bk99.de entertain the web since 1997

bk99.de
HN · TLSCurated

Understanding free Let’s Encrypt certificates by hand

Summary

Get HTTPS for Free walks through the ACME steps and shows how keys, signing requests, challenges and certificates fit together. Let’s Encrypt provides free DV certificates. ACME automates issuance and renewal.

Ideas

  • A local private key never leaves your own computer.
  • A CSR binds domain names to a public key.
  • ACME challenges prove control over the desired domain.
  • After successful validation, the certificate authority signs the certificate.

Insights

  • Automation becomes more trustworthy when its protocol steps remain understandable.
  • Control of a domain and personal identity are different statements.
  • Short certificate lifetimes require reliable renewal.

Facts

  • The website guides you through the protocol flow manually.

Recommendations

  • Automate renewal and monitor expiry dates.
  • Protect private keys with minimal file permissions.

References

Read the original article

Search the Web Archive

HN · 2009

The first few milliseconds of an HTTPS connection

Jeff Moser breaks an HTTPS connection down into DNS, TCP, the TLS handshake, certificate validation, key exchange and encrypted HTTP data. The article illustrates a complete TLS handshake. Certificate authorities sign certificates within a chain of trust.

RFC · 2026

RFC 9846: TLS 1.3: The consolidated current specification

RFC 9846 replaces RFC 8446 and consolidates TLS 1.3 with the corrections and updates published up to then. Security standards occasionally need a consolidated new edition instead of many scattered updates. Superseding the document changes the reference, not the goal of a smaller, secure protocol.

RFC · 2026

RFC 9849: TLS Encrypted ClientHello

RFC 9849 encrypts most of the TLS ClientHello and thereby protects destination and negotiation data that used to be visible. Content encryption alone does not hide all metadata of a connection. More privacy changes troubleshooting and network filtering.