Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL certificate requirements are becoming obnoxious

chrislockard.net

Post reply on HN
Print view View original

131–140 of 305 posts

Re: SSL certificate requirements are becoming obnoxious

#131

Post by ecb_penguin »

znpy wrote: post #112
stego-tech wrote: post #80

Earlier quoted context omitted.

In our defense, it’s because we’re expected to give everything a cert but often have no say on the security and cryptography capabilities of what’s brought onto the network in the first place, nevermind the manpower and time to build such an automated solution internally. Execs bringing in MFPs that don’t support TLS, PLCs that require SHA-1, routers with a packet buffer measured in single-digit integers but with a J…

Don't take this as a snarky comment, but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in. > PKI isn’t a solved problem. PKI is largely a solved issue nowadays. Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographically-strong CA and build the automation you need. I…

> but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in.

You have no idea the environment they work in. The "skill issue" here is you thinking your basic knowledge of Vault matters.

> Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips) let you create a cryptographically-strong CA and build the automation you need.

They didn't tell you their needs, but you're convinced this vendor product solves it.

Are you a non-technical CTO by chance?

> there are equivalents for mac os and gnu/linux i guess

You guess? I'm sensing a skill issue. Why would you say it's solved for their environment, "I guess??"

> Quite the contrary: it means that the process is technically so trivial the masses can do it in an afternoon and live off it for years with little to no maintenance.

I'm sensing you work in a low skill environment if you think "home lab trivial" translates to enterprise and defense.

> Hence, if a large organization is not able to implement that, the issue is in the organization, not in the technology.

Absolutely meaningless statement.

Re: SSL certificate requirements are becoming obnoxious

#132

Post by icedchai »

echelon wrote: post #69
Intermernet wrote: post #38

Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year, and that's only because I forget the steps required to setup auto-renewal. I pay nothing, I spend a tiny amount of time dealing with it, and it works brilliantly. I'm not sure why many people are still dealing with legacy manual certificate renewal. Maybe some regulatory requirements? I even have a w…

I really hate the HTTPS requirement that Google unilaterally mandated for everyone. Just wait until SSL is used to prevent us from publishing anything. Your ID will have to be on file and be compliant. We've gone from really simple tools to tools that could easily be used to ensnare us and rid us of our rights. Encryption doesn't necessarily mean privacy. It can also mean control.

Certs are free. All you need is a domain name and letsencrypt.

Re: SSL certificate requirements are becoming obnoxious

#133

Post by ocdtrekkie »

ameliaquining wrote: post #124
ocdtrekkie wrote: post #6

I do not think PKI will survive the 47 day change. I am not sure the CAB will survive that change. It seems extremely apparent the people who made the decision have neither any relevant experience in IT nor any practical understanding of security, and I think they've finally flown too close to the sun. Automated renewal is... probably about a decade or two from being supported well enough to be an actual answer. In o…

What would it look like for the Web PKI to "not survive that change"? Is the idea that companies stop having websites and tell all their users to switch to Gopher or something, because the burden of certificate management is too much? > In our case, we'll be spending the next couple years reducing our use of PKI certificates to the bare functional minimum. Good. A certificate being publicly trusted is a liability , w…

> What would it look like for the CA/B to "not survive that change"?

I suspect when companies who are members actually realize what happened, CA/B members will be told to reverse the 47 day lifetime or be fired and replaced by people who will. This is a group of people incredibly detached from reality, but that reality is going to come crashing through to their employers as 2029 approaches.

> Good.

You may assume that most organizations will implement private CAs in these scenarios. I suspect the use of encryption internally will just fall. And it will be far easier for attackers to move around inside a network, and take over the handful of fancy auto-renewing public-facing servers with PKI anyways.

Re: SSL certificate requirements are becoming obnoxious

#134

Post by 8organicbits »

Thorrez wrote: post #125
8organicbits wrote: post #93

Earlier quoted context omitted.

Lots of ACME software supports configuring CA fallbacks, so even if a CA is down hard for an extended period you can issue certificates with the others. Using LetsEncrypt and ZeroSSL together is a popular approach. If you need a stronger guarantee of uptime, reach for the paid options. https://github.com/acmesh-official/acme.sh?tab=readme-ov-fil...

If everyone uses that with 1 minute or 1 second expirations, I could certainly see a case where an outage in 1 CA causes traffic migration to another, causing performance issues on the fallback CA too. >If you need a stronger guarantee of uptime, reach for the paid options. We don't. If we had 1 minute or 1 second lifetimes, we would.

Oh, agreed. I was responding to the part about extended outages.

Re: SSL certificate requirements are becoming obnoxious

#136

Post by 9dev »

dvdkon wrote: post #128
9dev wrote: post #88

Earlier quoted context omitted.

Why is fronting these systems with a central haproxy with TLS termination or similar not an option?

Because then you have plain HTTP running over your network. The issue here (I presume) is not how to secure access over the Internet, but within an internal network. Plenty of people leave these devices without encrypted connections, because they are in a "secure network", but you should never rely on such a thing.

Nothing stops you from using a self-signed certificate with a ridiculous expiration period for HTTPS between the reverse proxy and the device in question.

Re: SSL certificate requirements are becoming obnoxious

#137

Post by sigseg1v »

The first link in the article I clicked for context led to a cert provider whose business name I recognize. Found the problem.

I inherited a process using the same thing last year and it is the absolutely most insane nonsense I can think of. These types of companies have support that is totally useless and their entire business model is to charge 1000x or more (eg. compare signature price to a HSM in GCP) what competitors charge while also providing less functionality, and hoping that people will get sucked in and trapped in their ecosystem by purchasing an expensive cert such as an "EV" cert which I'm still not totally clear does by the way, but I'm assured it's very important for security on Windows. Not security against bad guys though... it appears to be for security against no-name anti virus vendors deleting your files if they detect you didn't pay this "EV" cert ransom. They don't need to actually detect threats based on code or behavior, they just detect if you have enough money.

Re: SSL certificate requirements are becoming obnoxious

#138

Post by ameliaquining »

commandlinefan wrote: post #118

I would be ok with all of this if it meant anything. My computer has 151 trusted Certificate Authorities installed on it, including heavy hitters in the CA industry such as TUBITAK, Telia and Sectigo. As a user, I have no idea what sort of actual verification went into verifying the certificates that the site I'm visiting is presenting.

The reason you can trust all those CAs is because Certificate Transparency makes it very likely that misissuances will be caught, and a CA that screws up and fails to credibly ensure that it won't happen again will be distrusted be browsers. The chance that the particular domain you're interested in will be the one that gets a misissued certificate before that happens is really quite low. It's not a perfect system but it works surprisingly well in practice.

Re: SSL certificate requirements are becoming obnoxious

#139

Post by ameliaquining »

jacquesm wrote: post #30
romaniv wrote: post #18

The web today is a rotting carcass with various middlemen maggots crawling all over it and gorging themselves on the decay. The only real discussion to be had is what to replace it with and how to design the new protocols to avoid the same issues.

The reason the web is a rotting carcass is not because of the way the web is architected, it is because a lot of people's livelihoods depend on making it as rotten as possible without collapsing it entirely. From advertising companies, search engines (ok, sometimes both), certificate peddlers and other 'service' (I use the term lightly here) providers there are just too many of these maggots that we don't actually ne…

Who do you propose needs to fuck off in order for the web to not need certificate authorities?

Re: SSL certificate requirements are becoming obnoxious

#140

Post by rfl890 »

ecb_penguin wrote: post #131
znpy wrote: post #112

Earlier quoted context omitted.

Don't take this as a snarky comment, but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in. > PKI isn’t a solved problem. PKI is largely a solved issue nowadays. Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographically-strong CA and build the automation you need. I…

> but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in. You have no idea the environment they work in. The "skill issue" here is you thinking your basic knowledge of Vault matters. > Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographically-strong CA and build the…

Relax, dude. https://xkcd.com/386/
Post reply on HN