Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

31–40 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#31

Post by Nullabillity »

devy wrote: post #21
xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.

Re: Let's Encrypt root certificate trusted by Mozilla

#32

Post by nsgi »

throwaway29464 wrote: post #28
xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

Check out GlobalSigns Cloud SSL product if you want a cert that can mix wildcards with top level SANs....not free but.... https://www.globalsign.com/en/cloud/

Or AWS Certificate Manager for free if you use AWS.

Re: Let's Encrypt root certificate trusted by Mozilla

#33

Post by mholt »

xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

I spoke about this earlier this week at a meetup. The consensus in the group was that wildcard certificates are desirable because they're easier to manage. If your tooling is good, the automation afforded by ACME can invalidate the need for wildcard certificates.

Re: Let's Encrypt root certificate trusted by Mozilla

#34

Post by nailer »

koolba wrote: post #18
bhhaskin wrote: post #17

Earlier quoted context omitted.

Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal.

> Let's Encrypt is pretty great, but if you have the money get a paid SSL. Not all SSL certs are created equal. Say what? Besides the faux security of the green bar for an EV cert, what's the difference between a LetsEncrypt and a paid one? (non-EV)

Heads up: I work for a company that speeds up the background checks used for EV.

Tying real world identities to public keys is very much a part of crypto. Windows does it with package signing and EV, Debian does it with people holding up their passports at Linux events, and web sites do it with EV HTTPS.

And yes, we (CertSimple) are looking at Certbot support for EV.

Re: Let's Encrypt root certificate trusted by Mozilla

#35

Post by mholt »

wiradikusuma wrote: post #20

Question: any possible case of bad apples that make let's encrypt suddenly lose their trust? Eg bcoz it's free, it's used by "bad guys" just like .info tld.

If Comodo and Symantec are able to retain their trust status, then Let's Encrypt most certainly can.

Re: Let's Encrypt root certificate trusted by Mozilla

#36

Post by icebraining »

Nullabillity wrote: post #31
devy wrote: post #21

Earlier quoted context omitted.

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.

A good example is the Sandstorm platform, which fits both cases.

Re: Let's Encrypt root certificate trusted by Mozilla

#37

Post by Nullabillity »

seiferteric wrote: post #23
0xmohit wrote: post #13

It's about time that HN switches to Let's Encrypt.

It appears that HN's cert is a wildcard, so they can't switch yet anyway.

Does it need to stay that way? I'd assume there are only a couple of subdomains (www, news, maybe a handful more?), so replacing them with SANs or separate certificates shouldn't be too much work.

Re: Let's Encrypt root certificate trusted by Mozilla

#38

Post by aroch »

Nullabillity wrote: post #31
devy wrote: post #21

Earlier quoted context omitted.

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

SAN isn't a practical solution for cases where you don't want to expose which subdomains exist, or where you allocate them dynamically.

Unless all your subdomains are unique (e.g. coming out of a PRNG) AND there are no public DNS entries for them, subdomain enumeration by DNS or IP space is super easy. Not using SAN because of info disclosure concerns is security through obscurity.

Re: Let's Encrypt root certificate trusted by Mozilla

#40

Post by gsnedders »

aroch wrote: post #9
heinrich5991 wrote: post #6

Earlier quoted context omitted.

Other browsers do not have their own certificate stores but use those provided by the OS. Next interesting things are whether Windows and Mac OS X add the root certificate. I think Linux distributions tend to follow Mozilla's trust.

RE: Linux, You're correct, they're provided through the ca-certificates package[0]: "It includes, among others, certificate authorities used by the Debian infrastructure and those shipped with Mozilla's browsers. " RE: OSX - If you can get into Mozilla's trust stores, it's the same steps (and pro forma, more or less) [1] [0] https://packages.debian.org/wheezy/ca-certificates [1] https://www.apple.com/certificateautho…

Historically ca-certificates has included certificates that Mozilla had declined to include due to lack of audits, most notably the SPI root certificate because some Debian infrastructure relied upon it. They've also generally been relatively slow in removing root certificates after they're removed upstream, despite any removal essentially being a security issue. I think as of six months or so ago there is no longer any difference between ca-certificates and upstream.
Post reply on HN