Viewing profile — bifurcation

Just to clear up one point -- Let's Encrypt did not at all force ACME on the industry. We deliberately took it to the IETF so that we could get input from more parts of the industr…

Heh, as I was saying about shorter lifetimes encouraging automation... https://news.ycombinator.com/item?id=46210786

Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the …

The idea here is to be lighter-weight than profiles, or the similar feature in Chrome. I've got three different containers going right now, side-by-side in one browser window. In a…

Actually, it's in Beta now, and will be shipping to Firefox release channel users on Monday or Tuesday.

It's a mix. Some patches are just getting rebased and landed. For others, the Firefox and Tor Browser teams are working together to re-implement the feature in a way that makes mor…

Fingerprinting (in general) is the next thing on the agenda after First Party Isolation. Addressing canvas fingerprinting is in the plan: https://wiki.mozilla.org/Security/Fingerpr…

In a word, yes. When a server uses a Let's Encrypt certificate, a browser will consider it as issued under an IdenTrust root CA, which the browser trusts. So it will consider the L…

Other things I use all the time: `openssl x509 -in $FILE -text | less` https://lapo.it/asn1js https://golang.org/pkg/crypto/x509/ https://github.com/agl/certificatetransparency

Yep, that should work fine. You'll just need to do the validation process for each domain.

Unfortunately, ECDSA support is not as universal as RSA. But I understand that the plan is to start working on ECDSA support pretty much as soon as the first root is stood up, so i…

You've got things a little confused here. Let's Encrypt doesn't need to be part of the CABF in order to be included in the browsers, but they do need to demonstrate that they abide…

The CA/Browser Forum Baseline Requirements require that the CA have you sign one: "Prior to the issuance of a Certificate, the CA SHALL obtain ... either: 1. The Applicant’s agreem…

openssl req -new -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem openssl s_server -accept 8000 -key key.pem -cert cert.pem -HTTP

The use of HTTPS doesn't destroy cacheability, it just requires that one of the legitimate endpoints authorize the cache to be there.

Hey, this is Richard, the author of the post. All the feedback here is great, but if you've got thoughts on whether we should pursue this strategy or not, please comment on the moz…

The Mozilla root program currently has a similar plan proposed, with a final decision pending in the next day or so. https://groups.google.com/forum/#!topic/mozilla.dev.security...…

That's correct. Also, if you've got an A/AAAA record for the domain name in question, you could run an ACME client on that box that spins up a temporary web server. That's what the…

> I don't know what the story is with that site Turns out they had the wrong certificate chain provisioned. Seems to be fixed now.

Yes, we plan to apply a few mitigations of this type. Part of the idea of the "Proof of Possession of a Prior Key" challenge is so that if a web server requests a cert for a domain…

See also: https://sendto.mozilla.org/

We're working on an FAQ. This thread has been really helpful in clarifying which Qs are FA :) With regard to your questions: > Will it provide wildcard certs? Not initially, but po…

Getting to short-lived certificates is a goal, but the reality for now is that OCSP and CRLs are what implementations require, and what the CABF Baseline Requirements require. So w…