Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

  • @0x01@lemmy.ml
    link
    fedilink
    English
    1501 month ago

    Man I love let’s encrypt, remember how terrible ssl was before the project landed?

    • Rikudou_Sage
      link
      fedilink
      English
      641 month ago

      Crazy times. Nowadays it’s weird when a website doesn’t have https. Back then it was pretty much big companies only. And the price of a wildcard certificate…

    • @pcouy@lemmy.pierre-couy.frOP
      link
      fedilink
      English
      311 month ago

      I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.

    • @dan@upvote.au
      link
      fedilink
      English
      11 month ago

      I remember the days when each site that wanted to use SSL had to have a dedicated IP.

    • @leisesprecher@feddit.org
      link
      fedilink
      English
      231 month ago

      And if you remember, that this whole shebang was only started, because Snowden revealed that the NSA spied on all of us, it’s getting much much darker.

    • miss phant
      link
      fedilink
      English
      131 month ago

      I always had to fill out multiple pages of forms to get those free 1 year “trial” certs from startssl.

      • @xthexder@l.sw0.com
        link
        fedilink
        English
        41 month ago

        Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$

          • @xthexder@l.sw0.com
            link
            fedilink
            English
            31 month ago

            Wildcard certs are perfectly fine. Your own instance lemm.ee is using one right now.

            Obviously there could be issues if subdomains are shared with other sites, but if the whole domain is owned by 1 person, what does it matter?

            • @lud@lemm.ee
              link
              fedilink
              English
              11 month ago

              If one system is somehow compromised, the attacker could effectively impersonate all the systems on your entire domain if they had the wildcard cert. Maybe it’s not a huge deal for individuals but for companies or other organisations it could be extremely dangerous.

              If someone wanted a wildcard cert at work I would be very cautious before I even considered issuing one. Unfortunately there are a few wildcard certs on our domain, but those are from before my time.

              • @pcouy@lemmy.pierre-couy.frOP
                link
                fedilink
                English
                21 month ago

                Having a certificate for any subdomain has implications for other sibling domains, even without a wildcard certificate.

                By default, web browsers are a lot less strict about Same Origin Policy for sibling domains, which enables a lot of web-based attacks (like CSRF and cookie stealing) if your able to hijack any subdomain