Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL certificate requirements are becoming obnoxious

chrislockard.net

Post reply on HN
Print view View original

181–190 of 305 posts

Re: SSL certificate requirements are becoming obnoxious

#181

Post by unethical_ban »

Intermernet wrote: post #38

Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year, and that's only because I forget the steps required to setup auto-renewal. I pay nothing, I spend a tiny amount of time dealing with it, and it works brilliantly. I'm not sure why many people are still dealing with legacy manual certificate renewal. Maybe some regulatory requirements? I even have a w…

Having worked in IT, I assure you this is not a 99% implemented solution.

Weird internal setups, dozens of proprietary or in-house sites, different verification needs for internal vs. external.

And I'm speaking of the easier scenario of an internal CA.

Re: SSL certificate requirements are becoming obnoxious

#182

Post by OptionOfT »

DougN7 wrote: post #129
ComputerGuru wrote: post #109

I actually don’t have a problem with the SSL changes as they specifically pertain to http servers – it’s largely a dived problem with automated solutions compatible with all the major players on most fronts. But certs and every other context have become neigh impossible except in enterprise settings with your own CA and cert servers. From things like printers and network appliances to entirely non-http applications l…

The last time I looked, if you ran your HTTPS service on anything other than port 443 LetsEncrypt was not for you. Maybe that’s built into ACME?

You can get LetsEncrypt certificates for endpoints that aren't publically accessible through the DNS-01 challenge.

Re: SSL certificate requirements are becoming obnoxious

#183

Post by mdaniel »

DougN7 wrote: post #129
ComputerGuru wrote: post #109

I actually don’t have a problem with the SSL changes as they specifically pertain to http servers – it’s largely a dived problem with automated solutions compatible with all the major players on most fronts. But certs and every other context have become neigh impossible except in enterprise settings with your own CA and cert servers. From things like printers and network appliances to entirely non-http applications l…

The last time I looked, if you ran your HTTPS service on anything other than port 443 LetsEncrypt was not for you. Maybe that’s built into ACME?

I can't tell if it's a typo but HTTP-01 would contact your webserver on :80 in order to successfully retrieve a very, very, very specific ACME path and does not care at all what you do with your issued TLS afterward, including what port you run it upon

Also, I know firsthand that the DNS Validator also works perfectly fine, no http check required

Re: SSL certificate requirements are becoming obnoxious

#184

Post by ronsor »

Symbiote wrote: post #148
holoduke wrote: post #113

Earlier quoted context omitted.

Older Android 7 devices are not supported with letsencrypt. For us still 20% of our userbase. We went for a paid subscription with zerossl.

That's six years obsolete, without security patches. What sector has 20% of users with that hardware?

Half of all Android manufacturers suck, and many users are lazy to update, so if you target the platform, you always have to support a bunch of random old versions.

Re: SSL certificate requirements are becoming obnoxious

#185

Post by lovehashbrowns »

dark-star wrote: post #13

> I am responsible for approving SSL certificates for my company What does this even mean? Does he check the certificates for typos, or that they have the correct security algorithm or something? I'm pretty sure such an "approval" could be replaced by an automatic security scanner or even a small shall script

Sounds so similar to something we had set up when I worked for a major retailer a few years ago. In order to get a cert you had to email the security team or some junk like that and THEY would go through the digicert UI. I stopped reading the absolutely giant and incredibly confusing certificate support document and swapped everything I was responsible for to ACM.

Side note, at some point I got an email telling me to stop issuing public certificates and only issue private certs. I had to get on a call with someone and explain PKI. To someone on the security team!

Re: SSL certificate requirements are becoming obnoxious

#187

Post by roblabla »

basscomm wrote: post #178
Intermernet wrote: post #38

Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year, and that's only because I forget the steps required to setup auto-renewal. I pay nothing, I spend a tiny amount of time dealing with it, and it works brilliantly. I'm not sure why many people are still dealing with legacy manual certificate renewal. Maybe some regulatory requirements? I even have a w…

> Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year I run a couple of low-stakes websites just for fun and manually updating certificates takes me about 10 minutes a year, and most of that is remembering how to generate the csr. Setting up an automated process gains me nothing except additional points of failure. Ratcheting the expiration down to 47…

What's frankly ridiculous is that the big softwares like Nginx and Apache don't deal with this on their own. I've been letting Caddy (my http host of choice) deal with TLS for me for _ages_ now. I don't have to think about anything, I don't have to setup automation. I just... configure my caddy to host my website on https://my.domain.com and it just fetches the TLS for me, renews it when necessary, and uses it as necessary.

You don't need to be a professional sysadmin to deal with this - so long as the software you use isn't ass. Nginx will _finally_ get this ability in the next release (and it'll still be more configuration than caddy, that just defaults to the sane thing)...

Re: SSL certificate requirements are becoming obnoxious

#188

Post by op00to »

FuriouslyAdrift wrote: post #50
Jeslijar wrote: post #14

Earlier quoted context omitted.

Why is a month's expiration better than a year or two years? Why wouldn't you go with a week or a day? isn't that better than a whole month? Why isn't it instead just a minute? or a few seconds? Wouldn't that be better? Why not have certificates dynamically generated constantly and have it so every single request is serviced by a new one and then destroyed after the session is over? Maybe the problem isn't that certi…

I just recently had a executive level manager ask if we could get a 100 year cert for our ERP as the hassle of cert management and the massive cost of missing a renewal made it worth it. He said six figures for the price would be fine. This is an instance where business needs and technology have gotten really out of alignment.

Start your own business - nginx proxy in front of ERP where you handle the SSL for them, put $$ in a trust to ensure there's enough money to pay for someone to update the cert.

Re: SSL certificate requirements are becoming obnoxious

#190

Post by mdaniel »

quesera wrote: post #154
romaniv wrote: post #18

The web today is a rotting carcass with various middlemen maggots crawling all over it and gorging themselves on the decay. The only real discussion to be had is what to replace it with and how to design the new protocols to avoid the same issues.

I don't know what a replacement for the web would look like. But it seems apparent to me that it will have to work over HTTP/QUIC, and TCP port 443. Which prompts the obvious question ...

As a friendly reminder, SRV records exist and are great at fixing that magic port syndrome (unless you were hinting at the infinite corporate firewall appliances, for which I have no magic fix)
Post reply on HN