41–50 of 167 posts
I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.
Amazon maybe.
Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…
Earlier quoted context omitted.
If you use one of the myriad of automated tools for using LE, you will get your cert renewed as early as 30 days before it expires. So right now the issue should only be with new domains getting certs. If you renew LE certs manually, first what is wrong with you and don't you like yourself? Second, at that point it's no different than NameCheap going down and you getting your cert from 1and1 instead.
Wish someone would write one of those automated tools for Google App Engine-hosted apps. That renewal process is exactly like regex. Once every three months I need it, and have to spend an hour re-learning it from scratch.
I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.
Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager
Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…
OK done: we move to self signed certs. - Someone connects to wifi. - The wifi gives a DNS server. - The DNS server says some IP is foo.com. - foo.com isn't actually the foo.com you expect [1], but it's got a self signed DV cert so you connect to it, and give some bad person your data. That's why we don't more to self signed certs. [1] Of course, if you want to assert foo.com is actually the 'Foo, Inc' you were expect…
Earlier quoted context omitted.
What's the typical validity period for OCSP responses with Let's Encrypt? Shouldn't the stapled responses continue working for at least a couple hours even after Let's Encrypt goes down?
1 week, so most servers likely won't be affected unless the outage goes on for a really long time.
I have OCSP stapling turned on in Apache and Firefox wouldn't load my page when Let's Encrypt OCSP servers went down.
My monitoring shows that last stapled response had 4 days of validity left. So it seems that Apache immediately threw away cached OCSP responses.
Earlier quoted context omitted.
1 week, so most servers likely won't be affected unless the outage goes on for a really long time.
Not sure how this works. I have OCSP stapling turned on in Apache and Firefox wouldn't load my page when Let's Encrypt OCSP servers went down. My monitoring shows that last stapled response had 4 days of validity left. So it seems that Apache immediately threw away cached OCSP responses.
Earlier quoted context omitted.
That's going to be a limiter for adoption. Hopefully @mholt reconsiders. Update: Mholt pushed a change where caddy only refuses to start if the cert is expiring in 7 days or less. https://github.com/mholt/caddy/commit/410ece831f26c61d392e0e...
Hm, yeah I hope so too :/ Been using Caddy in prod for a year now, this issue, rare as it may be, could single-handedly get me back on nginx. Having the server be unable to start through circumstances outside of the system's control is just such a huge no.
So in case this helps anyone, I had people complaining about strange OCSP errors all over the morning coming from my server (using apache httpd). It turns out apache does practically everything to behave as dumb as possible in case of OCSP downtimes. If the OCSP sends an error it will send the error as a stapled OCSP reply (instead of using an old, still valid OCSP reply). You can't make it behave sane here, but you…
Was fun finding this out during a random server cycle. Turns out, Caddy doesn't appreciate the ACME server being down, and refuses to start :) https://github.com/mholt/caddy/issues/1680
Wow @ that close comment: > So, this is not a bug and all is working as intended. Caddy folks had better never restart the caddy service (or server) while LE happens to be down, even if you already have a valid cert!