ACME v2 and Wildcard Certificate Support is Live

#1

Post by schoen » Tue, Mar 13, 2018, 5:14 PM UTC

ACME v2 and Wildcard Certificate Support is Live
community.letsencrypt.org

Re: ACME v2 and Wildcard Certificate Support is Live

#2

Post by sheraz » Tue, Mar 13, 2018, 5:20 PM UTC

Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?

Re: ACME v2 and Wildcard Certificate Support is Live

#3

Post by neals » Tue, Mar 13, 2018, 5:21 PM UTC

The amount of money I've paid for this... I recon some of these providers are going under soon?

Re: ACME v2 and Wildcard Certificate Support is Live

#4

Post by nkkollaw » Tue, Mar 13, 2018, 5:22 PM UTC

neals wrote: post #3

The amount of money I've paid for this... I recon some of these providers are going under soon?

If it was up to me, even right now.

This is great news!

Re: ACME v2 and Wildcard Certificate Support is Live

#5

Post by dkasper » Tue, Mar 13, 2018, 5:24 PM UTC

sheraz wrote: post #2

Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?

Yeah, there are some edge cases where a wildcard is less secure. https://security.stackexchange.com/questions/8210/what-vulne...

Re: ACME v2 and Wildcard Certificate Support is Live

#6

Post by urda » Tue, Mar 13, 2018, 5:25 PM UTC

This is great news! Let's Encrypt has helped me secure many of my own boxes without having to maintain my own CA, very happy to see them grow.

Re: ACME v2 and Wildcard Certificate Support is Live

#7

Post by kyledrake » Tue, Mar 13, 2018, 5:25 PM UTC

First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them.

> It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet.

Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lot of us are also using custom v1 code for various reasons that may not be easy to change.

The preferable end-of-life date for ACMEv1 (sparing any existential security issues) should be never. Otherwise you will be executing a Geocities-sized web meltdown every time you phase out a version of the API.

Re: ACME v2 and Wildcard Certificate Support is Live

#8

Post by orthecreedence » Tue, Mar 13, 2018, 5:26 PM UTC

sheraz wrote: post #2

Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?

Yeah, I think that if someone hacked your DNS provider, they could add secure-payments.yourbusiness.com and start spamming people with "late payment! enter your credit card!" notices or something.

So I guess, make sure you trust your DNS provider if you're using wildcards. Or is there another exploit I'm missing?

Re: ACME v2 and Wildcard Certificate Support is Live

#9

Post by artursapek » Tue, Mar 13, 2018, 5:27 PM UTC

dkasper wrote: post #5

sheraz wrote: post #2

Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?

Yeah, there are some edge cases where a wildcard is less secure. https://security.stackexchange.com/questions/8210/what-vulne...

It's not even about edge cases - it's just good security practice to isolate credentials as much as possible and limit their scope.

Re: ACME v2 and Wildcard Certificate Support is Live

#10

Post by thinkloop » Tue, Mar 13, 2018, 5:27 PM UTC

On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved