Live data from Hacker News

Let's Encrypt makes certs for 30% of web domains

leebutterman.com

61–70 of 147 posts

Re: Let's Encrypt makes certs for 30% of web domains

#61
post #9

A few of these things, while not necessarily wrong, should be put into context. E.g. "Hundreds of thousands of domains' certs expire after 2099". Yeah, but no publicly trusted certs. They're capped at a bit more than 2 years and there's a discussion to cap them even more. The certs they're seeing are almost certainly mostly: "let's create a test selfsigned cert for this host. how long should it last? let's type in a…

> and there's a discussion to cap them even more.

For reference: https://gist.github.com/ScottHelme/5531ed88b1ff0c1e8ce8af565...

Re: Let's Encrypt makes certs for 30% of web domains

#62
post #6

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's encrypt is awesome because it's instantaneous! You'd think Google would understand that aspect. Edit: GCP people: Please give us a an explicit "retry" button to press when we've set up the DNS records. (I'm talking about the Google Cloud Balancing Service here.…

Huh, I've had the opposite experience when setting up DNS on GCP App Engine. Things seemed to be quite snappy to me.

The stars were probably aligned for you. Given DNS TTL there's a bunch of uncertainty here. My main feedback to Google is that having them periodically check back at an unanounced schedule, with no abilitity to force an an immediate check.. shows a total lack of understanding of customer needs.

I mean, like... Yes, I understand that by default Google does things at scale, but sometimes you need to do things by precision/on demand, too.

Re: Let's Encrypt makes certs for 30% of web domains

#63
post #16

Earlier quoted context omitted.

What problems would decentralization solve here?

Improved security. So many sites are trusting Let's Encrypt and have cron jobs set to refresh data from them. If Let's encrypt were comprised or went offline, they are now a huge single-point-of-failure (or worse, single-point-of-exploit?) for all these domains. It's become a kind of monoculture. A more diverse ecosystem of offerings would be resilient to any single attack or failure.

How would adding additional CAs improve security? By the very nature of the CA trust system, each CA is itself a single-point-of-failure/exploit (though certificate pinning and other measures improve this somewhat).

Re: Let's Encrypt makes certs for 30% of web domains

#64
post #16

This kind of centralization is not good. Even thought let's encrypt is non profit and has a very good service record. We desperately need more like it spread around the globe.

What problems would decentralization solve here?

Limiting a bit the impacts if Let's Encrypt is compromised in any way.

If Let's encrypt is compromised, either by being able to issue certificate for arbitrary domains or if the CA itself is compromised, the impact would be huge given the current number of certificates signed by it and this number is likely to grow in the futur.

With several CAs in different organizations, you have a far lower risk of seeing all the CAs being compromised at the same time, thus limiting the impact of a CA being compromised.

Note that it doesn't mean a full decentralization, but rather a set of CAs (5 or 10) independent of each other and providing a service as conviniant as Let's Encrypt.

As a side note, an idea a colleague of mine suggested to extend and better the security model of CAs/certificate would be the ability to have a certificate signed by several CAs. Let's say you are a bank or a security sensitive website, you could have your certificate signed by 4 or 5 CAs, and then, you could publish a policy, for example in a TXT DNS record, stating that you need at least 2 or 3 valid CA signatures. This way 1) your certificate doesn't need to be renewed in emergency if its CA is compromised, 2) if a CA is compromised (without people noticing), it reduces the overall impact as an attacker would have to in fact compromised several CAs to actually exploit this (MiM or impersonating websites).

Re: Let's Encrypt makes certs for 30% of web domains

#65
post #16

This kind of centralization is not good. Even thought let's encrypt is non profit and has a very good service record. We desperately need more like it spread around the globe.

What problems would decentralization solve here?

So if Let's Encrypt has a problem, like say their OCSP server is serving errors[1] then the entire Internet is not affected.

https://community.letsencrypt.org/t/may-19-2017-ocsp-and-iss...

Re: Let's Encrypt makes certs for 30% of web domains

#67
post #6

The GCP self-serving platform for certs is very welcome, but still kinda janky. You end up waiting hours for their batch jobs to run at unknown cycles. Let's encrypt is awesome because it's instantaneous! You'd think Google would understand that aspect. Edit: GCP people: Please give us a an explicit "retry" button to press when we've set up the DNS records. (I'm talking about the Google Cloud Balancing Service here.…

For GKE, in beta, you can tell the ingress to get a TLS certificate automatically. Google will manage the whole process. The weird thing is, it uses letsencrypt. Since Google has their own Root CA, that seemed like an interesting choice.

[0] https://cloud.google.com/kubernetes-engine/docs/how-to/manag...

Re: Let's Encrypt makes certs for 30% of web domains

#68
post #58
post #22

Earlier quoted context omitted.

Competition is always good. For one, a completely decoupled and separately managed system on a different stack would improve availability of ACME-based certificates. It would also reduce the concentration of trust in one entity. While LE is awesome, the target on their back is only getting bigger. For what it's worth, I'm pretty sure even Let's Encrypt wants to see competitors to Let's Encrypt.

> It would also reduce the concentration of trust in one entity. No it wouldn't. If there are 9999 CAs, you need to trust every single one of them. A better argument for having multiple CAs is that it would increase resilience (against takedowns, bugs, money running out, etc.)

Convergence was a project to have multiple notaries to vouch for a TLS certificate instead of a chain of CAs.

There are way to decentralize the internet, but there never will be much interest for it.

Re: Let's Encrypt makes certs for 30% of web domains

#69
does anyone care that letsencrypt and other CAs are sharing their certificate requests to indexers?

It allows someone to discover every one of your HTTPS certificates that you've requested.

For instance, here is some free rabbitmq clusters to use... https://censys.io/certificates?q=parsed.extensions.subject_a...

Default password of guest/guest works on http://rabbitmq.avtomain-crypto.com/#/

Re: Let's Encrypt makes certs for 30% of web domains

#70

does anyone care that letsencrypt and other CAs are sharing their certificate requests to indexers? It allows someone to discover every one of your HTTPS certificates that you've requested. For instance, here is some free rabbitmq clusters to use... https://censys.io/certificates?q=parsed.extensions.subject_a... Default password of guest/guest works on http://rabbitmq.avtomain-crypto.com/#/

You can use a wildcard cert too. With other possible issues.
Post reply on HN