Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL certificate requirements are becoming obnoxious

chrislockard.net

Post reply on HN
Print view View original

261–270 of 305 posts

Re: SSL certificate requirements are becoming obnoxious

#261

Post by GuinansEyebrows »

basscomm wrote: post #254
GuinansEyebrows wrote: post #244

Earlier quoted context omitted.

> Ratcheting the expiration down to 47 days is an effort to force everyone to use automation, which makes no sense for small hobby sites. you make it sound like setting up automated renewals is an onerous process. IME it takes about the same amount of time to set up the automation according to the directions as it does to manually renew the certs with an ACME client. the only difference is you're pasting a command in…

> you make it sound like setting up automated renewals is an onerous process The problem isn't that it's hard to set up. It's that it adds another thing that I have to monitor for failures and troubleshoot when it breaks. For a small hobby site, I might go longer than 47 days without looking at it.

fair point. for the stakes we're talking about, i've personally found it more than reliable for a handful of hobby sites i've hosted over the years, and i don't typically monitor the renewal process for those types of things.

ymmv. for me, i'll fix it if i have to, but i haven't yet :)

Re: SSL certificate requirements are becoming obnoxious

#262

Post by cpach »

fanf2 wrote: post #179
FuriouslyAdrift wrote: post #142

Earlier quoted context omitted.

Except browsers and other software that are becoming hard-coded to block access to such devices. We used to use Firefox solely for internal problem devices with IP and subnet exclusions but even that is becoming difficult.

Use the self-signed cert between the proxy and the problem device; everything else talks to the proxy.

Or Wireguard.

Re: SSL certificate requirements are becoming obnoxious

#263

Post by rini17 »

syncsynchalt wrote: post #239
rini17 wrote: post #37

Earlier quoted context omitted.

When it's automated we're back at square one: after few years it breaks and nobody will have any idea where the acme scripts are or how to debug them.

And if something silently breaks, would you rather the breakage is noticed within 47 days, or 398 days? Even your unrelated question is another argument for shortened certificate lifetimes. :-)

Except that's not how this works. When a cron job fails, does not depend on how often it is ran.

Re: SSL certificate requirements are becoming obnoxious

#264

Post by basscomm »

cpach wrote: post #258
basscomm wrote: post #253

Earlier quoted context omitted.

Expecting someone to set up automation to manage one certificate on a hobby site is overkill

I catch your drift, but the browser needs to treat all sites more or less the same. I’d say the easiest way out is to use the Caddy web server, which can take care of the certs all by itself.

I currently use XML and server-side XSLT to transform it because browser makers keep threatening to remove XSLT support (and I like to make it accessible for anyone using alternative browsers). Unless I'm missing something, Caddy doesn't support that, so that's a nonstarter unless I want to rewrite everything.

Re: SSL certificate requirements are becoming obnoxious

#265

Post by FuriouslyAdrift »

cpach wrote: post #262
fanf2 wrote: post #179

Earlier quoted context omitted.

Use the self-signed cert between the proxy and the problem device; everything else talks to the proxy.

Or Wireguard.

Using VPNs on server infrastructure to punch a hole is a resume generating event.

Re: SSL certificate requirements are becoming obnoxious

#266

Post by cpach »

nikanj wrote: post #23
b112 wrote: post #12

I've spent 15+ minutes searching, and the digicert (linked to in the article), and other cert providers all reference a vote on "Multi-Perspective Issuance Corroboration (MPIC)". Everywhere I've read, one "must validate domain control using multiple independent network perspectives". EG, multiple points on the internet, for DNS validation. Yet there is not one place I can find a very specific "this is what this means…

It means the barrier of entry to the SSL certificate market gets higher, favouring established players

I kind of get your point, but think about what low barrier of entry for becoming a CA would imply.

Also, there are loads of other requirements except this one and they are there for good reasons. It’s not easy to get your root certificate accepted by Firefox/Google/Microsoft/Apple and it shouldn’t be.

Re: SSL certificate requirements are becoming obnoxious

#267

Post by cpach »

ollybee wrote: post #107

What is obnoxious is that certificate transparency logs mean that you now have to effectively centrally register any new domain you put online. That means you instantly see a whole load of traffic to your domain from bots, scrapers, beg bounty scanners etc. Any new site has to be designed to handle that baseline of traffic. I understand the point of CTL's and it's necessary given that every browser and device is conf…

Point taken.

One option to avoid this could be to use the DNS-01 challenge to get a wildcard cert from Let’s Encrypt. Then CT will not expose your subdomains.

Re: SSL certificate requirements are becoming obnoxious

#268

Post by beaugunderson »

it's even worse if you are an individual developer who wants to sign the products you're releasing on Windows.

Azure had an "individual developer" beta that lasted less than a year and is now closed... so you have to be able to prove your "business" has been around for three years. they're one of the very few low-cost options who support cloud signing... $10/month or $120/year is VERY reasonable compared to $300/year the other registrars want, PLUS the cost of an HSM you can't use from the cloud.

how are people doing signed binaries on Windows for open source projects? I bought a three year file-based certificate to kick the can down the road but those three years are now up.

Re: SSL certificate requirements are becoming obnoxious

#269

Post by holoduke »

Symbiote wrote: post #148
holoduke wrote: post #113

Earlier quoted context omitted.

Older Android 7 devices are not supported with letsencrypt. For us still 20% of our userbase. We went for a paid subscription with zerossl.

That's six years obsolete, without security patches. What sector has 20% of users with that hardware?

Mainly people in southern America and a few Asian places.

Re: SSL certificate requirements are becoming obnoxious

#270

Post by slipperydippery »

FuriouslyAdrift wrote: post #149
9dev wrote: post #68

Earlier quoted context omitted.

How on earth would that make more sense than properly setting up ACME and forgetting about the problem for the next hundred years?? If your bespoke ERP system is really so hostile toward cert changes, put it behind a proper reverse proxy with modern TLS features and self-sign a certificate for a hundred years, and be done with it. It'll take about fifteen minutes of time, and executive level won't ever have to concer…

Support contract states we cannot put it behind a proxy. We used to use HAProxy and multiple web server instances, but the support switched to India and they claimed they could no longer undertsand or support that configuration. Since it is a main system for the entire org and the support contract is part of our financial liability and data insurance, the load balancer had to go. This is corporate enterprise IT. Now…

Most safety & security dysfunction stories: high level management-tier misaligned incentives, incompetence, and ignorance, overriding the expert advice of mere peons, leading to predictable catastrophes (not to mention, usually, extra costs in the meantime—just hidden ones).

Most solutions: make the peons watch a training video or attend a training session about how they should speak up more.

Post reply on HN