"High assurance datacenter" High assurance my ass. Those don't go down unless there's a DDOS or catastrophic failure (often several). Then, they're right back up. People need to stop misusing this label. Another is "high-assurance" certs from vendors that get compromised or subverted easily. Only one high-assurance CA that I know of. It's not around for business reasons, though.
Let's Encrypt is down
21–30 of 167 posts
Re: Let's Encrypt is down
#22Earlier quoted context omitted.
Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager
ACM is nice, but it does require the manual step of clicking a link in a verification email.
Yes but it also issues certs for a year, which helps alleviate that email link issue.
Re: Let's Encrypt is down
#23On the plus side, as a side effect to this event, most of libraries shall start handling this case in better robust ways..
Usually takes a serious failure first. Then, they start doing real robustness... on just that one thing. ;)
Re: Let's Encrypt is down
#24Traefik is having a problem similar to Caddy, where having letsencrypt down prevents it to boot.
Re: Let's Encrypt is down
#25Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…
You shouldn't renew the 90 day cert on day 89 anyway. As long as Let's Encrypt isn't down for more than a day I don't see the problem.
Re: Let's Encrypt is down
#26I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.
Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager
I think the OP is asking / looking forward big tech like them to host the infrastructure for higher availability. Basically like a mirror. To end users they are just the same server.
On the side note, is the LE infrastructure globally distributed or currently all reside in US/West and/or US/East? Is Mozilla currently the one hosting?
Re: Let's Encrypt is down
#27I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.
Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager
I am talking about it being wide open, not just for AWS, and implementing the ACME protocol.
Re: Let's Encrypt is down
#28Not only is it a problem with certificate issuance - but their OCSP servers are also down. This caused an issue on one of my sites where I was using OCSP Stapling: normal browser connections were failing, but not tools like curl (which don't ask for the OCSP response over SSL).
What's the typical validity period for OCSP responses with Let's Encrypt? Shouldn't the stapled responses continue working for at least a couple hours even after Let's Encrypt goes down?
Re: Let's Encrypt is down
#29So in case this helps anyone, I had people complaining about strange OCSP errors all over the morning coming from my server (using apache httpd).
It turns out apache does practically everything to behave as dumb as possible in case of OCSP downtimes.
If the OCSP sends an error it will send the error as a stapled OCSP reply (instead of using an old, still valid OCSP reply). You can't make it behave sane here, but you can at least tell it to not return the error with SSLStaplingReturnResponderErrors set to off.
However if the OCSP isn't available at all apache will fake its own OCSP error (sic!) and send it. This is controlled by the option SSLStaplingFakeTryLater, which defaults to on. So if your firefox users get strange OCSP errors, it's most likely this. The doc for SSLStaplingFakeTryLater claims that this option is only effective if SSLStaplingFakeTryLater is set to on, however that's wrong.
tl;dr set both of these options to "off", then at least apache won't staple any garbage in your TLS connection, firefox will try to reach the ocsp on its own and fail and still accept the connection. Yes, that's all pretty fucked up.
Re: Let's Encrypt is down
#30I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.
Redundancy yeah! But does it have to be one of those 4? I'm getting slightly worried and very bored by their dominance in infrastructure.