Let's Encrypt!
•
4 likes•1,007 views
Secure Your Website with free SSL cert from Let's Encrypt! (for 300 Seconds of Fame at lightning talk at Chicago hackerspace Pumping Station: One)
Report
Share
More Related Content
What's hot
What's hot (20)
Similar to Let's Encrypt!
Similar to Let's Encrypt! (20)
More from Drew Fustini
More from Drew Fustini (20)
Recently uploaded
Recently uploaded (20)
Let's Encrypt!
- 1. 300 Seconds of Fame: November 2015 Drew Fustini @pdp7
- 3. ● Free ● Automated ● Open New Certificate Authority:
- 4. ● As of October 2015, certificates are now: Trusted by all major browsers ● Beta Participation Request
- 6. ● Federal 501(c)(3) Non-Profit ● Mission: reduce financial, technological, and education barriers to secure communication over the Internet ● Board members from: EFF, Stanford Law, CoreOS, Akamai, Cisco, University of Michigan Internet Security Research Group
- 8. ● Client Software: Let's Encrypt is a Python-based utility that works alongside Apache to automatically obtain a certificate and convert a website to HTTPS. ● Server-side CA Software: Boulder is the primary Let’s Encrypt CA implementation. It’s based on the ACME protocol, and written primarily in Go.
- 9. ● Let’s Encrypt CA talks to certificate management software running on web servers ● Protocol for this is called ACME: Automated Certificate Management Environment ● Draft Specification – Will be proposed to IETF to make it open standard ACME Protocol
- 12. Certificate Issuance and Revocation
- 19. ● Your certificate and chain have been saved at: /etc/letsencrypt/live/pdp7.com/fullchain.pem ● Your cert will expire on: 20160207 ● To obtain a new version of the certificate in the future, simply run Let's Encrypt again. ● Your account credentials have been saved in your Let's Encrypt configuration directory at: /etc/letsencrypt ● You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Let's Encrypt so making regular backups of this folder is ideal.
- 20. ● My pdp7.com hosted by Debian 8.2 server on DigitalOcean ● Apache SSL Config file: /etc/apache2/sitesenabled/defaultssl.conf <IfModule mod_ssl.c> <VirtualHost *:443> SSLEngine on SSLProtocol all SSLv2 SSLv3 SSLCipherSuite ECDHERSAAES128GCMSHA256:ECDHEECDSAAES12 SSLHonorCipherOrder on SSLCompression off SSLCertificateFile /etc/letsencrypt/live/pdp7.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/pdp7.com/privkey.pem ServerSignature Off AcceptPathInfo Off AddOutputFilterByType DEFLATE text/html text/plain text/xml applicati AddDefaultCharset UTF8 SSLOptions +StrictRequire ServerAdmin admin@pdp7.com ServerName pdp7.com DocumentRoot /var/www/html ErrorLog ${APACHE_LOG_DIR}/error.log LogLevel warn CustomLog ${APACHE_LOG_DIR}/access.log combined LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{Useragent}i LogFormat "%v %h %l %u %t "%r" %>s %b" vhost_common </VirtualHost> </IfModule>
- 27. Why 90-day lifetimes for certs? ● 90 days is nothing new on the Web ● 29% of TLS transactions use 90-day certs (per Firefox Telemetry) ● Limit damage of key compromise & mis- issuance ● Encourage automation, which is essential for ease-of-use
- 28. Get Involved ● All code & protocol specifications are on GitHub ● Client software development mailing list ● CA software development mailing list ● ACME protocol dev IETF mailing list ● Community Support Forum (Discourse)