Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

111–120 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#111

Post by hawkice »

teraflop wrote: post #46
mholt wrote: post #33

Earlier quoted context omitted.

I spoke about this earlier this week at a meetup. The consensus in the group was that wildcard certificates are desirable because they're easier to manage. If your tooling is good, the automation afforded by ACME can invalidate the need for wildcard certificates.

The problem is that Let's Encrypt enforces rate limits on how frequently you can request new certificates. According to the documentation[1], the limit averages out to one certificate (which can include up to 100 hostnames) per roughly 8 hours, per domain. That's probably good enough for almost everyone who uses hostnames to represent physical machines or services. But it's totally unusable if you want to create cert…

I deploy all the different little code projects I make to different domains and I've hit the Let's Encrypt rate limit. If (like me) you waited a couple months to secure these little side projects, you'll hit the rate limit too. That being said, I just waited a week -- now everything is secure.

Re: Let's Encrypt root certificate trusted by Mozilla

#112

Post by __david__ »

devy wrote: post #21
xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

Any idea what makes it a hard problem? I see nothing that actually explains the issue.

Re: Let's Encrypt root certificate trusted by Mozilla

#113

Post by xienze »

GhotiFish wrote: post #91
xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

This 100% blocked me. I tried to work around it by using lets encrypt to provision me certificates on the fly, but I got rate limited. Then I started speccing out a way to get single certs for many subdomains in one request using SAN, and the whole thing looked like it would require more development time compared to just buying a wildcard cert. Very frustrating.

I mean it kind of makes sense doesn't it? If you need enough certs (> 20 per week) to hit the rate limit, you're probably running some sort of business -- in which case you probably shouldn't be depending on a free service and can likely afford the cost of wildcard certs.

Re: Let's Encrypt root certificate trusted by Mozilla

#114

Post by dimino »

xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

I feel like this is one of those "faster horse" moments.

You don't need a wildcard cert! Just get certs for each one of your subdomains, even internally.

Re: Let's Encrypt root certificate trusted by Mozilla

#115

Post by illumin8 »

__david__ wrote: post #112
devy wrote: post #21

Earlier quoted context omitted.

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1] LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability. [1]: https://github.com/certbot/certbot/issue…

Any idea what makes it a hard problem? I see nothing that actually explains the issue.

It's because once someone has a wildcard cert they can use it anywhere, in malicious ways: phishing emails that send you to bankofamerica.banking.io or other nefarious type of things.

Re: Let's Encrypt root certificate trusted by Mozilla

#116

Post by vtlynch »

saynsedit wrote: post #100
jerf wrote: post #26

Earlier quoted context omitted.

The purpose of Let's Encrypt, and the SSL certificate infrastructure in general, isn't to prevent "bad guys" from getting certificates. It's to ensure that if you own the box, the certificate verifies that a web client is speaking directly to that box with nothing in between. (Or more generally, directly to an authorized end point by the owner of that DNS entry. Authority can be delegated.) In other words, it keeps b…

Source? I remember reports in the past decrying CAs for issuing certificates for phishing sites in the style of "gooogle.com" etc.

Some in the industry, including some CAs (Certificate Authorities), believe that issuing certificates to "malicious" websites should be against the rules of the CA/B Forum, the industry body that sets guidelines for CA behavior.

You are right that some news articles and reports continue to chastise CAs who issue to sites in the style of "gooogle.com". Do not let them trick you - that is only their opinion on the matter. It is NOT against the industry rules to issue those certificates.[1]

What IS against the rules is to issue a certificate for "domain.com" to someone who has not proven ownership of "domain.com". That is the BIG no-no that leads to consequences such as being un-trusted. There are standardized methods for meeting the burden of proof, and every CA uses more or less the same mechanisms to do so.

Let's Encrypt, or any CA, may issue a certificate to "paaypal.com". Even if that site was a Paypal phishing site, a CA is under no obligation to revoke the certificate or prevent that user from getting another certificate.

Some CAs CHOOSE to do this. To some extent, I think it is sensible to try to thwart malicious use. However, the case is often made that CAs and SSL certificates are not meant to "police content", and furthermore, that they are not very effective at doing so.

Flagging a malicious site through a tool like Google's SafeBrowsing is significantly more effective than revoking their SSL certificate.

[1] Except for a more recent stipulation that Microsoft added to their root program. If they request the revocation of a certificate they believe is malicious, the CA is expected to comply. If they dont, they are only at risk of being punished by Microsoft.

Re: Let's Encrypt root certificate trusted by Mozilla

#117

Post by xutopia »

dimino wrote: post #114
xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

I feel like this is one of those "faster horse" moments. You don't need a wildcard cert! Just get certs for each one of your subdomains, even internally.

I get where you're coming from but I depend on a subdomain for each one of my user signups and we're talking thousands. LE limits us to 100 subdomains on a single cert and would require a restart for each signup. I'll definitely be using LE for other projects but many use cases require wildcards.

Re: Let's Encrypt root certificate trusted by Mozilla

#118

Post by gsnedders »

mynameisvlad wrote: post #63
gkanai wrote: post #43

Earlier quoted context omitted.

> (and Firefox which has their own CA store for some reason). Firefox has it's own CA store because it's built for all 3 major (desktop) platforms. OSX and Windows have their own but Linux does not and uses Mozilla's.

Does Chrome provide its own CA store on Linux? It's also built for all 3 major desktop platforms but uses the OSX and Windows stores.

They just use a copy of Mozilla's one on Linux. Of course, distro packages of Chromium if they use the system NSS library may well use some system CA store.

Re: Let's Encrypt root certificate trusted by Mozilla

#119

Post by Nullabillity »

gist wrote: post #96
arcticfox wrote: post #72

Earlier quoted context omitted.

HN, of all places, may take the trouble to actually make a small statement however. People would actually notice here.

> may take the trouble to actually make a small statement however Another move in the direction of political correctness and making decisions according to optics. Have you considered valid business purposes for a company doing a particular act or are you just deciding that everyone thinks this was a "scumbag" action?

Have you considered valid personal purposes for shoplifting or are you just deciding deciding that everyone thinks this was a "scumbag" action?

Re: Let's Encrypt root certificate trusted by Mozilla

#120

Post by marcosdumay »

mholt wrote: post #74
dyladan wrote: post #64

Earlier quoted context omitted.

Sometimes magic isn't a good thing, especially when you're operating a service used by as many people as hn daily. Magic means things happened that I didn't explicitly instruct.

That's called automation and it's a good thing.

"Magic" is automation that is hidden from you. That one is not universally good. The one thing you don't want on the configurations of a server farm is "magic". It is simply impossible to manage.

But it's a good thing LE is available without the magic too.

Post reply on HN