Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACME v2 and Wildcard Certificate Support is Live

community.letsencrypt.org

Post reply on HN
Print view View original

61–70 of 321 posts

Re: ACME v2 and Wildcard Certificate Support is Live

#61

Post by jaas »

kyledrake wrote: post #7

First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lo…

The reason we haven't announced an EOL for ACMEv1 is that we won't announce one until we are confident we won't cause the kind of meltdown you describe.

Re: ACME v2 and Wildcard Certificate Support is Live

#62

Post by ancarda »

eric_b wrote: post #60
ancarda wrote: post #57

Earlier quoted context omitted.

>Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security Can you explain why you think Symantec demonstrating incompetence is completely isolated from your Symantec SSL protected website? I sense a lot of hostility coming from you. It seems like you think we do these things for fun. Do you imagine a bunch of grumpy men get together, drink beer, and pick a new S…

> At the risk of all my karma, honestly, fuck off. Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general. To you, security is the only thing t…

I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.

Re: ACME v2 and Wildcard Certificate Support is Live

#63

Post by crtasm »

kardos wrote: post #26
thinkloop wrote: post #10

On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved

Dynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK [1] https://www.dtdns.com/dtsite/faq#hostdomains

LE requires setting DNS TXT records to get wildcard certs - do dynamic DNS providers ever let you do that? My assumption is they don't.

Re: ACME v2 and Wildcard Certificate Support is Live

#64

Post by kyledrake »

jaas wrote: post #61
kyledrake wrote: post #7

First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lo…

The reason we haven't announced an EOL for ACMEv1 is that we won't announce one until we are confident we won't cause the kind of meltdown you describe.

That's good to know, thank you for the info.

Re: ACME v2 and Wildcard Certificate Support is Live

#65

Post by eric_b »

ancarda wrote: post #62
eric_b wrote: post #60

Earlier quoted context omitted.

> At the risk of all my karma, honestly, fuck off. Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general. To you, security is the only thing t…

I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.

But why did it make you so angry? My guess is because my viewpoint is completely unfathomable to you. You can't even believe that someone would advocate for it. In situations like that, I always try and put myself in the shoes of that person. Sometimes they are wrong, and sometimes they have a point. But it's always a useful exercise.

To your parent comment -

No, I don't think it's a cabal of "grumpy old men" - I think it's a cabal of morally righteous security-minded people who have never worked for small companies or realize that most dev teams don't have the time to deal with all this forced entropy.

You care about security, I care about making valuable software. Security can be a roadblock to releasing valuable software on time and within budget. If my software doesn't transmit sensitive data, I surely do not want to pay the SSL tax if I'm on a deadline and it's cutting in to my margins.

Re: ACME v2 and Wildcard Certificate Support is Live

#66

Post by hamandcheese »

Karunamon wrote: post #48
eric_b wrote: post #43

Earlier quoted context omitted.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

That has to be balanced against the potential pain for users who will be accessing that software whilst vulnerable to having that information snooped or modified. Perhaps for social engineering purposes, perhaps to serve up the latest zero-day, perhaps just for the lulz... who knows? SSL has a history of being a pain in the ass. There are a lot of pain in the ass implementations out there. Everyone gets that. At the…

Your closing argument is essentially “if you’re not with us, you’re against us.” which sounds like quite the zealots argument to me.

Re: ACME v2 and Wildcard Certificate Support is Live

#67

Post by mattwoodnyc »

apearson wrote: post #58
Santosh83 wrote: post #28

I do hope GitHub employs this for rolling out https for Pages sites using custom domains too.

Not sure if it would help in your situation but I've moved all of my github pages to netlify.com and they have a one button https feature for custom domains.

I did the same. Between Netlify and Zeit.co's Now, I don't see any reason to complain about HTTPS, not to mention the devOps issues that both these services solve.

SSL requires one click with Netlify, and it's on by default with Now.

Re: ACME v2 and Wildcard Certificate Support is Live

#68

Post by hamandcheese »

shawabawa3 wrote: post #14
neals wrote: post #3

The amount of money I've paid for this... I recon some of these providers are going under soon?

> I recon some of these providers are going under soon? I really hope so. The cost to providers is exactly the same for a wildcard and a standard certificate, and yet they costs hundreds of dollars. It's unbelievable it's lasted this long

It’s not that unbelievable, what software service are you aware of that is sold at only it’s marginal cost?

Re: ACME v2 and Wildcard Certificate Support is Live

#69

Post by ancarda »

eric_b wrote: post #60
ancarda wrote: post #57

Earlier quoted context omitted.

>Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security Can you explain why you think Symantec demonstrating incompetence is completely isolated from your Symantec SSL protected website? I sense a lot of hostility coming from you. It seems like you think we do these things for fun. Do you imagine a bunch of grumpy men get together, drink beer, and pick a new S…

> At the risk of all my karma, honestly, fuck off. Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general. To you, security is the only thing t…

Would you be open to having a phone call, or some other more direct way of discussing this?

It may be easier to be more empathetic.

Re: ACME v2 and Wildcard Certificate Support is Live

#70

Post by 0x0 »

eric_b wrote: post #55
mholt wrote: post #49

Earlier quoted context omitted.

> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…

> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too. > You have not been paying attention to the hundreds of tools available to make HTTPS painless. I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What…

A lot of ISPs, some huge like the "XfinityWifi" SSID, routinely inject their own javascript in HTTP pages. Some even take no care to namespace their javascript and wreck a party on your window globals, too.
Post reply on HN