Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL certificate requirements are becoming obnoxious

chrislockard.net

Post reply on HN
Print view View original

251–260 of 305 posts

Re: SSL certificate requirements are becoming obnoxious

#251

Post by immibis »

echelon wrote: post #69
Intermernet wrote: post #38

Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year, and that's only because I forget the steps required to setup auto-renewal. I pay nothing, I spend a tiny amount of time dealing with it, and it works brilliantly. I'm not sure why many people are still dealing with legacy manual certificate renewal. Maybe some regulatory requirements? I even have a w…

I really hate the HTTPS requirement that Google unilaterally mandated for everyone. Just wait until SSL is used to prevent us from publishing anything. Your ID will have to be on file and be compliant. We've gone from really simple tools to tools that could easily be used to ensnare us and rid us of our rights. Encryption doesn't necessarily mean privacy. It can also mean control.

Google has backtracked from requiring HTTPS in Chrome. I repeat: HTTPS is not required. Where did you get that from?

If you're talking about Android, it doesn't require you to use WebPKI CAs. You can go self-signed.

If it's about the search engine, well, that's gone to shit and you'll only be visible if Google likes you in a completely arbitrary way - no point trying to add HTTPS to show up in search results now unless you already do.

Re: SSL certificate requirements are becoming obnoxious

#252

Post by cpach »

aitchnyu wrote: post #92
o_m wrote: post #60

Earlier quoted context omitted.

The older I get the more skeptical I get to free services that run on others servers. They have a bunch of expenses and you are getting it for free. You are not the customer. I rather pay for a service than gamble on some free service that might be shut down at any time, or that might have malicious intents.

Whats a LetsEncrypt competitor which has convenient automated renewal?

Google Cloud

Re: SSL certificate requirements are becoming obnoxious

#253

Post by basscomm »

rs186 wrote: post #248
basscomm wrote: post #178

Earlier quoted context omitted.

> Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year I run a couple of low-stakes websites just for fun and manually updating certificates takes me about 10 minutes a year, and most of that is remembering how to generate the csr. Setting up an automated process gains me nothing except additional points of failure. Ratcheting the expiration down to 47…

> Ratcheting the expiration down to 47 days is an effort to force everyone to use automation Forcing everyone to use automation sounds like a great idea. I am sure it is by design.

Expecting someone to set up automation to manage one certificate on a hobby site is overkill

Re: SSL certificate requirements are becoming obnoxious

#254

Post by basscomm »

GuinansEyebrows wrote: post #244
basscomm wrote: post #178

Earlier quoted context omitted.

> Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year I run a couple of low-stakes websites just for fun and manually updating certificates takes me about 10 minutes a year, and most of that is remembering how to generate the csr. Setting up an automated process gains me nothing except additional points of failure. Ratcheting the expiration down to 47…

> Ratcheting the expiration down to 47 days is an effort to force everyone to use automation, which makes no sense for small hobby sites. you make it sound like setting up automated renewals is an onerous process. IME it takes about the same amount of time to set up the automation according to the directions as it does to manually renew the certs with an ACME client. the only difference is you're pasting a command in…

> you make it sound like setting up automated renewals is an onerous process

The problem isn't that it's hard to set up. It's that it adds another thing that I have to monitor for failures and troubleshoot when it breaks. For a small hobby site, I might go longer than 47 days without looking at it.

Re: SSL certificate requirements are becoming obnoxious

#255

Post by TrueDuality »

mrgaro wrote: post #217
TrueDuality wrote: post #196

Earlier quoted context omitted.

Speaking as someone who has worked in tightly regulated environment, certificates are kind of a nasty problem and there are a couple of requirements that are in conflict for going to full automation of certificates. - Rotation of all certificates and authentication material must be renewed at regular intervals (no conflict here, this is the goal) - All infrastructure changes need to have the commands executed and con…

What dictates that certificate update needs to have a manual change process? I'd bet that it's just legal team saying that "this is how it's always been" instead of adjusting their interpretation as the environment around changes.

The references I'd direct you to are NIST 800-53r5 controls CM-3 (Configuration Change Control) and CM-4 (Impact Analyses) along with their enhancements, require that configuration changes go through documented approval, security impact analysis, and testing before implementation. A certificate change is unfortunately consider a configuration change to the services.

Each change needs a documented approval trail. While you can get pre-approval for automated rotations as a class of changes, many auditors interpret the controls conservatively and want to see individual change tickets for each cert rotation, even routine ones.

Re: SSL certificate requirements are becoming obnoxious

#256

Post by dingaling »

roblabla wrote: post #187
basscomm wrote: post #178

Earlier quoted context omitted.

> Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year I run a couple of low-stakes websites just for fun and manually updating certificates takes me about 10 minutes a year, and most of that is remembering how to generate the csr. Setting up an automated process gains me nothing except additional points of failure. Ratcheting the expiration down to 47…

What's frankly ridiculous is that the big softwares like Nginx and Apache don't deal with this on their own. I've been letting Caddy (my http host of choice) deal with TLS for me for _ages_ now. I don't have to think about anything, I don't have to setup automation. I just... configure my caddy to host my website on https://my.domain.com and it just fetches the TLS for me, renews it when necessary, and uses it as nec…

I just can't come to terms with letting a public-facing web server write arbitrary data from the network to disk.

Re: SSL certificate requirements are becoming obnoxious

#257

Post by mmh0000 »

ameliaquining wrote: post #153
GuB-42 wrote: post #145

Earlier quoted context omitted.

And yet, I am a bit worried that now, most of the web depends on LetsEncrypt. That's a single point of failure. Sure, they are "good guys", really, but remember that Google used to be "good guys" too. And this is a US-based organization, dependent on US rules, which is not so bad, but alternatives would be nice. And yes, there are alternatives, but everything is made so that LetsEncrypt is the only reasonable choice.…

How would you propose things should work instead?

I propose a system like SSH fingerprints.

Then anybody can maintain a database of "known fingerprints", and a web-of-trust can be established without depending on a centeral-point-of-censorship.

Fuck CA's. They're not and never have been trustworthy:

https://en.wikipedia.org/wiki/DigiNotar

https://en.wikipedia.org/wiki/Xcitium#Certificate_hacking

https://arstechnica.com/security/2025/06/chrome-boots-2-cert...

https://www.zdnet.com/article/google-guillotine-falls-on-cer...

Re: SSL certificate requirements are becoming obnoxious

#258

Post by cpach »

basscomm wrote: post #253
rs186 wrote: post #248

Earlier quoted context omitted.

> Ratcheting the expiration down to 47 days is an effort to force everyone to use automation Forcing everyone to use automation sounds like a great idea. I am sure it is by design.

Expecting someone to set up automation to manage one certificate on a hobby site is overkill

I catch your drift, but the browser needs to treat all sites more or less the same.

I’d say the easiest way out is to use the Caddy web server, which can take care of the certs all by itself.

Re: SSL certificate requirements are becoming obnoxious

#259

Post by cpach »

dingaling wrote: post #256
roblabla wrote: post #187

Earlier quoted context omitted.

What's frankly ridiculous is that the big softwares like Nginx and Apache don't deal with this on their own. I've been letting Caddy (my http host of choice) deal with TLS for me for _ages_ now. I don't have to think about anything, I don't have to setup automation. I just... configure my caddy to host my website on https://my.domain.com and it just fetches the TLS for me, renews it when necessary, and uses it as nec…

I just can't come to terms with letting a public-facing web server write arbitrary data from the network to disk.

Are there any certain exploits you’re worried about?

Re: SSL certificate requirements are becoming obnoxious

#260

Post by cpach »

TrueDuality wrote: post #255
mrgaro wrote: post #217

Earlier quoted context omitted.

What dictates that certificate update needs to have a manual change process? I'd bet that it's just legal team saying that "this is how it's always been" instead of adjusting their interpretation as the environment around changes.

The references I'd direct you to are NIST 800-53r5 controls CM-3 (Configuration Change Control) and CM-4 (Impact Analyses) along with their enhancements, require that configuration changes go through documented approval, security impact analysis, and testing before implementation. A certificate change is unfortunately consider a configuration change to the services. Each change needs a documented approval trail. Whil…

Haven’t read those documents but to me that sounds like a problem with the auditor rather than the guideline?
Post reply on HN