Let's Encrypt Blog

Let's Encrypt is all about giving people free SSL certs and basically any hosting provider worth its salt has started offering them for free to their customers: https://letsencrypt.org/

> as it seems like you support amqps at the $55 level but do not on your pricing page. Hi, sorry about that. We'll fix the comparison page. > Why not support TLS/amqps at all pricing levels? When we started out, we were offering AMQPS/TLS for all plans through certificates from letsencrypt[1]. However, it became hard to manage certificate renewals, since we had to renew them on one machine and scp them to the respective RabbitMQ servers. This was too labour intensive and not worth. We however still have plans to roll out TLS for all plans at no extra cost. 1. https://letsencrypt.org/

This is the ideal time to switch to Let's Encrypt, and be done with certificate issues once and for all. https://letsencrypt.org/ https://certbot.eff.org/ You no longer have to ask year after year for a new certificate. It will be renewed automatically for as long as your webserver lives. And everything is backed by good protocols, a strong community and a trustworthy organization (EFF).

> My beef is how Google forces this change on everyone, but at the same time haven't the balls to shake things up and make SSL easily available for everyone. Really? https://letsencrypt.org/ Chrome is listed amongst the major sponsors. I don't even use, or have much love for, LetsEncrypt as it happens because it was a PITA to set up with node when I tried it. But even without that getting and using a certificate issued by Cloudflare was easy. Creating a self-signed certificate for dev and test is also pretty easy. It just takes a handful of commands in bash: http://www.akadia.com/services/ssh_test_certificate.html. It's the work of literally 5 minutes.

> No where in here is the web service a public good. It could be, it just depends on who owns the web service. Could be a corporation, could be a social-minded B corp, or could be a non-profit. https://letsencrypt.org/ is run by a non-profit, and would be considered a public service. Consider how much "profit" they're removing from the economy by offering the service for free, and yet one could argue the value of every site able to obtain an SSL cert to receive free TLS support is greater than that profit.

Randomly who designed the website @ https://letsencrypt.org/ ? I love the landing page, it's clean, well organized and simple.

If you're comfortable with the tools around it I'd highly recommend looking into LetsEncrypt[1]. Doesn't cost you a thing either. [1]: https://letsencrypt.org

$29 seems kind of ridiculous when "free" is right around the corner: https://letsencrypt.org/ (Even at that, $29 isn't a particularly great price for an SSL certificate. If you shop around, you can get them from reputable CAs for half the price.)

Let's Encrypt | Full Time | Remote Let's Encrypt is hiring another sysadmin. Help us make HTTPS ubiquitous! https://letsencrypt.org/ Looking for security-conscious systems administrators with the following qualifications: - Strong familiarity with enterprise networking, such as firewalls, network isolation, VLANs, and data backups. - Extensive experience implementing hardened systems with high capacity, high availability networking. - Strong understanding of virtualization. - Skills with git, saltstack, shell scripting. - Excellent English communication skills, written and spoken. Dev-ops and python experience would be a huge plus. Position is remote, can hire in the U.S. or Canada. Email resumés to: [email protected]

It comes up everytime but let's at the very least wait until we see if this is a viable way to easily implement HTTPS: https://letsencrypt.org/ I'd love to see such thing being built in straight into the Nginx/Apache packages of disto's to really make it straightforward. Personally I have a mail.mydomain.nl, a mydomain.nl and an owncloud instance at cloud.mydomain.nl, it is such a pain to update every year, it requires at least 2, if you do it well 3 long sessions at startssl. If you by any chance don't have [email protected] set up, you get to do that first too. This problem really, really needs solving.

You can keep your A+ and add IE8 on XP, plus boost your key exchange to 100%[0], by following Mozilla's TLS docs[1] and sticking with the default Intermediate ciphersuite. You might also consider disabling server tokens to hide your Nginx version (server_tokens off;) for a bit of 'security through obscurity' and enabling SPDY (listen 443 ssl spdy;) for a performance boost. Also worth pointing out is the upcoming Let's Encrypt project[2] which will make domain validated certificates free soon. [0]https://www.ssllabs.com/ssltest/analyze.html?d=brossmanit.com [1]https://wiki.mozilla.org/Security/Server_Side_TLS [2]https://letsencrypt.org/

I don't suppose we should be checking the pages that should actually be secure. IE Ubuntu is listed as bad, why not check their login page? https://login.launchpad.net/ or launchpad.net. Perhaps once https://letsencrypt.org/ comes available it will be worth the extra effort to encrypt everything. In the interim it's most likely a waste of funds, especially for projects that operate on donations. Edit: I was surprised to see the WSJ listed as Bad. Checking their login form, something that should be encrypted, the post goes to... https://id.wsj.com a secure page. I wont go through the entire list, but I expect most of the ones in this list have a similar configuration.

> Obviously we have to assume that public wifi is compromised in any case and require transport-layer security, but I can certainly see there's still a gaping security hole there. Agreed on the security hole on public wifi, though it's probably about less "sensitive" data as HTTPS is becoming more of a standard, especially after the Snowden revelations. Most services/apps speak HTTPS nowdays and a lot more will (hopefully) follow: https://letsencrypt.org/ > Is there any reasonable way to deal with this issue? So, yes with HTTPS

Is this machine-generated text? That or it's badly translated. Either way, it's strangely incoherent and subtly flawed. Take just the first section. It talks about a bubble sort of ints. Then provides code for bubble sorting strings [1]. Then talks about "sign position in the ASCII table". "linking to the native sort function" is... not the right term (what happened to "call"?). And then we suddenly talk about "the element to be found" (weren't we just sorting?). The rest of the article is in the same vein. I hope I'm not coming across as just picking on someone's English skills - even with perfect English I would find it hard to follow the train of thought. [1] This is subtly different because (naive) string comparison is not constant-time, unlike comparing ints in most languages. I was half expecting the article to go there but it didn't. PS: If not for the discussion here, I would've skipped the read because the site has no HTTPS. Please get a cert, it's free: https://letsencrypt.org/

Not making that point at all. Just making the point that related certificates and keys need to be looked up at run time from some secure place rather than be provisioned onto a file system at build time or via some hard to automate sysadmin ritualistic dance on the command line post startup. If in amazon, the secure parameter store is a good place for storing secrets. They also provision nice EC 2 credentials to hosts allowing you to access resources securely without having to rely on silly ssh keys baked into images or passwords passed around insecurely. And of course they allow you to centrally manage ssl certificates as well and manage provisioning those to things like load balancers. Kubernetes has nice infrastructure for this as well. The point is that this stuff should never be baked into docker or ec2 images and having software expecting to find these things in some file on the filesystem actively makes it harder to configure it in a sane way. I've seen quite a few docker images that require me to mount a volume with certificate files to work at all. The only way to beat some sense into that is to customize the Docker file and template these files (e.g. dockerize is great for this). Sane deployment automation seems to be an afterthought with many developers. Since you brought up SSL, a nice innovation a few years ago was https://letsencrypt.org/ which uses short lived certificates that need to be renewed regularly. That sounds like a good practice to do anywhere…

Hi Galen, If you use Stripe, Twitter, npm, or your bank, you'll see the company name in a green bar. That's an EV certificate and is the only way for a website to prove a company's identity. EV certs are great, particularly if you're selling something or people are logging into your site. Since they involve a bunch of verification, the industry standard time get the certificate is normally about 7-21 days. https://certsimple.com, my company, live checks data while you enter to do EV in an average of 5 hours. It takes 80 seconds to apply, including making the CSR - no Q and A in a terminal, no installing anything, just cut and paste. Because of this, we're faster at EV than everyone else. We also give 5% of our revenue to groups that make strong crypto happen - we cut our first cheque to OpenBSD Foundation last Friday. We also publish a bunch of interesting research around performance and security at http://certsimple.com, including OSS code to recreate our results. Hope that helps! Email me any time at [email protected] if you have questions. Mike PS. if you don't need EV, we recommend you get a free certificate from http://letsencrypt.org which should be launching soon.

> Until there's a free, easy, maintainable, and actually existent solution to SSL certs, enforcing HTTPS-only is just downright extortion. > Referring to solutions that are under construction doesn't cut it. If you're that passionate about it, contribute to the SSL cert solution yourself instead of to the endless calls for HTTPS-only Right. In similar threads, I've seen a lot of people linking to Let's Encrypt[0]. The idea of that project is great but, at best, all we can do now is discuss how to enforce HTTPS once Let's Encrypt (or something comparable) is available. Anybody who runs a small, personal website that generates no revenue would essentially be screwed if it were enforced before then, as (and someone can correct me if I'm wrong here) there aren't really any affordable options at this point for people who don't have much money to throw towards their site. [0] https://letsencrypt.org/

Mike from CertSimple here, from my old openid account (as I'm replying too fast with my other one): > $469 USD per year? No. All certificates are two years - the big price is the total. I've made this more apparent on the front page. If someone wants a non-EV cert we also recommend https://letsencrypt.org We could easily sell non-EV certs - they can be generated in seconds as they don't require manual ID verification to make a quick buck, but I think poor identity verification is what got SSL into the current mess we're in. You'll note GitHub, Stripe, Mozilla and npm have EV certs. Make of that what you will. Unfortunately letsencrypt doesn't do EV certs. We compared Symantec (whose brands include GeoTrust) when deciding on a CA partner. We picked Digicert based on the issuance speed and business practices. Symantec upsell IE5-level export encryption as a security feature. We don't want to support that. The CA we chose to partner with - Digicert - who we have the same prices as - sits in the middle of the market. They makes the certs for GitHub, Facebook, Intel, Yahoo, and Nintendo.

We're working on an FAQ. This thread has been really helpful in clarifying which Qs are FA :) With regard to your questions: > Will it provide wildcard certs? Not initially, but possibly in a future iteration. Note that having an automatic CA addresses some of the use cases for wildcard certs. Namely, if you're using a wildcard cert just to avoid having to manage individual certs for foo-1.example.com through foo-N.example.com, you can just have them each automatically get a specific cert. > How does it auto-renew, does it have to run all the time? That will depend on the software running on the web server. The current "node-acme" and "lets-encrypt-preview" implementations in the Github repo are examples. Ultimately, in addition to these tools, it would be great to have ACME / LE support built into web server platforms, which are already running all the time. > Why is the cert for identrustssl not trusted in Chrome or Safari? That doesn't inspire confidence : https://www.identrustssl.com/ I don't know what the story is with that site, but I believe the Let's Encrypt CA will be cross-signed under the same IdenTrust CA that issued the cert for https://letsencrypt.org/. So Let's Encrypt certificates should work wherever that site works (which includes Chrome and Safari, at least on my MacBook). > Can every CA support issuing certs this way please? :) I can't speak for other CAs, but we are definitely open to other CAs re-using technologies from Let's Encrypt to…

You have to opt in, and they are honest about the tradeoffs when discussing them: > Short-lived certificates are opt-in and we have no plan to make them the default at this time. Subscribers that have fully automated their renewal process should be able to switch to short-lived certificates easily if they wish, but we understand that not everyone is in that position and generally comfortable with this significantly shorter lifetime. We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well. https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability

The July announcement for IP address certs listed a handful of potential use cases: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certif…

>Oh that sounds wonderful. So every small site that took the LE bait needs expensive help to stay online. I agree with the terminology "bait", because the defaults advocated by letsencrypt are horrible. Look at this guide [0]. They strongly push you towards the HTTP-01 challenge which is the one that requires the most amount of infrastructure (http webserver + certbot) and is the hardest to setup. The best challenge type in that list is TLS-ALPN-01 which they dissuade you from! "This challenge is not suitable for most people." And yet when you look at the ACME Client for JVM frameworks like Micronaut [1], the default is TLS and its the simplest to set up (no DNS access or external webserver). Crazy. [0] https://letsencrypt.org/docs/challenge-types/ [1] https://micronaut-projects.github.io/micronaut-acme/5.5.0/guide/#chall…

Following CT (without relying on a third party service) right now is a scale problem, and increasing scale by at least another order of magnitude will make it worse. I was trying to process CT logs locally. I gave up when I realized that I'd be looking at over a week even if I optimized my software to the point that it could process the data at 1 Gbps (and the logs were providing the data at that rate), and that was a while ago. With the current issuance rate, it's barely feasible to locally scan the CT logs with a lot of patience if you have a 1 Gbps line. https://letsencrypt.org/2025/08/14/rfc-6962-logs-eol states "The current storage size of a CT log shard is between 7 and 10 terabytes". So that's a day at 1 Gbps for one single log shard of one operator, ignoring overhead.

btw. you can use a different dns server than you're main dns server which exposes the api, via cname redirects/ns records. https://letsencrypt.org/docs/challenge-types/#dns-01-challenge > Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server.

Of course it's more difficult. You are talking of a volume of around 600 000 000 domains (based on a plot on their website) that try to renew at best after 8 weeks. And that's just default profile, there are 160h certs profiles now [0]. You think they will ever send nearly as much as (at least) 75 million newsletter mails weekly? Sendgrid's highest value in their pricing slider is 1,25 mil a week. - [0] https://letsencrypt.org/docs/profiles/

> speaking about it in webinars and various conferences That's unfortunately the feeling I got from the landing page, lots of talking, bureaucracy and buzzword bingo and not much "doing". I might be wrong. For comparison https://letsencrypt.org, not a single mention of "webinars" or "stakeholders".

Apache Software Foundation accepts individual donations of any amount that are tax-deductible: https://apache.org/foundation/individual-supporters Outreachy is another excellent 501c3 that provides paid internships for open source: https://www.outreachy.org/sponsor/donate/ Let's Encrypt provides free TLS certificates to anyone: https://letsencrypt.org/donate/ You can find a wide range of OSS projects on OpenCollective: https://opencollective.com/search?q=&tag=open+source

Are you seriously not aware of Let's Encrypt? https://letsencrypt.org/ Nobody has really had to pay for certificates for quite a number of years. What certificates get you, as both a website owner and user, is security against man-in-the-middle attacks, which would otherwise be quite trivial, and which would completely defeat the purpose of using encryption.

Yep, they started in 2020: https://letsencrypt.org/2020/02/19/multi-perspective-validation/ This has been challenging for some subscribers who are unaccustomed to receiving any legitimate site traffic from foreign countries. https://community.letsencrypt.org/t/multi-perspective-validation-geobl… Now that it's a requirement for the whole web PKI, it will be interesting to see the pressure against blanket geoblocking increase. (Or maybe more web hosts will make it easier to use DNS challenge methods to get certificates.)

Website doesn't support SSL? Have you looked into Lets Encrypt? https://letsencrypt.org/