Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

anchor.dev

Post reply on HN
Print view View original

51–60 of 60 posts

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#51

Post by weddpros »

nbadg wrote: post #18
masfuerte wrote: post #12

Earlier quoted context omitted.

If users delegate their DNS to you, what's stopping you issuing a certificate to yourself for their site?

Certificate transparency logs are likely the only realistic way, but you could make the same argument against your DNS provider. Trust has to start somewhere. Whether or not something like this makes sense to you is probably a question of your personal threat model.

Seeing how people are worried about third parties issuing certificates, I encourage using a tool to monitor CT Logs. It really makes the fog of war disappear around your certificates.

https://crt.sh for point in time checks, https://sslboard.com for comprehensive oversight (disclosure: I'm the founder)

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#52

Post by weddpros »

xmprt wrote: post #2

I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first thing about CAs but Let's Encrypt really isn't that difficult to understand.

There's a scale beyond which the real challenge isn't issuing a certificate.

I see organisations with thousands of SSL certificates, and their struggle is real. Even reputable companies with huge teams have their certificates expire or served badly. Some serve expired certificates for years!

Plus, enterprise alternatives are extremely costly and rigid.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#53

Post by weddpros »

michaelt wrote: post #4
xmprt wrote: post #2

I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first thing about CAs but Let's Encrypt really isn't that difficult to understand.

I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with mo…

I think it's more a matter of scale. If you need SSL certificates for hundreds of appliances and you want to manage it, rather than hack it, that's the product you need.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#54

Post by weddpros »

bobbob1921 wrote: post #26

I’ve never understood why there isn’t an easy way (ie that never expires) to use certificates or otherwise encrypt communications. I’m mainly referring to unique or internal use cases where the complications around certificates expiring has made it so that those communications end up unencrypted (SSL disabled). I guess what I’m saying is I’ve come across many cases where even bad encryption is better than plaintext,…

You could see expiring certificates as a chance to examine your security regularly: protocols and ciphers change, bugs are fixed, vulnerabilities are discovered and fixed.

Setup and forget is never good for security. From what I see with sslboard.com (I'm the founder), all hosts serving old expired certificates also have bad TLS versions and ciphers (RC4, DES) and vulnerabilities.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#55

Post by tenuousemphasis »

weddpros wrote: post #52
xmprt wrote: post #2

I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first thing about CAs but Let's Encrypt really isn't that difficult to understand.

There's a scale beyond which the real challenge isn't issuing a certificate. I see organisations with thousands of SSL certificates, and their struggle is real. Even reputable companies with huge teams have their certificates expire or served badly. Some serve expired certificates for years! Plus, enterprise alternatives are extremely costly and rigid.

All the more reason to automate renewing of certificates.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#58

Post by wredcoll »

derefr wrote: post #23
toast0 wrote: post #13

Earlier quoted context omitted.

> * If you want an SSL certificate for, say, your printer Ummmm why does my printer need a certificate?

If you're already thinking in the IPv6 mode of thought — where NAT / network-local addresses are irrelevant/obsolete, as long as there's a stateful firewall somewhere in front of your LAN devices, to treat all LAN devices as default-closed to incoming packets from outside the LAN's IPv6 network prefix... ...then (at least in theory!) there's no reason to not also give every one of those devices, with their public-rou…

> The problem with this being that neither routers nor IoT devices have any way to assign DNS-like names to devices on your network

Is this because an ipv6 network doesn't have DHCP which has the side effect of telling the router the hostname of the machine asking for an IP?

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#59

Post by weddpros »

tenuousemphasis wrote: post #55
weddpros wrote: post #52

Earlier quoted context omitted.

There's a scale beyond which the real challenge isn't issuing a certificate. I see organisations with thousands of SSL certificates, and their struggle is real. Even reputable companies with huge teams have their certificates expire or served badly. Some serve expired certificates for years! Plus, enterprise alternatives are extremely costly and rigid.

All the more reason to automate renewing of certificates.

Sure! yet automation only solves one problem (until it doesn't). Inventory and control/accountability is still needed at scale, and automation doesn't provide it.

Re: Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates

#60

Post by fuckinpuppers »

Hackbraten wrote: post #43
Palomides wrote: post #36

Earlier quoted context omitted.

if you can't trust your network, everything needs to be public internet level hardened anyway, so why not just directly use letsencrypt?

Because you don't want to expose your printer to the public Internet?

Isn’t that what dns challenge can be used for?
Post reply on HN