ACME v2 and Wildcard Certificate Support is Live
201–210 of 321 posts
Re: ACME v2 and Wildcard Certificate Support is Live
#202Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.
The only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model. My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for ma…
Does LE have a secure and resilient infrastructure? Like they have multiple sites where they can run all operations from in event of a natural disaster, for example. How about in the event of a government that decides to take it over as a part of their national infrastructure, sounds crazy but we're putting a lot of eggs in their basket.
Re: ACME v2 and Wildcard Certificate Support is Live
#203DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)
Use Terraform to manage records. They have support for lots of DNS providers (AWS Route53, Google Cloud DNS, Cloudflare, DigitalOcean, Azure DNS, DYN, DNSMadeEasy, NS1, UltraDNS, PowerDNS).
I switched to Terraform + CloudFlare for managing my DNS entries and I absolutely love it. No more messing around with web pages, change a line in a file and you're done. Fantastic.
Warning: I have made services inaccessible by deploying before making sure the git repo I was working from was the latest version. That's the downside of stateless deployments!
Re: ACME v2 and Wildcard Certificate Support is Live
#204Does the DNS method require proving you control the IP space for the domain, or is a DNS TXT really the only thing you need to generate a certificate?
Just a TXT record.
https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-...
Re: ACME v2 and Wildcard Certificate Support is Live
#205I did not see it on the forum, but seeing that the wildcard feature requires DNS-01 challenge for getting the certificates, does it mean automatic renewal is impossible without DNS api ? (or is it possible to renew without the dns challenge ? )
This thread [0] suggests that you do. 0. https://www.reddit.com/r/programming/comments/84607r/lets_en...
Yes, for an unattended renewal you'll need a way of programmatically creating TXT records. (Note that the validation follows CNAMEs, so the records you create don't have to be in your main DNS zone.)
Re: ACME v2 and Wildcard Certificate Support is Live
#206Earlier quoted context omitted.
I don't get the notion that some sites don't "need" HTTPS. The threat model it protects against isn't only sensitive information being intercepted, it's also man-in-the-middle attacks that actually change what's delivered. Maybe a hobbyist website only has text and images sitting on its server, but the visitor might receive malware — and that can happen to literally any site served over HTTP.
> I don't get the notion that some sites don't "need" HTTPS. Your failure to grasp this is fairly evident from the rest of your comment.
[deleted]
Re: ACME v2 and Wildcard Certificate Support is Live
#207Earlier quoted context omitted.
> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…
What about hosting HTTP content because you verify GPG signatures upon download? These content would then be super easy to cache on the local network. HTTPS defeats this and makes it uncachable. I hardly ever see people talk about this use case and how to solve it with https everywhere. AND it's super widely used: e.g. debian repositories.
I'm actually surprised debian repos are still HTTP.
Don't get me wrong GPG signatures with pinned public key is a lot better than trust TLS of a random mirror.
But isn't it nice to have two layers, the two key systems are independent and orthogonal that seems like a solid win.
Need I remind of Heartbleed (openssl) or the very debian specific gpg key derivation bug years ago.
There will always be bugs, we can only hope they aren't exposed concurrently :)
Re: ACME v2 and Wildcard Certificate Support is Live
#208HTTPS vs HTTP usage:
https://netmarketshare.com/report.aspx?options=%7B%22filter%...
Re: ACME v2 and Wildcard Certificate Support is Live
#209The amount of money I've paid for this... I recon some of these providers are going under soon?
I don't know. Will Letsencrypt also replace EV certificates?
Their FAQ says no because the process for issuing EVs can't be automated which given the requirements for Extended Validation makes some sense I guess.