Let's Encrypt
letsencrypt.org
Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report.

Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

    • FMEEE@lemmy.dbzer0.comEnglish
      1·
      33 minutes ago

      Today it’s just more or less stupid to buy SSL you can get one extremely easy for free from Let’s Encrypt or Google Trust…

  • __matthew__@lemmy.worldEnglish
    11·
    4 hours ago

    Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let’s Encrypt.

    I probably need more positivity in my life 😂

  • laxe@lemmy.worldEnglish
    6·
    5 hours ago

    Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.

  • 0x01@lemmy.mlEnglish
    104·
    11 hours ago

    Man I love let’s encrypt, remember how terrible ssl was before the project landed?

      • xthexder@l.sw0.comEnglish
        2·
        5 hours ago

        Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$

    • treadfulEnglish
      7·
      7 hours ago

      Remember they wanted like $75 for certs? The gall.

    • Rikudou_Sage@lemmings.worldEnglish
      43·
      10 hours ago

      Crazy times. Nowadays it’s weird when a website doesn’t have https. Back then it was pretty much big companies only. And the price of a wildcard certificate…

    • leisesprecher@feddit.orgEnglish
      20·
      10 hours ago

      And if you remember, that this whole shebang was only started, because Snowden revealed that the NSA spied on all of us, it’s getting much much darker.

    • pcouy@lemmy.pierre-couy.frOPEnglish
      24·
      11 hours ago

      I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.

  • somenonewho@feddit.orgEnglish
    33·
    10 hours ago

    Damn! That’s definitely a “I’m old” moment for me. I still remember when I first heard about the concept and I remember setting it up the first time on a self hosted project (which seemed harder back then).

    Awesome project!

  • RoyaltyInTraining@lemmy.worldEnglish
    14·
    9 hours ago

    Let’s Encrypt is amazing, but are there any equally trustworthy alternatives people could switch to if something bad happens to it?

    • treadfulEnglish
      7·
      7 hours ago

      They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it’s so difficult and expensive.

      • xthexder@l.sw0.comEnglish
        7·
        5 hours ago

        Well, it’s difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.

        • treadfulEnglish
          1·
          5 hours ago

          Correct me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.

          The impact is serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.

          It doesn’t improve encryption compared to a self-signed cert though.

          • xthexder@l.sw0.comEnglish
            3·
            4 hours ago

            If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It’s effectively allows MITM for any certificate. Worse, it’s not even limited to certificates under that CA. The browser has no way of knowing there’s 2 “valid” certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is a possibility).

            Certificate pinning might save things, since that will force the same certificate as was previously used, but I’m not sure this is a common default.

    • fmstrat@lemmy.nowsci.comEnglish
      7·
      8 hours ago

      If it begins to enshitify, someone will quickly take up the helm. It’s become so core now that someone like Cloudflare would just be like “We do this now.”

      • CosmicTurtle0@lemmy.dbzer0.comEnglish
        7·
        7 hours ago

        Cloudflare sort of provides this now by being a MITM to secure your site between your server and the end user. But this requires you and your end user to trust Cloudflare.

        And fwiw the ACME protocol is open so anyone can implement it. I believe even the ACME software that EFF sends out allows you to choose your server with some configuration.