Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

anchor.dev

Post reply on HN
Print view View original

11–20 of 60 posts

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#11

Post by woodruffw »

eternauta3k wrote: post #8
michaelt wrote: post #4

Earlier quoted context omitted.

I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with mo…

Why not sign it yourself?

Most people find the user experience of self-signed certificates much worse. The developer experience for local issuance isn't great, although mkcert does a really great job of smoothing the parts that can be smoothed[1].

[1]: https://github.com/FiloSottile/mkcert

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#12

Post by masfuerte »

benburkert wrote: post #9
aeaa3 wrote: post #6

Does this means that you have the ability to a) impersonate the identities of your users and b) decrypt the SSL traffic of your users ?

It does not. Anchor never see sees your private keys for certificates. We hold an ACME account key on your behalf with the CA, but we cannot use it impersonate your domain or decrypt traffic. We have a more technical overview of how this works in our docs: https://anchor.dev/docs/public-certs/acme-relay

If users delegate their DNS to you, what's stopping you issuing a certificate to yourself for their site?

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#13

Post by toast0 »

michaelt wrote: post #4
xmprt wrote: post #2

I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first thing about CAs but Let's Encrypt really isn't that difficult to understand.

I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with mo…

> * If you want an SSL certificate for, say, your printer

Ummmm why does my printer need a certificate?

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#14

Post by mholt »

toast0 wrote: post #13
michaelt wrote: post #4

Earlier quoted context omitted.

I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with mo…

> * If you want an SSL certificate for, say, your printer Ummmm why does my printer need a certificate?

If you can't trust your network, you'll want encryption, regardless of devices on it.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#15

Post by traceroute66 »

Oh dear.

I'm sorry. But do you really need to re-invent the wheel yet again ?

Go to the Let's Encrypt website, there is a whole page of client implementations[1].

What makes yours better than, for example, `lego` or `caddy` or `step` ?

All of which are easy to use, come with sensible defaults and do not provide you with "innumerable ways to shoot yourself in the foot".

And for people who really can't use Let's Encrypt because "its difficult", there are still all the old-school, well-established, commercial CA's out there who will hold your hand in return for a few dollars.

[1] https://letsencrypt.org/docs/client-options/

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#16

Post by michaelt »

toast0 wrote: post #13
michaelt wrote: post #4

Earlier quoted context omitted.

I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with mo…

> * If you want an SSL certificate for, say, your printer Ummmm why does my printer need a certificate?

Well yes, you've just hit on why this is a rather niche product.

You get a handful of somewhat questionable benefits. If for some reason your guests are visiting your printer's administration page, they won't have to click through a scary warning page. If someone is somehow sniffing all the traffic within your home network they won't be able to get your printer's administrative password.

But the main reason is some homelab enthusiasts are like bodybuilders at the gym - taking on tasks that seem Sisyphean to outsiders, for fun and to build their strength.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#18

Post by nbadg »

masfuerte wrote: post #12
benburkert wrote: post #9

Earlier quoted context omitted.

It does not. Anchor never see sees your private keys for certificates. We hold an ACME account key on your behalf with the CA, but we cannot use it impersonate your domain or decrypt traffic. We have a more technical overview of how this works in our docs: https://anchor.dev/docs/public-certs/acme-relay

If users delegate their DNS to you, what's stopping you issuing a certificate to yourself for their site?

Certificate transparency logs are likely the only realistic way, but you could make the same argument against your DNS provider. Trust has to start somewhere.

Whether or not something like this makes sense to you is probably a question of your personal threat model.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#19

Post by bananapub »

for everyone willing to put a tiny amount of effort in, you can just:

1. Install acme-dns somewhere

2. Point part of your domain to that

3. Use lego or caddy or whatever to get certs using dns-01

No need to pay some dude who can then forge certs for your domain.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#20

Post by benburkert »

masfuerte wrote: post #12
benburkert wrote: post #9

Earlier quoted context omitted.

It does not. Anchor never see sees your private keys for certificates. We hold an ACME account key on your behalf with the CA, but we cannot use it impersonate your domain or decrypt traffic. We have a more technical overview of how this works in our docs: https://anchor.dev/docs/public-certs/acme-relay

If users delegate their DNS to you, what's stopping you issuing a certificate to yourself for their site?

We theoretically could, but those certificates would show up in CT logs. (For quick & easy monitoring, you can get an RSS feed for your domain on https://crt.sh/, but it's not the most reliable service.) It would be a reputation killer if we did that, just like it would be for your DNS provider or ISP.
Post reply on HN