Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt is down

letsencrypt.status.io

Post reply on HN
Print view View original

11–20 of 167 posts

Re: Let's Encrypt is down

#11

Post by atonse »

mastax wrote: post #9
throw2016 wrote: post #7

Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…

I don't disagree about CAs, but LE suggests to renew certs every 60 days. So unless this outage lasts a month or some acme tool is poorly made it shouldn't affect anything except new registrations.

The only exception is OCSP data. If you're stapling, I think that lasts a week, but I'm not 100% sure.

Anyway, in either case, your site should absolutely be able to weather CA downtime like this.

Re: Let's Encrypt is down

#12

Post by QUFB »

Not only is it a problem with certificate issuance - but their OCSP servers are also down. This caused an issue on one of my sites where I was using OCSP Stapling: normal browser connections were failing, but not tools like curl (which don't ask for the OCSP response over SSL).

Re: Let's Encrypt is down

#13

Post by discreditable »

scrollaway wrote: post #2

Was fun finding this out during a random server cycle. Turns out, Caddy doesn't appreciate the ACME server being down, and refuses to start :) https://github.com/mholt/caddy/issues/1680

Wow @ that close comment:

> So, this is not a bug and all is working as intended.

Caddy folks had better never restart the caddy service (or server) while LE happens to be down, even if you already have a valid cert!

Re: Let's Encrypt is down

#14

Post by tscs37 »

throw2016 wrote: post #7

Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…

You can run your own ACME provider, the code is open source.

Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question.

The automation of LE is not the problem either. Properly automated systems would extend/renew the cert well before they are invalid, almost every LE guide I know mentions this on grounds of "what if LE is down".

The only libraries and services affected are those who do not properly code for an external service provider being temporarily offline.

The problem with OOB verification of certs is that it's slow and inefficient for almost all methods this can be done with. And it doesn't scale either.

Imagine if everyone wanted to OOB verify the Google certs on the same day.

Re: Let's Encrypt is down

#15

Post by Vendan »

discreditable wrote: post #13
scrollaway wrote: post #2

Was fun finding this out during a random server cycle. Turns out, Caddy doesn't appreciate the ACME server being down, and refuses to start :) https://github.com/mholt/caddy/issues/1680

Wow @ that close comment: > So, this is not a bug and all is working as intended. Caddy folks had better never restart the caddy service (or server) while LE happens to be down, even if you already have a valid cert!

I clicked the link, saw it was closed, and thought, "Wow, these guys are fast". Then I read it....

Re: Let's Encrypt is down

#16

Post by falcolas »

IgorPartola wrote: post #10

I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.

Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager

Re: Let's Encrypt is down

#17

Post by tokenizerrr »

scrollaway wrote: post #2

Was fun finding this out during a random server cycle. Turns out, Caddy doesn't appreciate the ACME server being down, and refuses to start :) https://github.com/mholt/caddy/issues/1680

And best part, according to the developer this is working as intended. A webserver with perfectly valid cached certificates refusing to start.

Re: Let's Encrypt is down

#19

Post by tyingq »

discreditable wrote: post #13
scrollaway wrote: post #2

Was fun finding this out during a random server cycle. Turns out, Caddy doesn't appreciate the ACME server being down, and refuses to start :) https://github.com/mholt/caddy/issues/1680

Wow @ that close comment: > So, this is not a bug and all is working as intended. Caddy folks had better never restart the caddy service (or server) while LE happens to be down, even if you already have a valid cert!

That's going to be a limiter for adoption. Hopefully @mholt reconsiders.

Update: Mholt pushed a change where caddy only refuses to start if the cert is expiring in 7 days or less. https://github.com/mholt/caddy/commit/410ece831f26c61d392e0e...

Re: Let's Encrypt is down

#20

Post by tyingq »

falcolas wrote: post #16
IgorPartola wrote: post #10

I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.

Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager

ACM is nice, but it does require the manual step of clicking a link in a verification email.
Post reply on HN