Hacker News new | ask | show | jobs
by jonknee 3933 days ago
It's amazing that it takes a free provider to make things simple:

https://letsencrypt.org/howitworks/

I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

4 comments

I run https://certsimple.com: we only do EV certificates, we're the fastest place to get an EV cert, we check as much as we can before you pay us a cent, and our application process is 80 seconds.
You might want to fix your webdesign: http://i.imgur.com/zQbWnUI.png

And this is in Firefox, which renders fonts more bold than other browsers.

Just removing the font-weight: 300 helps tremendously. Personally, I'm becoming less of a fan of external fonts. I've noticed lately that they're often the slowest thing to load on sites that use them (especially Google fonts).
The weight works great on a high DPI display, but on older displays, it just doesn't work. Open on a rMBP or iPad, and it's beautiful. I'm guessing the designers are working on a high DPI Mac.
Edit: should be sorted.

Original: working on a standard DPI Mac, but it still looks fine - see http://imgur.com/WRWYzBx. Trying to figure it out now...

Do you mean "fine" as in "very fine lines", or "looks fine" as in "looks good"?

Cause that looks like a printer that ran out of ink.

I'm guessing OS X's font smoothing is more aggressive and makes it look better than Windows'. It also depends on how the font was hinted for Windows, whereas on OS X, the system "knows best" and has its own font smoothing technique.
I am on a rMBP and I wouldn't call it beautiful.

It's painfully thin, and the eyestrain factor is pretty high.

I downloaded all of Google’s font library and installed it locally, means I can read the fonts without having to load them from Google. Still doesn’t help against fonts with 0.5px thin lines.
Back in the day, running a massive library of fonts slowed down many apps. Is this still the case? I'm running Mac OS X 10.10.
I’m on linux, and yes, it does. Opening the font selection menu can take for me, with 7000 installed fonts, about half an hour sometimes. I just don’t do that, instead select fonts by name (I know most of them now).

But you don’t notice it until you open a font selection menu.

Edit:

I've made some changes to Typekit to thicken things up. Is it better? If not, can you provide details of your OS?

Original:

I'll investigate and fix that now. What OS are you on so I can reproduce it?

It looks this this here in Firefox (http://imgur.com/WRWYzBx) and this in Chrome (http://imgur.com/6dFeQhG) on OS X, testing across multiple Macs here. I'd really like to fix it though! Thanks for the heads up!

We moved from Google Fonts to TypeKit recently, so I suspect it may have happened then.

On the updated version, want to give some actionable feedback:

Not just the weight, the size combined with the weight: 12px in a thin font is too light for a screen, especially done in grey. Going to 16px could really make a difference.

Going with a bigger size gives the scope to use a different, contrasting (perhaps thicker, perhaps thicker and smaller for double-contrast?) font for the headings currently in green.

* Getting older happens to different people at different ages, one of the effects of this means eyes get more temperamental, and this doesn't happen 50+, it happens a lot earlier for a lot of people.

Thanks - I'm really grateful for the feedback - and would like it if you have any more.

I'll be changing the base font to 14px and darkening the grey to #222 quite soon.

I'll also look at 16px but this needs some additional design work.

As I said above, the Firefox screenshot looks like a printer that ran out of ink, the Chrome version is slightly better, but look at the letter 'T', that's still wrong, a hairline that falls between pixels. That's only acceptable for text that is not actually intended to be read (thumbnails, mockups, zoomed out stuff, etc).
In Chrome is better but still terrible :/
Yeah but still $234/yr for a certificate. While I appreciate what you're doing to make things more simple, that's pretty expensive.

I can't wait until letsencrypt is done.

They offer EV certs, so there's some cost involved in doing the identity verification. I don't think it's $234 dollars a year, forever, but it costs something. And that's actually a pretty competitive price for an EV certificate.
While I also look forward to letsencrypt being generally available, the fact your parent comment charges $234/yr for a cert is in response to:

> I'd actually pay more than I do now for SSL certs to get that kind of simplicity.

$10/yr to $234/yr is quite the jump.
Is it possible to get a wildcard EV certificate?
Wildcards are prohibited on EV certificates per CA/B Forum requirements: https://cabforum.org/wp-content/uploads/EV-V1_5_61.pdf (Section 9.2.2)
No, which is why most of Google isn't running on EV certs..
Like the other comment says, the font is way too thin on your site and actually hurts to read on my monitor. Any interest I had in this service is effectively gone now.

Text needs to be legible, please try and stick to normal and bold weights.

I didn't know the site is unreadable until uMatrix was disabled.
These shameless plugs are getting really annoying. We know about you, we know CloudFlare and Let's Encrypt are kinda competitors with their free certificates, but you don't have to comment on each post about them. Really, stop annoying us - it doesn't do you any good, honestly!
These shameless plugs are getting really annoying. We know about you

I for one had never heard of these guys and appreciate the mention. Besides, as far as I can recall, it's never been considered problematic to promote your own service on HN as long as the mention is topical and done tastefully.

In this case, the previous commenter was explicitly asking for advice about how to get certificates more conveniently today, so the replies about existing services that can do so seem quite relevant.
It's like trying to sell a Ferrari to a guy who's looking for a regular car...
Maybe so, but you know every regular guy driving a regular car would rather have a Ferrari and might even spend time looking at them even though he can't buy one.
You're wrong. EV is a scam. I can afford to buy EV for most of my sites, but I don't do it. Because consumers don't really care. Even HN doesn't have an EV! Ferrari is what everybody wants, EV is a different story! And stop downvoting all my comments - it shows your subpar human material. Downvote my main point and stop right there. No need to go aggressive and try to silence me and not comment further, because you will "punish" me further as well.
Oh, the commenter asked for the overly expensive EV type? Let's not be the devil's advocate. This is the wrong way to advertise. This is not the beginners corner. You advertise once, twice, three times, people remember, you can search HN - no need to annoy people till the end of the world. The company seems desperate for new business this way anyway.
Who's us? I didn't know you represented me.

I actually had never heard of this and think it's pretty cool.

Grab a dictionary - there's "us", and there's "all".
SSLMate seems pretty easy as well: https://sslmate.com/

(No affiliation, I just saw their HN post some time before)

Looks awesome!

Does anyone know if there's an undo command for `$ letsencrypt run`?

I would love to try this, but too scared to do it and mess up with my nginx configs.

The client has a checkpointing mechanism that does back up old configuration versions and can revert them. (This client feature is called the "reverter", in case you care to look at some of the code or issues related to it on our GitHub page.)

I still haven't figured out how that interacts with the automated renewal features (probably not well right now!) but the ability to revert configurations exists.

Also, please don't try the client with a live site right now, because we don't have general public availability (nobody outside of Let's Encrypt can get a cert issued from the Let's Encrypt intermediate -- you'll get one from "happy hacker fake CA" instead), and we don't have the cross-signature. We're not even quite at the beta-test stage yet, let alone the "please use our certificates on your popular public services" stage. :-)

The main exception would be if you currently don't have HTTPS enabled at all and you're in the mood to experiment to learn more about Let's Encrypt.

For this specific reason I'm a lot more comfortable running the "nosudo"[0] variant, which tells you to install the keys yourself.

A recently released Ruby gem also looks promising, in that it's a much better codebase with a tonne of tests.[1].

[0] https://github.com/diafygi/letsencrypt-nosudo [1] https://github.com/unixcharles/acme-client

Perhaps $ git init your nginx configs?
I mean... back them up? :D
SSLmate (https://sslmate.com/) actually makes things similarly simple — I've been using them for a few months now.