AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by ubergeek42 on Thursday January 21, 2016 @04:05PM (#10948350)

Can anyone think of any advantages LetsEncrypt would provide over this offering from AWS? Or does this basically kill LetsEncrypt's usage on AWS?

The only thing I can think of is that AWS Certificate Manager only validates by email addresses which can be problematic if you don't have MX records or don't have control over it(Maybe a large organization where the people who do control those email addresses won't click simple verification links)

It seems a bit inconsistent as to when it will use the email on the whois record for the validation too. For some subdomains I try it will allow validation using the whois address, other times it's just the common [email protected](which requires an mx record) So I guess if you're nesting deeper than one subdomain(e.g. abc.def.example.com) then maybe it'd be easier to get letsencrypt set up than try to get mx records for abc.def.example.com.

Shameless Plug/Disclaimer: I had been working on a tool to make it dead simple to use Lets-Encrypt certificates for CloudFront/ELBs and handled autorenewal via Lambda. I'm not sure there is any use for this now that this exists though.

https://github.com/ubergeek42/lambda-letsencrypt/

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by koolba on Thursday January 21, 2016 @04:13PM (#10948423)

I don't think you have access to the actual private key file so this would be restricted to AWS services like an ELB. With letsencrypt you have the key file as well so you can use it for securing any type of connection (not just a load balancer front end).

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by kevincox on Thursday January 21, 2016 @04:09PM (#10948377)

I believe this requires the use of cloudfront or their load balancer. So if you want to stick with minimal costs you can use letsencrypt with just an ec2 instance.

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by ubergeek42 on Thursday January 21, 2016 @04:19PM (#10948462)

That's a good point. For some reason the only thing I was thinking about was cloudfront/elb.

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by luma on Thursday January 21, 2016 @05:57PM (#10949201)

My frustration with these offerings is that they tend to only service public-facing HTTPS servers. There are a lot of use cases where valid certificates come into play, and a lot of them aren't facing the public internet or serving HTTP traffic.

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by jlgaddis on Friday January 22, 2016 @05:51PM (#10956079)

FWIW, you don't need to have an MX for example.com to get a certificate for it. The e-mail addresses used for domain validation come from WHOIS and can be, e.g., [email protected].

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by IceyEC on Monday January 25, 2016 @08:25AM (#10967009)

please actually use example.com. It's a domain intended for this usage (including with email!).

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by tal_berzniz on Thursday January 21, 2016 @04:09PM (#10948376)

LetsEncrypt is automated, so for hosting services who wants to issue certs for customers - LetsEncrypt currently wins

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by teddythetwig on Thursday January 21, 2016 @05:48PM (#10949143)

It depends on your security requirements as well. Some people feel the need for end to end encryption as opposed to SSL termination at the load-balancer tier. If you are one of those people, letsencrypt is the way to go

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by rdl on Friday January 22, 2016 @11:20AM (#10953588)

If it's all going in AWS, I don't see a huge difference between terminating in the ELB vs. terminating on the VMs. It might help you if the ELB got misconfigured, but AWS managing/provisioning the keys keeps them safe from being misplaced, too, so on balance it's probably better.

If you had on-premise servers, or a different/more secure host vs. intermediary/load-balancer, I could see the value of end to end. (especially if you have a long-lived cert, a pinned cert, EV, whatever).

(and of course crypto between the intermediary and the servers, if it's not on a physically secured LAN segment)

[ Parent | on HN ]

Re:AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS by plasticxme on Monday January 25, 2016 @08:27AM (#10967018)

Some forms of compliance require end-to-end encryption for certain transmissions. PCI is one that comes to mind.

[ Parent | on HN ]