ACME v2 and Wildcard Certificate Support is Live

Post by alwillis » Wed, Mar 14, 2018, 5:36 AM UTC

Karunamon wrote: post #158

amaccuish wrote: post #155

Earlier quoted context omitted.

And how would rollover work?

It would wind up being visible to a large chunk of users simultaneously. Furthermore, since we're relying on the wisdom of the crowd rather than a true CA, you'd be able to trust companies' own CAs rather than delegating off to a not-so-trusted third party. In other words, if someone claiming to be Facebook has told a significant number of people all over the world that Facebook's cert fingerprint is ABCD124, and tha…

Post by alwillis » Wed, Mar 14, 2018, 6:12 AM UTC

eric_b wrote: post #44

neals wrote: post #3

The amount of money I've paid for this... I recon some of these providers are going under soon?

I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).

Post by slrz » Wed, Mar 14, 2018, 6:23 AM UTC

Karunamon wrote: post #143

Jaruzel wrote: post #116

Earlier quoted context omitted.

For the standard LE certs, you need a public facing web server for the domain name in question, and LE give you a keyfile to put into: '/.well-known/pki-validation' For the wildcard certs, you just need to add a TXT record to the public DNS entry, no public web server required. Even if you have no intention of using your internal DNS domain name on the internet, it's good practice to register it anyway.

Is there a "standard" TLD for internal use that will also fit this requirement? The problem here is that there's no such thing as domain ownership, only domain renting. You forget to pay your bill (read: someone loses an email) and a core part of your infrastructure is up in smoke, or worse, taken over by a squatter.

Post by icebraining » Wed, Mar 14, 2018, 6:36 AM UTC

aplorbust wrote: post #227

mholt wrote: post #49

Earlier quoted context omitted.

> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…

"It's their privacy being deprived." I wonder if anyone will be surprised when they learn how HTTPS and HTTP/2 will be used to push more advertising to users and exfiltrate more user data from them than HTTP would ever allow. Will these "advances" benefit users more than they benefit the companies serving ads, collecting user data and "overseeing the www" generally? Is there a trade-off? To users , will protecting tr…

Post by staticassertion » Wed, Mar 14, 2018, 6:44 AM UTC

pwnna wrote: post #78

mholt wrote: post #49

Earlier quoted context omitted.

> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…

What about hosting HTTP content because you verify GPG signatures upon download? These content would then be super easy to cache on the local network. HTTPS defeats this and makes it uncachable. I hardly ever see people talk about this use case and how to solve it with https everywhere. AND it's super widely used: e.g. debian repositories.