth noting that Domain Validated certificates make no guarantees about the actual, real-world identity of the person or organization which owns the domain. Extended Validation certificates do that, but Let’s Encrypt doesn’t issue Extended Validation certificates.
1 Like
Glad to know I’m not the only one who thought that comment seemed out of place. It didn’t add anything to the post, other than potentially alienate roughly 50% of the people who read it. Privacy & security are critical regardless of who won the last election (electoral college or popular vote).
That said, it’s Jeff’s blog and he can post whatever he likes. 
2 Likes
I have secured all of my services using LetsEncrypt and that’s why the least I can do is donate. And I did. I urge everybody to do so.
1 Like
If you have a busy site, let the CDN act as the TLS endpoint. CloudFlare and CloudFront already support this, though CloudFront charges 25 to 60 cents extra per million hits for HTTPS.
If you have a very slow uplink shared by several subscribers, the operator of the intercepting caching proxy can act as an automated CA. Then each subscriber can add this CA as a trusted root CA. This increases the number of people who can view or alter the communication from two (the endpoints) to three (the endpoints and the proxy), but that’s still far fewer than every single router between the endpoints, which was the case under cleartext HTTP.
DANE also relies on a centralized component: the DNS root servers. Adoption of DANE has been lagging for two reasons.
- DANE relies on DNSSEC, whose public key is only 1024 bits. This short key length is the primary reason why Chrome doesn’t come with DANE support.
- Some domain registrars that bundle DNS service have decided to treat DNSSEC as an upsell, making it available only to subscribers to “premium DNS”. GoDaddy falls (or fell?) into this category.
You mentioned one recurring cost in the article.
Without that required cash each year, without the SSL certificate that you must re-purchase every year in perpetuity – you can’t encrypt anything.
But that’s not the only recurring cost of a move toward HTTPS.
As a measure to increase HTTPS adoption, Firefox and Chrome have started to make some JavaScript APIs available only in secure contexts. These currently include at least Service Workers, Geolocation, and WebRTC. So if someone wants to make a router, printer, NAS, or other appliance with a web interface, and that web interface uses one of the secure-only APIs, it’s going to need HTTPS and thus a certificate. For example, once the Fullscreen API goes secure-only due to phishing attacks that spoof the browser chrome, a user of a NAS won’t be able to play movies from the NAS in the full screen.
Let’s Encrypt offers certs for any website that has a FQDN in a registrable domain. This covers the public web. It does not cover a private home LAN on 192.168/16. It’s possible to get a cert from LE just with a domain and not an HTTP server using the DNS challenge through the dehydrated client. but then each home user will need to buy a domain.
Thus the need to pay $15 per year to Gandi or another registrar to continue to renew a domain for your home LAN will replace a certificate as the recurring cost.
1 Like
Donating an amount to a free service equal to what I’d pay to another service doesn’t sound good to me. This way there is no difference between them. So what’s free here? Except my time.
I was initially scared seeing that support from places like 1&1 wasn’t there (since they want to sell their overpriced service to get them in)… but since I’m running a VPS with plesk I had more options. Looks like this already has support via extensions, and after using it…
I am sold on the service. It’s a two-click process (or three, if you get the checkbox), and handles the under-the-covers configuration for domains. It saves me a huge amount of time and effort on a task I hate doing.
I agree with @abatishchev. There is a cost for Let’s Encrypt to provide their service - nothing is truly free. But suggesting we pay what we would have paid to another company means we are just making them the biggest for-profit company in the certificates market.
It seems disingenuous (or maybe you didn’t know) not to mention that many of their services are already subsidised. For example, their own root certificate is provided by an existing player and used to be signed by Global Sign (now IdenTrust, I think). The project is part of Internet Security Research Group (ISRG) which is a tax exempt organization based in California which is supported by several large institutions.
And it’s worth pointing out that they are not asking for anything like this kind of contribution. They are saying their monthly costs are $200,000 and they are looking for support to cover this base amount. Its a shame they are not being a bit more transparent and breaking this down into their specific costs such as processing, salaries, offices, heat and light so potential donors can see how their contributions are likely to be used.
I don’t have password or credit card fields on my form on the website, and chrome still shows alert. Why? Is email-id also the sensitive field?