ACME v2 and Wildcard Certificate Support is Live • Hacker News Board

Re: ACME v2 and Wildcard Certificate Support is Live

#211

Post by cm2187 » Wed, Mar 14, 2018, 2:08 AM UTC

belorn wrote: post #163

kyledrake wrote: post #7

First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lo…

Since the certificate need to be updated every three months they have access to exact number of how many people use ACMEv1. They also have as naturally part of the process the domain names of those users. This should allow them to very slowly watch as the number of v1 users drops until there is so few that they can try contact any remaining users before deciding to set an end-of-life to that version.

You are supposed to provide a valid email address when you register for a let's encrypt certificate. In theory they should be able to contact all v1 client users.

Re: ACME v2 and Wildcard Certificate Support is Live

#212

Post by tatersolid » Wed, Mar 14, 2018, 2:12 AM UTC

xenophonf wrote: post #79

eric_b wrote: post #60

Earlier quoted context omitted.

> At the risk of all my karma, honestly, fuck off. Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general. To you, security is the only thing t…

> You can't possibly understand... Oh, I get it. I've worked with lots of people like you. You're lazy. As an infosec practitioner, I'm the one that cleans up after the people who claim good current infosec practices are "too hard" or "impractical" or "not cost-effective", which all boil down to sysadmins and developers like you creating negative externalities for people like me. I have heard all of these arguments b…

> If you can't be bothered with some minimal standard of care, you need to exit the IT market.

My goodness, you just nailed it.

The IT job market is so tight that complete incompetence is still rewarded. Incompetence and negligence that would get you fired immediately or even prosecuted in many if not most other professions.

If restaurant employees treated food safety the way most developers treat code safety, anyone who dined out would run about a 5-10% chance of a hospital visit per trip.

I was just arguing with a “senior developer” who left a wide open SQL injection in an app. “But it will only ever be behind the firewall, it’s not worth fixing.”

That’s like a chef saying “I know it’s old fish but we’ll only serve it to people with strong stomachs, I promise”.

Re: ACME v2 and Wildcard Certificate Support is Live

#213

Post by cm2187 » Wed, Mar 14, 2018, 2:16 AM UTC

16bytes wrote: post #105

fulafel wrote: post #95

Earlier quoted context omitted.

You could do this before too, without wildcards.

Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.

You have multiple authorisation mechanism. The one you are referring too is http but you could also use DNS (you add a pre-agreed string as a TXT entry). Wildcard requires dns validation whereas domain specific certificates can use both.

Re: ACME v2 and Wildcard Certificate Support is Live

#214

Post by cm2187 » Wed, Mar 14, 2018, 2:20 AM UTC

nodesocket wrote: post #164

0x0 wrote: post #17

DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)

Use Terraform to manage records. They have support for lots of DNS providers (AWS Route53, Google Cloud DNS, Cloudflare, DigitalOcean, Azure DNS, DYN, DNSMadeEasy, NS1, UltraDNS, PowerDNS).

Moving a domain between providers is quite disruptive.

Re: ACME v2 and Wildcard Certificate Support is Live

#215

Post by cm2187 » Wed, Mar 14, 2018, 2:24 AM UTC

pbhjpbhj wrote: post #202

ocdtrekkie wrote: post #29

Earlier quoted context omitted.

The only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model. My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for ma…

Does LE have a secure and resilient infrastructure? Like they have multiple sites where they can run all operations from in event of a natural disaster, for example. How about in the event of a government that decides to take it over as a part of their national infrastructure, sounds crazy but we're putting a lot of eggs in their basket.

If you renew your LE certs a month before expiry you still have a month to find an alternative solution should let's encrypt blow up.

Re: ACME v2 and Wildcard Certificate Support is Live

#216

Post by cm2187 » Wed, Mar 14, 2018, 2:29 AM UTC

NKCSS wrote: post #144

I just wished there was a Windows client that just works with IIS. Every time I try, it just errors out and gives me headaches (certify, Let's Encrypt Simple Windows Client, etc.)

If you are using wildcard it doesn't need to be integrated with IIS. Use acmesharp which has a nice powershell interface (doesn't support wildcards yet). Then loading the certificate in the certificate store and assigning it to a website should be fairly easy in powershell.

Re: ACME v2 and Wildcard Certificate Support is Live

#217

Post by cm2187 » Wed, Mar 14, 2018, 2:30 AM UTC

brightball wrote: post #86

Can this be used for multi-level subdomains? Like *.subdomain.example.org?

And before you ask you can also do multi wildcard certificates. Like a single certificate for both

   *.example1.com and

   *.example2.com

(using SAN).

Re: ACME v2 and Wildcard Certificate Support is Live

#218

Post by schoen » Wed, Mar 14, 2018, 2:38 AM UTC

peterwwillis wrote: post #210

schoen wrote: post #204

Earlier quoted context omitted.

Just a TXT record. https://tools.ietf.org/html/draft-ietf-acme-acme-03#section-...

Wow. A lot of sites are going to get owned.

We've been using TXT records to authenticate certificate requests since Let's Encrypt launched. That hasn't changed.

Re: ACME v2 and Wildcard Certificate Support is Live

#219

Post by peterwwillis » Wed, Mar 14, 2018, 2:58 AM UTC

schoen wrote: post #218

peterwwillis wrote: post #210

Earlier quoted context omitted.

Wow. A lot of sites are going to get owned.

We've been using TXT records to authenticate certificate requests since Let's Encrypt launched. That hasn't changed.

Without verifying who controls the IP space?

If you don't verify who controls the IP space, then if you can control the DNS, you can generate certs. Certs that appear valid to unsuspecting users.

Putting that kind of trust in DNS is pretty crazy considering how insecure most DNS setups are. Not to mention general attacks on DNS. There's even a potential chicken and egg problem, if you need DNS to secure your HTTPS, but you use HTTPS to manage your DNS.

What's really crazy too is it seems like this can't even be avoided. Even if I'm not using Let's Encrypt, if someone owns my DNS, they can use Let's Encrypt to get valid certs for my domain. That's insane.

What am I missing here?

Re: ACME v2 and Wildcard Certificate Support is Live

#220

Post by tialaramex » Wed, Mar 14, 2018, 3:09 AM UTC

Frondo wrote: post #118

eric_b wrote: post #100

Earlier quoted context omitted.

Yeah, I'm not opposed to HTTPS. In fact, the reason I get frustrated is because, like you, I've dealt with it at scale for years. I agree it should be used most places, but what about static documentation sites? What about blogs? I've even used Let's Encrypt a few times, and it seems like a great service. But who wants to set up that machinery for a simple resume site? That machinery has a cost. With every barrier we…

Yeah, it is an argument you've lost, because it's a bad argument. Even places like dreamhost give you a letsencrypt cert for free on any domain. There is no case to be made for not securing your site, on principle or based on what's already happening out in the world, with shady providers injecting code into non-secure HTTP connections. You see it as "a simple resume site," and I see it as a conduit for malicious pro…

Yup, the Dreamhost model, and the model at generic cPanel sites (sadly some places with cPanel disable this to drive revenue to their commercial CA partner) is the Right Thing here - one of the options when setting up or modifying your web site is "Free automatic certificates" and then it's the Host's job to make sure that stays working, just like if you pick "Use latest PHP" or "Strip leading www. from hostname". The guy with a blog about carpentry shouldn't need to care about the ACME protocol any more than he cares about how erbium doped optical amplifiers work when calling his grandmother half way around the world. It's just technology.