Lets Encrypt!
Download as PPTX, PDF2 likes881 views
Let's Encrypt is a free, automated, and open certificate authority that aims to reduce barriers to secure internet communication. It allows users to generate SSL/TLS certificates at no cost by automating the key generation, certificate signing request, and domain verification processes. Certificates issued by Let's Encrypt are generally supported by modern browsers and operating systems. The service uses the ACME protocol for domain verification and has rate limits of 100 domains per certificate and 500 registrations per IP every 3 hours to prevent abuse.
![Let's Encrypt
https://letsencrypt.org/
"free, automated, and open certificate authority (CA), run for the public’s benefit"
[https://letsencrypt.org/about/]
Provided by ISRG - Internet Security Research Group (California based Non-Profit)
Sponsored by Mozilla, Akamai, Cisco, EFF, OVH,
Facebook, Chrome, etc.
Mission: reduce technological & financial barriers to
secure internet communication](https://image.slidesharecdn.com/0hpnpicvsyaama04o8ai-signature-48d6db0302446ddde70f43d8b5e4f88c9fa8b4a7e8b2cd93cdd57c723cfa12c5-poli-160309045612/85/Lets-Encrypt-4-320.jpg)
Lets Encrypt!
- 1. Let's Encrypt SSL Certificates without the pain
- 3. SSL certificate orders/renewals so far Generate RSA key Generate CSR Log in to CA's web horrible interface Fill out certificate order form Pay a lot of money Verify domain
- 4. Let's Encrypt https://letsencrypt.org/ "free, automated, and open certificate authority (CA), run for the public’s benefit" [https://letsencrypt.org/about/] Provided by ISRG - Internet Security Research Group (California based Non-Profit) Sponsored by Mozilla, Akamai, Cisco, EFF, OVH, Facebook, Chrome, etc. Mission: reduce technological & financial barriers to secure internet communication
- 6. What does it do? Still with Key, CSR, Domain verification, get certificate It's automated It's free
- 7. How does it work? ● ACME protocol: https://ietf-wg-acme.github.io/acme/ ● Specifies mostly the process of domain verification ● What we need to know: https://letsencrypt.org/how-it-works/ ● Server admin is identified by key pair ● CA issues challenges to authorize key pair, e.g. ○ DNS record ○ File on server
- 8. Pitfalls User running letsencrypt must have write access to web server root Make sure dot-files are accessible Challenge path: https://my-domain.com/.well-known/acme- challenge/jd1o3ddZXTYbjwUHvRnQOECZToSY-BKxyd6LdFgjvOg server { listen 80; # don't do this location ~ ^/. { deny all; } }
- 9. Certificates ● Root CA: ISRG Root X1 ● Intermediates: ○ Let’s Encrypt Authority X1 (not widely supported yet) ○ Let’s Encrypt Authority X2 (recovery) ● Cross signed by IdenTrust (DST Root CA X3), widely supported ● Issues certs: https://www.certificate-transparency.org ● Searchable: https://crt.sh/
- 10. Client Support Yep: Android > 2.3.6 Firefox > 2.0, Firefox OS > 2.2 Windows: IE, Chrome Safari > 4.0, iOS > 3.1 Linux: Debian > 6, Ubuntu > 12.04, CentOS ? Quickly tested: Node.js, PHP Nope: Java as of jdk8u51 (applied for) Older Androids Windows XP Blackberry
- 11. Rate Limits According to https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 Domains per certificate: 100 Certificates per domain: 5 certs/domain/week Registrations per IP: 500/3hrs For testing/development: use staging env (--test-cert, --staging) No limits on total number of certificates
- 12. Integrations Apache installer (haven't tried) Caddy Server Express middleware Fully automated SSL FTW!
- 13. Why should I use it? Less work - makes you happy It's free - makes your boss/client happy It's encrypted - makes your users safer It's automated - makes DevOps people happy
- 14. Limitations No love for: Windows XP Java No wildcards Only domain validated! i.e. 🔒https://paypal-service-evil-hackers.net
Editor's Notes
- #2: TODO: Browser support, wildcards, limitations (only domain validated certs!)
- #13: Caddy (live demo?: not localhost or IP port not 80 scheme is not http TLS is not turned off Certificates and keys are not provided Caddy able to bind to 80 and 443 Get caddy: https://github.com/mholt/caddy/releases Caddyfile: jhenning.me gzip browse ext .html log ./access.log Start caddy Done!
- #15: https://community.letsencrypt.org/t/which-browsers-and-operating-systems-support-lets-encrypt/4394