diff --git a/content/en/how-it-works.md b/content/en/how-it-works.md index b36dc2f8c..03a07923f 100644 --- a/content/en/how-it-works.md +++ b/content/en/how-it-works.md @@ -58,7 +58,7 @@ Renewing a certificate at a later time means repeating the issuance process over ### Revocation -Revocation works in a similar manner. The client signs a revocation request with the account key pair authorized for `example.com`, and the Let's Encrypt CA verifies that the request is authorized. If so, it publishes revocation information via [Certificate Revocation List](https://en.wikipedia.org/wiki/Certificate_revocation_list) (CRL), so that relying parties such as browsers can know that they shouldn't accept the revoked certificate. +Revocation works in a similar manner. The client signs a revocation request with the account key pair authorized for `example.com`, and the Let's Encrypt CA verifies that the request is authorized. If so, it publishes revocation information via a [Certificate Revocation List](https://en.wikipedia.org/wiki/Certificate_revocation_list) (CRL), so that relying parties such as browsers can know that they shouldn't accept the revoked certificate.
Requesting revocation of a certificate for example.comDell PowerEdge R7525 internals. The two silver rectangles in the middle are the CPUs. The RAM sticks, each 64GB, are above and below the CPUs. The 24x NVMe drives are in the front of the server, on the far left. -By going with AMD EPYC, we were able to get 64 physical CPU cores while keeping clock speeds high: 2.9GHz base with 3.4GHz boost. More importantly, EPYC provides 128 PCIe v4.0 lanes, which allows us to put 24 NVMe drives in a single machine. NVMe is incredibly fast (\~5.7x faster than the SATA SSDs in our previous-gen database servers) because it uses PCIe instead of SATA. However, PCIe lanes are typically very limited: modern consumer chips typically have only 16 lanes, and Intel’s Xeon chips have 48. By providing 128 PCI lanes per chip (v4.0, no less), AMD EPYC has made it possible to pack large numbers of NVMe drives into a single machine. We’ll talk more about NVMe later. +By going with AMD EPYC, we were able to get 64 physical CPU cores while keeping clock speeds high: 2.9GHz base with 3.4GHz boost. More importantly, EPYC provides 128 PCIe v4.0 lanes, which allows us to put 24 NVMe drives in a single machine. NVMe is incredibly fast (\~5.7x faster than the SATA SSDs in our previous-gen database servers) because it uses PCIe instead of SATA. However, PCIe lanes are typically very limited: modern consumer chips typically have only 16 lanes, and Intel’s Xeon chips have 48. By providing 128 PCIe lanes per chip (v4.0, no less), AMD EPYC has made it possible to pack large numbers of NVMe drives into a single machine. We’ll talk more about NVMe later. ## Performance Impact @@ -79,7 +79,7 @@ Queries now average *three times faster*, about 0.15ms. NVMe drives are becoming increasingly popular because of their incredible performance. Up until recently, though, it was nearly impossible to get many of them in a single machine because NVMe uses PCIe lanes. Those were very limited: Intel’s Xeon processors come with just 48 PCIe v3 lanes, and a number of those are used up by the chipset and add-on cards such as network adapters and GPUs. You can’t fit many NVMe drives in the remaining lanes. -AMD’s latest generation of EPYC processors come with 128 PCIe lanes - more than double what Intel offers - and they’re PCIe v4! This is enough to pack a 2U server full of NVMe drives (24 in our case). +AMD’s latest generation of EPYC processors comes with 128 PCIe lanes - more than double what Intel offers - and they’re PCIe v4! This is enough to pack a 2U server full of NVMe drives (24 in our case). Once you have a server full of NVMe drives, you have to decide how to manage them. Our previous generation of database servers used hardware RAID in a RAID-10 configuration, but there is no effective hardware RAID for NVMe, so we needed another solution. One option was software RAID (Linux mdraid), but we got several recommendations for OpenZFS and decided to give it a shot. We’ve been very happy with it! diff --git a/content/en/post/2024-12-11-EOY-letter-2024.md b/content/en/post/2024-12-11-EOY-letter-2024.md index 933cd0b07..c59fd375e 100644 --- a/content/en/post/2024-12-11-EOY-letter-2024.md +++ b/content/en/post/2024-12-11-EOY-letter-2024.md @@ -16,7 +16,7 @@ _This letter was originally published in our [2024 Annual Report](https://abette The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent security -and stability. Our understanding of what it will take to make more privacy-preserving +and stability. Our understanding of what it will take to make privacy-preserving metrics more mainstream via our Divvi Up project is evolving in important ways. Prossimo has made important investments in making software critical infrastructure safer, from TLS and DNS to the Linux kernel. diff --git a/content/en/post/2025-03-18-community-of-funders.md b/content/en/post/2025-03-18-community-of-funders.md index b0ca51789..6f535e131 100644 --- a/content/en/post/2025-03-18-community-of-funders.md +++ b/content/en/post/2025-03-18-community-of-funders.md @@ -33,4 +33,4 @@ Indeed, this contribution is significant because of its scale, but more importan Ten years ago we set out to build a better Internet through easy-to-use TLS. If you or your organization have supported us throughout the years, thank you for joining Jeff in believing in the work of Let's Encrypt. For a deeper dive into the impact of Let's Encrypt and ISRG's other projects, take a look at our [most recent annual report](https://www.abetterinternet.org/documents/2024-ISRG-Annual-Report.pdf). -_Let's Encrypt is a project of the nonprofit Internet Security Research Group, a 501(c)(3) nonprofit committed to protecting Internet users by lowering monetary, technological, and informational barriers to a more secure and privacy-respecting Internet. For more, visit [abetterinternet.org](https://abetterinternet.org). Press inquiries can be sent to [press@abetterinternet.org](mailto:press@abetterinternet.org)_ \ No newline at end of file +_Let's Encrypt is a project of the nonprofit Internet Security Research Group, a 501(c)(3) nonprofit committed to protecting Internet users by lowering monetary, technological, and informational barriers to a more secure and privacy-respecting Internet. For more, visit [abetterinternet.org](https://abetterinternet.org). Press inquiries can be sent to [press@abetterinternet.org](mailto:press@abetterinternet.org)._ \ No newline at end of file diff --git a/content/en/post/2026-04-10-test-sites.md b/content/en/post/2026-04-10-test-sites.md index 7edb5ebfc..1de85d96a 100644 --- a/content/en/post/2026-04-10-test-sites.md +++ b/content/en/post/2026-04-10-test-sites.md @@ -48,7 +48,7 @@ And finally, we need a webserver to host the certificates. We're using Go, which If you visit one of our revoked sites, you might not get an error message. Revocation checking in browsers varies pretty widely, and has historically not worked great. Today's state-of-the-art is [Firefox's CRLite](https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/), which is efficient and reliable. Ubuntu is deploying [upki](https://discourse.ubuntu.com/t/an-update-on-upki/77063), a Rustls project based on CRLite. We hope other browsers and operating systems follow suit. The upki project is a great example of a project [making use of](https://github.com/rustls/upki/tree/main/revoke-test) these revoked test certificates, too. -The actual content of the website isn't terribly important: We just have a little HTML page explaining what the site is. But since this website is meant for testing clients, there's more than just browsers connecting. In particular, it's pretty routine that I try connecting with `curl` or some other terminal http client, and getting a bunch of HTML spewed to your terminal isn't very nice. +The actual content of the website isn't terribly important: We just have a little HTML page explaining what the site is. But since this website is meant for testing clients, there's more than just browsers connecting. In particular, it's pretty routine that I try connecting with `curl` or some other terminal http client, and getting a bunch of HTML spewed to my terminal isn't very nice. As a small Easter egg, we added a plain text version of the website with an ASCII art version of our logo that we serve if your HTTP client doesn't include text/html in its `Accept` HTTP header. You can pass a ?txt or ?html URL parameter to specifically request one or the other version of the content, if you just want to [see the ASCII art](https://valid.x2.test-certs.letsencrypt.org/?txt).