Let's Encrypt has issued its first million certificates

Re:Let's Encrypt has issued its first million certificates by lrem on Tuesday March 08, 2016 @08:16AM (#11244983)

However, imho, he biggest reason to ever use self signed is that you can set expiry @2099 and it won't degrade anything.

[ Parent | on HN ]

Re:Let's Encrypt has issued its first million certificates by Ao7bei3s on Tuesday March 08, 2016 @08:42AM (#11245123)

1. You'd have install the custom CA in all devices. Ever tried it on Android? The "network may be monitored" warning doesn't go away.

2. If the certificate is ever compromised, you'll have to keep it in the revocation list forever, or replace the entire CA.

(And I hope your CA contains a DNS name restriction.)

[ Parent | on HN ]

Re:Let's Encrypt has issued its first million certificates by technofiend on Tuesday March 08, 2016 @10:53AM (#11245974)

>1. You'd have install the custom CA in all devices. Ever tried it on Android? The "network may be monitored" warning doesn't go away.

This is the most annoying part of using certs for Radius authentication with Android. Either you self-sign a cert and forever get these warnings, or you let someone else sign your cert and then that CA can issue device certs for your domain.

[ Parent | on HN ]

Re:Let's Encrypt has issued its first million certificates by Ao7bei3s on Tuesday March 08, 2016 @02:25PM (#11247791)

At least modern Android version support setting the CA certificate in the wifi settings.

(And then there's the university way of things: just run your own trusted (!) CA ;-) (e.g. in Germany: signed by DFN)

[ Parent | on HN ]