Viewing profile — j4cob

Wow, thank you for all of your work on Sensei's Library! It made a huge impression on me in ~2003, and has really helped me understand Go better and get stronger. I work on Let's E…

Folks may also be interested to read this useful summary of issues around locally installed roots: https://github.com/njh/dymo-root-ca-security-risk/blob/maste...

The implicit threat model here is "no one outside your machine can do something to you to make 127.0.0.1 traffic route elsewhere." It's true that software running on your machine c…

FYI, OpenSSL has a new flag that makes the "-extensions" part somewhat simpler, but most people won't have it in their copy yet: https://github.com/openssl/openssl/pull/4986

For your use case, I'd recommend that you either combine them using SAN certificates, as one commenter suggested, or issue them over the span of a few weeks. Processing rate limit …

(Let's Encrypt engineer) > large organisations (I'm sure there are more than 20 sites run under .mit.edu sites by different teams who wouldn't want to share multi-name certificates…

(Let's Encrypt engineer) Token bucket is a good idea, and I agree that it would make the user experience of hitting rate limits less onerous. We implemented sliding windows because…

FWIW, cPanel just announced Let's Encrypt integration with their AutoSSL feature: https://blog.cpanel.com/announcing-cpanel-whms-official-lets...

This was a performance decision. Cross-signing the root instead of the intermediate would mean that web servers would have to include both the root and the intermediate in the chai…