Wish there was an equivalent thing for signing executables. eg for the binaries of our software releases.
We'd been using StartCom signing certs (for Win binaries) up until this clusterfk. ;)
Just to get a signing certificate I'd need to get my personal id docs signed by a public notary, get those docs to the KSoftware people, and THEN they'd be ok to issue the cert.
Whilst not impossible, that's like the process was back in the Stone Age ;) for getting normal https website certs.
Obviously went with the StartCom approach instead, which may need to be looked at again if we need to sign packages in the near future. :/
The page on the Certum website about certs-for-open-source-signing didn't mention AuthentiCode at all. The AuthentiCode compliant certs seem like a different product.
If their certs for Open Source projects really are Authenticode compliant, I'd expect that to be front and center on the page about it. It's the one main feature of importance. :)
Nope
GPG signing is suitable for a different group of users. :)
I much prefer the CA industry practice of, put a meta tag on your frontpage, or add a string to a DNS TXT record, and then download a certificate, then you're done for three years. I understand their security claims (which apparently don't apply to letsencrypt.org), but all CAs offer 2-3 year certs, so it's a feature they have that LE lacks.
certbot raises complexities if you're using a managed hosting solution that doesn't have shell access, or the owner of your machine doesn't want you running code on their box, or you have a weird custom web server setup or something.
But all the same, I'm not sure that avoiding certbot is worth continuing to pay $40 a year for my wildcard certificate from AlphaSSL. I may switch when mine expires.
What I'm even more hopeful for is that prices of wildcard certs from other vendors will drop now that there's a free alternative. I'm super excited that LE are finally offering these for free!
If you have a host that doesn't have shell access, it wouldn't be that hard to modify a script like that to copy files up to .well-known/acme-challenge, and copy the TLS key in place when done.
Why? The whole point of LE is to be able to automate renewals and if you automate it then the length of validity makes zero difference.
From Wikipedia:
> Let's Encrypt is a certificate authority that launched on April 12, 2016
From Let's Encrypt's certificate
> Period of Validity > Begins On: 2015/2/4
I agree they should eat their own dogfood, but in the meantime, I'm eating their dogfood and it tastes pretty good.
I use the acme.sh client (https://github.com/Neilpang/acme.sh) for updating certs for a site on a managed platform, using the DNS verification method.
Long term I would be concerned that browsers, such as Chrome, may stop supporting certs that last too long. We are already seeing this behavior with Symantec after some security issues with issuing certs. I expect in the long run certs that last over a year will be done away with.
a) free letsencrypt certificates for everything that only needs to be domain-validated (DV SSL).
b) $95/year EV certificates for companies that want the big friendly green banner on their ecommerce/credit card checkout pages, which is reassuring to the average non techincal user. In the last 4 years I have seen the price for EV SSL certs fall from $400/year to $95/year from several vendors. My main concern is that EV SSL issuers need to be held to a very high standard of actually verifying corporate identity. If they start getting lax about it and known EV certs go out to not-fully-vetted organizations, that would be a bad thing for the whole idea behind EV.
It's not clear that the prices being charged by commercial CAs are anywhere close or even related to the underlying costs.
I think LE is beginning to demonstrate that the costs of operating a CA are not actually that high, at the same time that the lax behavior by certain commercial CAs has demonstrated that the "validation" they provide is of very little value.
The actual technical infrastructure required, while intricate, isn't that hard to set up.
> Issuing certificates cost money
Making a post on HN probably costs more money than issuing certificates.
LE's probably the best we're going to get for a long time. Mozilla's one of the few groups I'd go so far as to say is completely benevolent, and LE is being operated as a public service.
e.g. a software as a service database provider most likely does not use their own software for their database.
I used StartCom for years, but LE made it completely obsolete for me. And StartCom seems to have been willing to throw it all away with the WoSign acquisition.