Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 
Meow
8020 posts

Uber Geek
+1 received by user: 4006

Moderator
Trusted
Lifetime subscriber

  Reply # 2101877 4-Oct-2018 23:19
One person supports this post
Send private message quote this post

dfnt:

 

I'm even using Let's Encrypt (wildcard cert) for all my internal devices, like EdgeRouter, Synology NAS, pihole etc using nginx as a reverse proxy to them. That way I don't have to deal with self signed cert warnings when accessing them, and I just have a singular device that the cert resides on.

 

So easy when using the Cloudflare certbot plugin, so you don't have to expose your internal services for validation

 

I really need to get on to that... Thanks for the heads up regarding the Cloudflare Certbot plugin! Could come in handy :)

 

Lias:

 

Or better yet with free Let's Encrypt, Comodo or AWS ACM certificates.. It's high time people stopped paying money for SSL certs.

 

Afraid working for a large bank that won't fly... People need to see the padlock along with the name of the bank since phishing is so prominent (amongst other reasons). EV Validation really isn't cheap to do either. LetsEncrypt however will work with 2degrees however being a corp I'd say they'll be in the same boat here.







defiant
671 posts

Ultimate Geek
+1 received by user: 310

Lifetime subscriber

  Reply # 2101880 4-Oct-2018 23:27
Send private message quote this post

michaelmurfy:

 

dfnt:

 

I'm even using Let's Encrypt (wildcard cert) for all my internal devices, like EdgeRouter, Synology NAS, pihole etc using nginx as a reverse proxy to them. That way I don't have to deal with self signed cert warnings when accessing them, and I just have a singular device that the cert resides on.

 

So easy when using the Cloudflare certbot plugin, so you don't have to expose your internal services for validation

 

I really need to get on to that... Thanks for the heads up regarding the Cloudflare Certbot plugin! Could come in handy :)

 

 

NP.

 

Let me know if you want my config examples and I'll send them through, although its pretty straightforward especially when you've done the same concept with the Unifi Controller


BDFL - Memuneh
61508 posts

Uber Geek
+1 received by user: 12233

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 2101881 4-Oct-2018 23:29
Send private message quote this post

dfnt:

 

I'm even using Let's Encrypt (wildcard cert) for all my internal devices, like EdgeRouter, Synology NAS, pihole etc using nginx as a reverse proxy to them. That way I don't have to deal with self signed cert warnings when accessing them, and I just have a singular device that the cert resides on.

 

 

Just for the record, I've posted a quick guide on using Let's Encrypt certs on Synology and Fritz!box. This can easily be used for other models and if you are so inclined you can automate the renewal process in some routers.







defiant
671 posts

Ultimate Geek
+1 received by user: 310

Lifetime subscriber

  Reply # 2101883 5-Oct-2018 00:19
Send private message quote this post

freitasm:

 

dfnt:

 

I'm even using Let's Encrypt (wildcard cert) for all my internal devices, like EdgeRouter, Synology NAS, pihole etc using nginx as a reverse proxy to them. That way I don't have to deal with self signed cert warnings when accessing them, and I just have a singular device that the cert resides on.

 

 

Just for the record, I've posted a quick guide on using Let's Encrypt certs on Synology and Fritz!box. This can easily be used for other models and if you are so inclined you can automate the renewal process in some routers.

 

 

Oh yeah, forgot about that. I knew it was a thread I read somewhere that gave me the inspiration to do it but ended up procrastinating then forgetting.

 

The method I'm using is with nginx running on debian on an Intel NUC, so the devices retain their self signed certs leaving you with just one server hosting the cert. Makes automation and renewal easier that way.

 

But either option is good!


255 posts

Ultimate Geek
+1 received by user: 207

Trusted
2degrees

  Reply # 2102004 5-Oct-2018 09:53
3 people support this post
Send private message quote this post

dfnt:

 

So the end is near for the distrust of Symantec, and its various subsidiary CA's, SSL certs via Chrome.

 

Just FYI, I'm running Chrome beta so on version70.0.3538.45 now, getting this when browsing to secure.2degreesbroadband.co.nz

 

Click to see full size

 

Probably best to get onto this asap, as the stable release of 70 is just around the corner, more info here

 

@2degreesCare

 

cc @NickMack

 

 

 

 

 

 

Hiya,

 

Under control, and will be resolved today along side the other certs we have :-)

 

Nick.




defiant
671 posts

Ultimate Geek
+1 received by user: 310

Lifetime subscriber

  Reply # 2106268 11-Oct-2018 14:29
Send private message quote this post

I noticed the cert has been renewed and now under the Digicert chain, so problem solved :)


255 posts

Ultimate Geek
+1 received by user: 207

Trusted
2degrees

  Reply # 2106276 11-Oct-2018 14:33
Send private message quote this post

dfnt:

 

I noticed the cert has been renewed and now under the Digicert chain, so problem solved :)

 

 

Hiya,

 

Indeed - As I said, under control :-)

 

Nick.




defiant
671 posts

Ultimate Geek
+1 received by user: 310

Lifetime subscriber

  Reply # 2106279 11-Oct-2018 14:37
Send private message quote this post

NickMack:

 

dfnt:

 

I noticed the cert has been renewed and now under the Digicert chain, so problem solved :)

 

 

Hiya,

 

Indeed - As I said, under control :-)

 

Nick.

 

 

Yup, wasn't questioning it just updating the thread for closure


3455 posts

Uber Geek
+1 received by user: 1918

Trusted
Lifetime subscriber

  Reply # 2106508 11-Oct-2018 21:06
Send private message quote this post

michaelmurfy:

 

Afraid working for a large bank that won't fly... People need to see the padlock along with the name of the bank since phishing is so prominent (amongst other reasons). EV Validation really isn't cheap to do either. LetsEncrypt however will work with 2degrees however being a corp I'd say they'll be in the same boat here.

 

 

I missed that somehow.. Yes there will always be some organisations that need EV certificates, but for the vast majority of websites, DV is fine.





Information wants to be free. The Net interprets censorship as damage and routes around it.


21535 posts

Uber Geek
+1 received by user: 4388

Trusted
Subscriber

  Reply # 2106511 11-Oct-2018 21:08
Send private message quote this post

I expect that any business that takes money to have a decent EV cert. It just shows that they are at least slightly serious about things that they have gone to that little bit of effort and minimal expense.

 

letsencrypt is fine for blogs and other meaninless things.





Richard rich.ms

3455 posts

Uber Geek
+1 received by user: 1918

Trusted
Lifetime subscriber

  Reply # 2106525 11-Oct-2018 21:51
Send private message quote this post

richms:

 

I expect that any business that takes money to have a decent EV cert. It just shows that they are at least slightly serious about things that they have gone to that little bit of effort and minimal expense.

 

letsencrypt is fine for blogs and other meaninless things.

 

 

You might have higher standards than most people.

 

I just checked out a few of the NZ top 50 sites from Alexa, Trademe is the only non bank site based in NZ I could see that uses EV.

 

MightyApe, PBTech, Spark, Xero.. don't appear to be using EV

 

I checked a few others I could think of, Travelbug, Wotif, Countdown Online, 2Degrees, Vodafone, Slingshot, Orcon, again, no EV.

 

Even within the banks and financial sector, it appears some are still not using EV certs, or not using them across the board.

 

Registered banks:

 

  • Heartland, non EV front page, EV login page
  • RaboDirect, non EV front page, EV login page
  • BNZ, EV front page and once logged in, but the actual login page for internet banking uses a different, non EV certificate. Ooops :-P
  • Quite a few of the registered asian banks were similar, several didn't even have any certificate on their home pages but did on login pages etc.

Other financial related entities:

 

  • Mercer (Kiwisaver etc), no EV
  • Flexicard/Flexigroup (Farmers Card, IT leasing etc), no EV
  • GE/Laititude (GEM Visa/Creditline), no EV
  • Columbus Financial (Q Card), No EV.
  • First Credit Union, No EV

I'm sure I could keep finding more if I could be bothered.





Information wants to be free. The Net interprets censorship as damage and routes around it.




defiant
671 posts

Ultimate Geek
+1 received by user: 310

Lifetime subscriber

  Reply # 2106534 11-Oct-2018 22:44
3 people support this post
Send private message quote this post

Good read about EV by Troy Hunt


1 | 2 
Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.