Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL certificate requirements are becoming obnoxious

chrislockard.net

Post reply on HN
Print view View original

291–300 of 305 posts

Re: SSL certificate requirements are becoming obnoxious

#291

Post by ecb_penguin »

rfl890 wrote: post #140
ecb_penguin wrote: post #131

Earlier quoted context omitted.

> but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in. You have no idea the environment they work in. The "skill issue" here is you thinking your basic knowledge of Vault matters. > Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographically-strong CA and build the…

Relax, dude. https://xkcd.com/386/

I don't know why you think a couple sentence reply is all that difficult...

Re: SSL certificate requirements are becoming obnoxious

#292

Post by ecb_penguin »

znpy wrote: post #271
ecb_penguin wrote: post #131

Earlier quoted context omitted.

> but that sounds quite literally as "skill issue". Not in you personally, but in the environment you work in. You have no idea the environment they work in. The "skill issue" here is you thinking your basic knowledge of Vault matters. > Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographically-strong CA and build the…

> You have no idea the environment they work in. The "skill issue" here is you thinking your basic knowledge of Vault matters. I've deployed Vault both at home and in two different companies, doing anything from pki, mutual-tls, secret storage and other stuff. > > Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographical…

> It's not 1995, cryptography isn't arcane anymore.

My username is literally a cryptographic mode of operation. But you didn't know that, because you have a low skill issue.

> Do you know the US government has dedicated cloud regions (eg:

This is a joke, right? You're just an LLM going through training.

Re: SSL certificate requirements are becoming obnoxious

#293

Post by throw0101a »

jraph wrote: post #119
throw0101a wrote: post #102

Earlier quoted context omitted.

> The decreasing validity time pushes for the process to be automated, and automation reduces the possible human errors. There are environments and devices where automation is not possible: not everything that needs a cert is a Linux server, or a system where you can run your own code. (I initially got ACME/LE working on a previous job's F5s because it was RH underneath and so could get Dehydrate working (only needs…

In these setups, the issue already exists: an appliance would have to renew its SSL certificate when it expires. I believe ssl certificates should already not be used anywhere they can't be renewed.

There's a difference between having to renew annually and having to do it every 47 days:

* https://news.ycombinator.com/item?id=43693900

Re: SSL certificate requirements are becoming obnoxious

#294

Post by znpy »

ecb_penguin wrote: post #292
znpy wrote: post #271

Earlier quoted context omitted.

> You have no idea the environment they work in. The "skill issue" here is you thinking your basic knowledge of Vault matters. I've deployed Vault both at home and in two different companies, doing anything from pki, mutual-tls, secret storage and other stuff. > > Software like Vault from hashicorp (it's FIPS compliant, too: https://developer.hashicorp.com/vault/docs/enterprise/fips ) let you create a cryptographical…

> It's not 1995, cryptography isn't arcane anymore. My username is literally a cryptographic mode of operation. But you didn't know that, because you have a low skill issue. > Do you know the US government has dedicated cloud regions (eg: This is a joke, right? You're just an LLM going through training.

> My username is literally a cryptographic mode of operation. But you didn't know that, because you have a low skill issue.

Again, ad hominem attack... You proved yourself to be quite a fool. You can't argue, you can't back your own opinions, you are only capable of attacking on a personal level.

> This is a joke, right? You're just an LLM going through training.

My account is from 2015 and has ~11k points. Your account is 4 months old and barely has 150 points. It's more likely that you're a poorly trained LLM (whoever trained you had skill issues :P) rather than me.

I'll be dropping this useless conversation. Farewell.

Re: SSL certificate requirements are becoming obnoxious

#295

Post by LeifCarrotson »

znpy wrote: post #274
LeifCarrotson wrote: post #151

Earlier quoted context omitted.

> It's been out for years now, integrating the root CA shouldn't be much of an issue via group policies (in windows, there are equivalents for mac os and gnu/linux i guess). How do you do this on a proprietary device from the late 90s that runs a WindRiver VXWorks RTOS with 1 MB of SRAM? The updated (full color!) Panelview HMI is running Windows CE 6.0, so it's perhaps more likely to be compatible, but I don't think…

> How do you do this on a proprietary device from the late 90s that runs a WindRiver VXWorks RTOS with 1 MB of SRAM? You weight the cost of incurring in that thing getting hacked against the cost of that thing being rebuilt on modern hardware with modern technologies and enough processing power to do TLS. Then you pick the "rebuild route". Easy. Anyway, it's crazy how on this forum it goes from "REWRITE EVERYTHING IN…

>> Sure, adding a cert to the SCADA server is trivial, it runs Windows Server and has a NIC that can access the Internet, but on the other NIC...there's a menagerie of 30 years of industrial oddities.

> Not gonna lie, all i hear is "i'm annoyed i was able to ignore the problem for 30 years but now i have to actually fix it".

You're not entirely wrong, but you're talking to the wrong guy. Clean-slate rewrites are some of my favorite best projects, and I hate dealing with legacy junk - but there's just not budget to keep everything brand new all the time.

Realize that when you flush the toilet, the reason the water level goes down is likely to be a municipal sewer system and waste treatment plant that must never stop...they replace mechanical wear items once in a while, but some of the controls are well over 30 years old. Same story at the clean water plant that fills the tank back up. An average consumer might replace their phone every 2 years, but industrial processes and infrastructure have much, much longer timelines.

Re: SSL certificate requirements are becoming obnoxious

#297

Post by FuriouslyAdrift »

9dev wrote: post #296
FuriouslyAdrift wrote: post #265

Earlier quoted context omitted.

Using VPNs on server infrastructure to punch a hole is a resume generating event.

Wireguard is not a VPN, it’s a protocol that can be used for a lot of things.

The wireguard protocol is an encapsulation or tunneling protocol... which is, by definition, a virtualized private network protocol.

It's not different from IPSec, GRE, VXLAN, etc. It's just the new hotness.

We use VXLAN extensively in our network, btw, and IKEv2/IPSec tunnels between sites.

Re: SSL certificate requirements are becoming obnoxious

#298

Post by lulceltech »

Hey there I feel your pain, ironically this is what lead me to create a new tool for developers like yourself called VanityCert that takes away the headache.

My journey personally was with my previous company and we had the challenge of 1-n domains pointing at 1-n sub domains so a simple solution like certbot just didn’t work for us sadly. Not only that but my bosses were doing it manually and still paying for the certs which was consuming time and money. So over the course of a few months I wrote a solution to that problem to easily issue, manage, and renew 1-n certs for 1-n vanity domains. Was a good bit of work but for the last 2 years it’s been flawless and turned into a upsell and a money maker from a losing situation previously.

This is funny timing because we actually just put VanityCert on product hunt if you’re interested in checking out what I build. Would love your thoughts!

Re: SSL certificate requirements are becoming obnoxious

#299

Post by znpy »

LeifCarrotson wrote: post #295
znpy wrote: post #274

Earlier quoted context omitted.

> How do you do this on a proprietary device from the late 90s that runs a WindRiver VXWorks RTOS with 1 MB of SRAM? You weight the cost of incurring in that thing getting hacked against the cost of that thing being rebuilt on modern hardware with modern technologies and enough processing power to do TLS. Then you pick the "rebuild route". Easy. Anyway, it's crazy how on this forum it goes from "REWRITE EVERYTHING IN…

>> Sure, adding a cert to the SCADA server is trivial, it runs Windows Server and has a NIC that can access the Internet, but on the other NIC...there's a menagerie of 30 years of industrial oddities. > Not gonna lie, all i hear is "i'm annoyed i was able to ignore the problem for 30 years but now i have to actually fix it". You're not entirely wrong, but you're talking to the wrong guy. Clean-slate rewrites are some…

> Clean-slate rewrites are some of my favorite best projects, and I hate dealing with legacy junk - but there's just not budget to keep everything brand new all the time.

Hey, I get it.

The thing is, budget is largely artificial. Unless a company is on the brink of bankruptcy, there can be budget (but the company has to eat that from profits).

The thing is, eating budget for maintenance and system upgrades is a known playbook companies use. That doesn't make it right though.

That is why i wrote that the issue is organizational, not technical...

Re: SSL certificate requirements are becoming obnoxious

#300

Post by b112 »

ameliaquining wrote: post #42
jaas wrote: post #27

Earlier quoted context omitted.

Section 3.2.2.9 of this document: https://cabforum.org/working-groups/server/baseline-requirem... You can also just search the document for the word "Perspective" to find most references to it.

For convenience, here are the quotes that most directly answer the above question: " Effective December 15, 2026, the CA MUST implement Multi-Perspective Issuance Corroboration using at least five (5) remote Network Perspectives. The CA MUST ensure that [...] the remote Network Perspectives that corroborate the Primary Network Perspective fall within the service regions of at least two (2) distinct Regional Internet…

Thanks muchly.
Post reply on HN