SSL certificate requirements are becoming obnoxious • Hacker News Board

Re: SSL certificate requirements are becoming obnoxious

#301

Post by ecb_penguin » Thu, Aug 28, 2025, 1:07 AM UTC

znpy wrote: post #294

ecb_penguin wrote: post #292

Earlier quoted context omitted.

> It's not 1995, cryptography isn't arcane anymore. My username is literally a cryptographic mode of operation. But you didn't know that, because you have a low skill issue. > Do you know the US government has dedicated cloud regions (eg: This is a joke, right? You're just an LLM going through training.

> My username is literally a cryptographic mode of operation. But you didn't know that, because you have a low skill issue. Again, ad hominem attack... You proved yourself to be quite a fool. You can't argue, you can't back your own opinions, you are only capable of attacking on a personal level. > This is a joke, right? You're just an LLM going through training. My account is from 2015 and has ~11k points. Your acco…

> Again, ad hominem attack

That's not what ad hominem means. Ad hominem doesn't mean I can't insult you

> My account is from 2015 and has ~11k points. Your account is 4 months old and barely has 150 points. It's more likely that you're a poorly trained LLM (whoever trained you had skill issues :P) rather than me.

Content matters more than age you goofball

Re: SSL certificate requirements are becoming obnoxious

#302

Post by jraph » Thu, Aug 28, 2025, 8:04 AM UTC

throw0101a wrote: post #293

jraph wrote: post #119

Earlier quoted context omitted.

In these setups, the issue already exists: an appliance would have to renew its SSL certificate when it expires. I believe ssl certificates should already not be used anywhere they can't be renewed.

There's a difference between having to renew annually and having to do it every 47 days: * https://news.ycombinator.com/item?id=43693900

For an appliance, if you embed a 1 year certificate that can't be renewed, the feature will stop working correctly after a year. That's already quite short. And if it can be renewed, then it can also most probably be renewed every month no problem.

You linked to a whole thread in which the top comment asks a question that's a slippery slope, and of which the top answer lists advantages of a reduced validity time (while pointing out that too short like 30 seconds poses reliability and scale risks, to address the slippery slope argument).

What did you mean to point out?

Re: SSL certificate requirements are becoming obnoxious

#303

Post by 9dev » Thu, Aug 28, 2025, 12:28 PM UTC

FuriouslyAdrift wrote: post #297

9dev wrote: post #296

Earlier quoted context omitted.

Wireguard is not a VPN, it’s a protocol that can be used for a lot of things.

The wireguard protocol is an encapsulation or tunneling protocol... which is, by definition, a virtualized private network protocol. It's not different from IPSec, GRE, VXLAN, etc. It's just the new hotness. We use VXLAN extensively in our network, btw, and IKEv2/IPSec tunnels between sites.

WireGuard can be used to create a virtualised private network, but doesn't do so on its own, or without additional infrastructure. WireGuard tunnels network packages securely, with high throughput, from an arbitrary point A to an arbitrary point B. No more, no less.

Just because it can be used to recreate VPNs traditionally used to remotely dial into a secure network zone doesn't mean it shouldn't be used in far smaller use-cases. WireGuard doesn't constitute anything like a full VPN solution on its own.

Re: SSL certificate requirements are becoming obnoxious

#304

Post by DougN7 » Sat, Aug 30, 2025, 11:55 PM UTC

mdaniel wrote: post #183

DougN7 wrote: post #129

Earlier quoted context omitted.

The last time I looked, if you ran your HTTPS service on anything other than port 443 LetsEncrypt was not for you. Maybe that’s built into ACME?

I can't tell if it's a typo but HTTP-01 would contact your webserver on :80 in order to successfully retrieve a very, very, very specific ACME path and does not care at all what you do with your issued TLS afterward, including what port you run it upon Also, I know firsthand that the DNS Validator also works perfectly fine, no http check required

That’s right. So a private server hosted on something other than port 80 (like port 81 in my case) is where you’re out of luck :(

Re: SSL certificate requirements are becoming obnoxious

#305

Post by SAI_Peregrinus » Sun, Aug 31, 2025, 4:45 PM UTC

syncsynchalt wrote: post #240

dark-star wrote: post #13

> I am responsible for approving SSL certificates for my company What does this even mean? Does he check the certificates for typos, or that they have the correct security algorithm or something? I'm pretty sure such an "approval" could be replaced by an automatic security scanner or even a small shall script

There are environments where it's required that _every_ environmental change has an associated CCB ticket. In that kind of environment, yes, every new cert is attached to a ticket that the board has to review and approve. Yes, it's insane, but it sure makes fault analysis easier when the environment is that locked down and documented.

But they don't require changes for altering the state of RAM on the server, or data in the database. So clearly not every change requires an associated ticket. Certificate renewal is part of the regular operation of a device, not a change to that operation.