91–100 of 147 posts
Earlier quoted context omitted.
Have you tried using Caddy? It handles automatic HTTPS (a.k.a Let's Encrypt) renewal across a fleet. https://caddyserver.com/docs/automatic-https#fleet
Caddy seems nice but I am way too invested in Nginx
>Almost 1.6M domains had a cert that had recently expired (in July, the month of the scan). Almost 3.7M domains had a cert that expired in 2019 (the year of the scan). Over 9.6M domains had a cert that expired in the 2010s! This doesn't make sense. Even assuming you included the ones that had expired certs in "had a cert that expired in the 2010s", it would only be 1.6+3.7~=5.3M. Where does the rest 4.3M come from?
Those are certs that not-so-recently expired, the heading is "Millions of certs served have expired".
Earlier quoted context omitted.
Let's Encrypt goes down, certs can't be renewed, people can't access websites securely (or at all if HSTS was used).
Good practice says that you should be renewing your certs when they have about 10% of their lifetime left, just in case this exact thing happens with whoever your provider might be. It's unlikely they would be down for so long that certs would actually expire.
One thing I don't understand about Let's Encrypt: Why do the certificates expire after 90 days? What would be the downside of giving them a longer expiration time?
Earlier quoted context omitted.
Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.
Just so people don't get an oversimplified view of what it takes to start a CA from this comment, you will have much bigger challenges than access to application software. Your first issue will be securing millions of dollars per year for the staff that it takes to run the CA responsibly. Your next issue will be getting trusted by browsers. Also, the open source Let's Encrypt CA software is tailored for how we do thi…
[edit]
At least partly through corporate sponsership:
Earlier quoted context omitted.
If your load balancers are AWS load balancers, you are doing it wrong. AWS provides their own free certificates that work the load balancer and they handle renewal as well. Let's Encrypt would be an unnecessary additional dependency and complexity. (At least if you are comfortable terminating your SSL at the load balancer. If you plan to use SSL between the AWS LBs and your EC2 instances, then AWS certs don't work th…
> (At least if you are comfortable terminating your SSL at the load balancer. If you plan to use SSL between the AWS LBs and your EC2 instances, then AWS certs don't work there and you'll need to provision them yourself using something like LE). Interesting note - ALBs/ELBs (NLBs with SSL termination as well, I would assume, but I am not sure) do not perform validation of your backend certificate. You can terminate a…
A few of these things, while not necessarily wrong, should be put into context. E.g. "Hundreds of thousands of domains' certs expire after 2099". Yeah, but no publicly trusted certs. They're capped at a bit more than 2 years and there's a discussion to cap them even more. The certs they're seeing are almost certainly mostly: "let's create a test selfsigned cert for this host. how long should it last? let's type in a…
> Yeah, but no publicly trusted certs. > (Over 1.5M expire in the 2040s alone!) I doubt ~75% of the self signed certs expire in this dataset expire 21-30 years from now. Surely the author is correct that there are a good number of public certs with a very long expiration. Would need to download and filter the dataset to know for sure though.
Back in 2011 when the Baseline Requirements were first written, they set 60 months (5 years) as the upper limit, with the intent to further restrict to 39 months in a few years and that eventually happened in 2015 or so.
Last year 39 months went down to 825 days and there's currently pressure to reduce it further in 2020.
Note that it's not just self-signed certs you'd be considering, many of the certs in this dataset will be issued by a CA but not a public CA. Could be an internal CA (e.g. Windows Server provides software to run one, so does RHEL) or could even be one of the private-use-only CAs run by the same companies that operate public CAs.
There were about half a million certs in that dataset issued by SomeOrganization with email address root@localhost.localdomain. Not technically self-signed, but obviously that's not a public CA.
Earlier quoted context omitted.
Competition is always good. For one, a completely decoupled and separately managed system on a different stack would improve availability of ACME-based certificates. It would also reduce the concentration of trust in one entity. While LE is awesome, the target on their back is only getting bigger. For what it's worth, I'm pretty sure even Let's Encrypt wants to see competitors to Let's Encrypt.
I agree => small question: in this context wouldn't "diversification" be more appropriate than "competition"?
Earlier quoted context omitted.
Start a LetTheRestOfUsEncrypt.org based in a different country whose government isn't so full of themselves? Or better yet, is there a way to start a decentralized organization itself so that no jurisdiction has absolute power over it?
How are you going to trust that decentralized org? Is it just voting? Can we all vote to revoke anyone's cert at any time for no reason? What happens when someone performs a 51% attack and takes over google.com's cert? CAs exist solely because you CAN trust them, otherwise what's the point? We'd just have every site self-sign and let the users choose who to trust.
does anyone care that letsencrypt and other CAs are sharing their certificate requests to indexers? It allows someone to discover every one of your HTTPS certificates that you've requested. For instance, here is some free rabbitmq clusters to use... https://censys.io/certificates?q=parsed.extensions.subject_a... Default password of guest/guest works on http://rabbitmq.avtomain-crypto.com/#/
Several distinct outfits sell what they call "passive DNS" which is a feed of snooped DNS queries and their answers, minus any identifying information. So you don't need a certificate, if anybody, anywhere, looks up the name and it has an answer then these systems will tell you what it is.
The records come through roughly like this:
name: 'news.ycombinator.com'
type: 'A'
value: '209.216.230.240'