Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACME v2 and Wildcard Certificate Support is Live

community.letsencrypt.org

Post reply on HN
Print view View original

41–50 of 321 posts

Re: ACME v2 and Wildcard Certificate Support is Live

#41

Post by elahd »

ocdtrekkie wrote: post #38
elahd wrote: post #37

Earlier quoted context omitted.

The encryption part is easy -- you don't need CAs for that -- but they're a necessary evil when it comes to verifying ownership. You need to delegate trust to someone , otherwise using the internet becomes too cumbersome.

Automated SSL providers effectively mitigate the idea of "verifying ownership" or "delegating trust", because for example, someone can buy a domain like... googIe.com, get an SSL cert for it, and it's "valid". We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. (In this example, bear in mind, Google doesn't use an EV cert, so th…

I wasn't referring to EV certificates, just to verifying simple ownership of the domain for the purposes of MITM and other attacks of that kind. Let's Encrypt would inform you that the page that appears when you visit googIe.com was indeed served by the owner of that domain (barring server compromises or cert leaks, but that's a separate issue). LE and "basic" certificates do not attempt to answer the question of who owns the domain -- that's also an entirely separate problem.

Re: ACME v2 and Wildcard Certificate Support is Live

#42

Post by prdonahue »

wyattjoh wrote: post #40
JorgeGT wrote: post #34

Earlier quoted context omitted.

I started using Cloudflare just for their DNS API - the dynDNS providers baked into my router's firmware went under so I started pointing the DNS record to my home dynamic IP with a cronjob that called CF's API.

It's this exact situation why I decided to write a tool that integrates with the CF API [0]. [0]: https://github.com/wyattjoh/cloudflare-ddns

You can also use our Terraform provider to manage DNS: https://github.com/terraform-providers/terraform-provider-cl....

We've got a number of open PRs as well to add other resources, e.g., load balancing, rate limiting, zone settings, etc. HashiCorp is currently reviewing/merging.

Re: ACME v2 and Wildcard Certificate Support is Live

#43

Post by eric_b »

mholt wrote: post #15
kyledrake wrote: post #7

First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lo…

> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren't.

(Related, a big thanks to Google for un-trusting that whole big Symantec security chain. Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security, as I don't have nation states or motivated hackers in my threat model.)

Security measures should be weighed like everything else - as cost/benefit. In many cases the cost of the security is not worth it.

Edit: I'd just like to point out the irony in some of the replies to this comment. I'm complaining about zealotry, and the vast majority of nasty replies I've received to this comment are using language that only zealots and ideologues would use. My god, you'd think I'm killing puppies based on some of these responses. Nope, just advocating for using HTTPS where it makes sense, and not having it forced down your throat.

Re: ACME v2 and Wildcard Certificate Support is Live

#44

Post by eric_b »

neals wrote: post #3

The amount of money I've paid for this... I recon some of these providers are going under soon?

I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).

Re: ACME v2 and Wildcard Certificate Support is Live

#45

Post by dspillett »

orthecreedence wrote: post #8
sheraz wrote: post #2

Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?

Yeah, I think that if someone hacked your DNS provider, they could add secure-payments.yourbusiness.com and start spamming people with "late payment! enter your credit card!" notices or something. So I guess, make sure you trust your DNS provider if you're using wildcards. Or is there another exploit I'm missing?

They would need to both hack your DNS entries and have access to the private key of the pair for which the certificate was signed. Having access to the private key probably indicates a significant hole in the site's infrastructure so that is more of a concern than DNS.

Of course such access may be easier for a disgruntled internal actor so it is a risk worth considering (and mitigating via proper separation of concerns/access).

Re: ACME v2 and Wildcard Certificate Support is Live

#46

Post by blibble »

0x0 wrote: post #17

DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)

is it common for DNS hosts to provide delegated access at the granularity of individual records?

I don't want my webserver to have the ability to change my entire zonefile just so it can authorise certificates!

Re: ACME v2 and Wildcard Certificate Support is Live

#47

Post by JankySolutions »

elahd wrote: post #30
rospaya wrote: post #21

Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.

The service is great, but they're really the only free SSL cert game in town. As more sites start using their certs, they'll wind up becoming a single point of failure.

They are not the only CA that issues certificates for free. For example, AlwaysOnSSL[0] was on HN a few days ago[1], with some important differences (as pointed out in the HN comments)

[0] https://alwaysonssl.com/

[1] https://news.ycombinator.com/item?id=16566031

Re: ACME v2 and Wildcard Certificate Support is Live

#48

Post by Karunamon »

eric_b wrote: post #43
mholt wrote: post #15

Earlier quoted context omitted.

> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

That has to be balanced against the potential pain for users who will be accessing that software whilst vulnerable to having that information snooped or modified. Perhaps for social engineering purposes, perhaps to serve up the latest zero-day, perhaps just for the lulz... who knows?

SSL has a history of being a pain in the ass. There are a lot of pain in the ass implementations out there. Everyone gets that.

At the same time, it's never been easier, and basic care for what you're serving your users demands taking that extra step. What Google is doing amounts to disclosing something that's an absolute fact. Plain HTTP is insecure (in the most objective and unarguable way possible), and it is unsuitable for most traffic given the hostile nature of the modern web.

Do you want your users being intercepted, engineered, or served malware on? If the answer is no, secure it. The equation is that simple. Any person or group of people who in 2018 declines to secure their traffic is answering that question in the affirmative and should be treated accordingly!

That's not "zealotry" friend, that's infosec 101.

Re: ACME v2 and Wildcard Certificate Support is Live

#49

Post by mholt »

eric_b wrote: post #43
mholt wrote: post #15

Earlier quoted context omitted.

> The preferable end-of-life date for ACMEv1 should be never. As would be the preferable end-of-life date for SSLv3 and HTTP.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

> developers who just want their software to work.

Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with.

> they either don't know or don't care about all the effort and pain they're creating

You have not been paying attention to the hundreds of tools available to make HTTPS painless.

> until someone at Big G decided they weren't.

And Mozilla. And countless research papers. And real-world attacks that are reported over and over again. The fact is that the global Web has become hostile, regardless of your prejudice against Google's Web security teams.

> In many cases the cost of the security is not worth it.

The problem is that it's not YOUR security, it's other people's. If websites don't implement HTTPS, it's the users of the Web who pay the price. It's their privacy being deprived. And the website becomes easy to impersonate and manipulate, increasing the liability of having a website. HTTP is bad news all around.

Re: ACME v2 and Wildcard Certificate Support is Live

#50

Post by Vendan »

eric_b wrote: post #44
neals wrote: post #3

The amount of money I've paid for this... I recon some of these providers are going under soon?

I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).

If you are following the recommended practices, it's every 2 months, and ACME would have to be down for a solid month. I think that's fairly unlikely
Post reply on HN