Viewing profile — dextercd

This comment on the 7th of May from someone at Let's Encrypt says that implementation may be delayed until Q3 due to open issues in the specification. That might be what happened. …

Apparently VeriSign plans to discontinue .name: https://itp.cdn.icann.org/en/files/consensus-policies/rsep-2...

Your comment is 100% correct, but I just want to point out that this doesn't negate the risks of bob's approach here. LE wouldn't see this as a legitimate reason to raise rate limi…

An account needs to be created before you can request a certificate. Some ACME clients might create the account for you implicitly when you request the first certificate, but in th…

This adds a new validation method that people can use if they want. The existing validation methods ( https://letsencrypt.org/docs/challenge-types/ ) aren't going away, so your cur…

The server that wants to authenticate clients via mTLS doesn't need the clientAuth EKU on its certificate, only the clients do. Most of the time you set up mTLS by creating your ow…

Thanks for chiming in! I remember now that you also said this on the LE community forum. Right, that explains it. So the use would be for things other than websites or for websites…

All major root store programs (Chrome, Apple, Microsoft, Mozilla) have this power. They set the requirements that CAs must follow to be included in their root store, and for most C…

It's a requirement from the Chrome root program. This page is probably the best resource on why they want this: https://googlechrome.github.io/chromerootprogram/moving-forw...

Interesting! On the Google search results page at the bottom there's a city name + "From your IP address" link. Clicking it shows a map with a circled region. It seems to match wit…

2.33 km off for me. Pretty cool

You need external monitoring of certificate validity. Your ACME client might not be sending failure notifications properly (like happened to Bazel here). The client could also thin…

Here's the Python version I've been using: https://gist.github.com/dextercd/3bd65c1e32635b9e7bebf287b52... Another issue I just ran into is that a colon separated value for ExecSea…

You can use systemd-run with --shell (or a subset of options enabled by --shell) and -p to specify service properties to run commands interactively in a similar environment as your…

A code signing certificate does not cost $500 a year. The OP links to an offering by Certum which is just $25 a year plus the cost for a reusable smart card. Personally, I recently…

CT definitely helps, but not everyone monitors it. This is an area where I still need to improve. But even if you detect a misissued cert, it can not reliably be revoked with OCSP/…

Sure, but it's even better if everyone else does too, including attackers that mislead CAs into misissuing a cert. CAs used to be able to use WHOIS for DCV. The fact that this opti…

Apple introduced this proposal. Why would they care about a CA's legal exposure? Lower the lifetime of certs does mean that orgs will be better prepared to replace bad certs when t…

Stealing a private key or getting a CA to misissue a certificate is hard. Then actually making use of this in a MITM attack is also difficult. Still, oppressive states or hacked IS…

No idea how many are first-party or vetted by Microsoft. Probably none of them. But I really, really doubt you can only run software that ticks one of those two boxes. Certify The …

I learned a lot from TLS Mastery by Michael W. Lucas.

Let's Encrypt lists 10 ACME clients for Windows / IIS. If an organisation ignores all those options, then I suppose they should keep doing it manually. But at the end of the day, t…

If a CA or subscriber improves their security but had an undetected incident in the past, a hacker today has a 397 day cert and can reuse the domain control validation in the next …

I think most orgs can get away with free ACME clients and free/cheap monitoring options. This will be painful for people in the short term, but in the long term I believe it will m…

"outdated certificate data" would be domains you no longer control. (Example would be a customer no longer points a DNS record at some service provider or domains that have changed…