Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt is down

letsencrypt.status.io

Post reply on HN
Print view View original

151–160 of 167 posts

Re: Let's Encrypt is down

#151

Post by eridius »

enimodas wrote: post #48
scrollaway wrote: post #32

Earlier quoted context omitted.

Hm, yeah I hope so too :/ Been using Caddy in prod for a year now, this issue, rare as it may be, could single-handedly get me back on nginx. Having the server be unable to start through circumstances outside of the system's control is just such a huge no.

Why did you switch away from nginx?

I switched from nginx to caddy for my (extremely low-traffic) server because I was tired of having to copy & paste a bunch of SSL setup any time I was configuring a new domain.

Re: Let's Encrypt is down

#152

Post by foepys »

benchaney wrote: post #148
foepys wrote: post #121

Earlier quoted context omitted.

Yes. But you could argue that securing DNS is necessary anyways and using it for TLS is just the next step.

What do you mean by necessary?

Things like SPF and SSHFP records are still unprotected without DNSSEC. HTTP, IMAP/POP3, and SMTP may be safe by themselves but it would be nice to have the others covered as well.

Re: Let's Encrypt is down

#153

Post by cestith »

falcolas wrote: post #16
IgorPartola wrote: post #10

I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.

Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager

And then Route53 doesn't support CAA.

Re: Let's Encrypt is down

#154

Post by manigandham »

majewsky wrote: post #69
scrollaway wrote: post #60

Earlier quoted context omitted.

Not having to deal with certificate renewal is a big deal.

Is it? I spent one day getting certbot up and running, and ever since then it's been pretty much a done deal.

That's 1 day that I didn't have to spend, even better when dealing with many instances.

Re: Let's Encrypt is down

#155

Post by chronial »

stephenr wrote: post #103
scrollaway wrote: post #94

Earlier quoted context omitted.

I have no idea how this is relevant to the conversation, nor who said anything about hyperbolic claims. You're claiming "caddy does everything". As opposed to what? If you're running apache or nginx, your server does far more than caddy, so you're quite simply mistaken.

> You're claiming "caddy does everything". As opposed to what? Serving content over http(s), and obtaining TLS certificates are two very different tasks. > If you're running apache or nginx, your server does far more than caddy Far more, that is directly related to serving content over http/https.

> Serving content over http(s), and obtaining TLS certificates are two very different tasks.

Except that with let's encrypt one actually needs the other.

Re: Let's Encrypt is down

#156

Post by niftich »

zkms wrote: post #116
niftich wrote: post #106

Earlier quoted context omitted.

Some have argued that this is why CRL and (especially) OCSP are useless pieces of security theater: they don't actually protect against a crafted attack because they fail-open in the very situations that a determined adversary can trigger, so they only "protect" in situations where no real threat exists. It's simply feel-good bookkeeping. Adam Langley, working on Google Chrome [1][2][3], has been very vocal about OCS…

> I believe this was the correct solution: offering better protection for a curated subset of sites vs. pretending to -- but not actually -- protecting all sites. I concur, but note that it is possible to do better and offer better revocation protection for all sites, with low bandwidth/storage costs: http://www.ccs.neu.edu/home/cbw/static/pdf/larisch-oakland17...

This paper -- the CRLite proposal -- is wonderfully well thought-out, experimentally tested, and meets the design goals much better and more elegantly than any other attempt to solve the certificate revocation problem.

Looks like it was posted here and got very little traction [1]; a shame. But it will be presented in a few days at the IEEE Symposium on Security and Privacy [2]. I hope it will get the coverage and examination it deserves.

[1] https://news.ycombinator.com/item?id=13982861 [2] https://www.ieee-security.org/TC/SP2017/program-papers.html

Re: Let's Encrypt is down

#157

Post by corobo »

yjftsjthsd-h wrote: post #118
jacquesm wrote: post #41

Earlier quoted context omitted.

I'd vote for Gandi.net or Github to do it. FB definitely not, MS rather not, Google not if I could avoid it. Amazon maybe.

What's the threat model? I don't trust FB either, but with CA transparency and CAA it seems safe enough.

"We want to make sure our users are protected from malicious links so we proxy them when clicked"

Very unlikely, most feasible thing I could think of

Re: Let's Encrypt is down

#158

Post by mort96 »

alixaxel wrote: post #128
Filligree wrote: post #4

This is also why you don't wait until the last day before renewing. (But no-one does that, right?)

If you have your nginx HTTP vhost configured for serving {{ domain }}/.well-known/acme-challenge/ from /var/www/{{ domain }}, then getting a new cert and having it automatically renewed it's as simple as running: certbot certonly --webroot --webroot-path /var/www/{{ domain }} --agree-tos -m {{ email }} --domain {{ domain }} --renew-hook "service nginx reload" If certbot was installed with PIP, a CRON job will be auto…

That assumes the only sites you want to use SSL with is sites with a web root. Many sites use python's flask or node.js or similar, where you instead have an http server running on a high port, then proxy requests to certain domains to those ports. Such a script won't work with a setup like that.

Re: Let's Encrypt is down

#159

Post by mort96 »

tscs37 wrote: post #14
throw2016 wrote: post #7

Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…

You can run your own ACME provider, the code is open source. Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question. The automation of LE is not the problem either. Properly automated systems would extend/renew the cert well before they are invalid, almost every LE guide I know mentions this on groun…

> Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question.

You know that's BS. All of your users would get certificate errors, that's what's preventing you from running your own CA.

Re: Let's Encrypt is down

#160

Post by mort96 »

nickpsecurity wrote: post #21

"High assurance datacenter" High assurance my ass. Those don't go down unless there's a DDOS or catastrophic failure (often several). Then, they're right back up. People need to stop misusing this label. Another is "high-assurance" certs from vendors that get compromised or subverted easily. Only one high-assurance CA that I know of. It's not around for business reasons, though. http://www.anthonyhall.org/c_by_c_secu…

The issue here doesn't seem that a data center went down, but that there was a bug which caused downtime.
Post reply on HN