Let’s Encrypt to transition to ISRG root • Hacker News Board

Re: Let’s Encrypt to transition to ISRG root

#11

Post by xref » Wed, Apr 17, 2019, 6:37 AM UTC

josteink wrote: post #8

founderling wrote: post #5

Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.

It’s easy if you have a DNS provider for which there is a DNS-auth module. This was one of the reasons for me switching to Cloudflare DNS, although many other providers should work too.

Unfortunately CloudFlare doesn’t provide limited-scope API keys so every server requesting certs needs your global API key which is the keys-to-the-kingdom...so be careful.

Re: Let’s Encrypt to transition to ISRG root

#12

Post by regecks » Wed, Apr 17, 2019, 6:40 AM UTC

viraptor wrote: post #4

They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.

On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks.

To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017).

On iOS, it was first added in iOS 10 (2016).

The root itself was created in June 2015.

Edit: they also have a list on their website - https://letsencrypt.org/docs/certificate-compatibility/#know... . It lists Android < 2.3.6 as being incompatible .. I wonder if that's updated for the non-cross-signed intermediates.

Re: Let’s Encrypt to transition to ISRG root

#13

Post by zaarn » Wed, Apr 17, 2019, 6:43 AM UTC

founderling wrote: post #5

Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.

It's not that hard, I've written a fairly short bash script that automatically issues all of the wildcard certs I use with the correct credentials (and switches to normal HTTP verification when a wildcard isn't requested).

Re: Let’s Encrypt to transition to ISRG root

#14

Post by josteink » Wed, Apr 17, 2019, 6:44 AM UTC

xref wrote: post #11

josteink wrote: post #8

Earlier quoted context omitted.

It’s easy if you have a DNS provider for which there is a DNS-auth module. This was one of the reasons for me switching to Cloudflare DNS, although many other providers should work too.

Unfortunately CloudFlare doesn’t provide limited-scope API keys so every server requesting certs needs your global API key which is the keys-to-the-kingdom...so be careful.

I actually have the reverse model: requesting certs is done by its own isolated and dedicated container and scp’d to the server which needs it.

Compromising a web-server will thus not compromise my DNS.

Re: Let’s Encrypt to transition to ISRG root

#15

Post by regecks » Wed, Apr 17, 2019, 6:46 AM UTC

xref wrote: post #11

josteink wrote: post #8

Earlier quoted context omitted.

It’s easy if you have a DNS provider for which there is a DNS-auth module. This was one of the reasons for me switching to Cloudflare DNS, although many other providers should work too.

Unfortunately CloudFlare doesn’t provide limited-scope API keys so every server requesting certs needs your global API key which is the keys-to-the-kingdom...so be careful.

You can also CNAME your _acme-challenge record to another zone and perform the updates on the target zone, avoiding overprivileging your webserver.

https://github.com/joohoi/acme-dns is a server implementation of that, and a number of popular clients support it. Or if you don't want to run acme-dns, some ACME clients support an "alias" mode that essentially does the same thing using generic DNS CNAMEing.

Annoyed that Route53 IAM still doesn't let you limit the record label ...

Re: Let’s Encrypt to transition to ISRG root

#16

Post by gpvos » Wed, Apr 17, 2019, 6:47 AM UTC

p4bl0 wrote: post #6

viraptor wrote: post #4

They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?

That site should have some text on it like "If you did not get any errors or warnings while opening this web page, your computer or device knows about the ISRG root certificate and Let's Encrypt will continue to work for you." Currently, this isn't immediately clear to (relative) laypeople like me.

Re: Let’s Encrypt to transition to ISRG root

#17

Post by dspillett » Wed, Apr 17, 2019, 6:48 AM UTC

xref wrote: post #11

josteink wrote: post #8

Earlier quoted context omitted.

It’s easy if you have a DNS provider for which there is a DNS-auth module. This was one of the reasons for me switching to Cloudflare DNS, although many other providers should work too.

Unfortunately CloudFlare doesn’t provide limited-scope API keys so every server requesting certs needs your global API key which is the keys-to-the-kingdom...so be careful.

No need for individual servers, let alone public ones, to have your DNS API key.

Have a separate machine that isn't publicly addressable generate the keys and request the certificates, and then push them out to where they need to be. You don't even need to give that box privileged access to the places the certificates need to be, if you arrange things right. Only one box then needs your API key.

Re: Let’s Encrypt to transition to ISRG root

#18

Post by xref » Wed, Apr 17, 2019, 6:54 AM UTC

josteink wrote: post #14

xref wrote: post #11

Earlier quoted context omitted.

Unfortunately CloudFlare doesn’t provide limited-scope API keys so every server requesting certs needs your global API key which is the keys-to-the-kingdom...so be careful.

I actually have the reverse model: requesting certs is done by its own isolated and dedicated container and scp’d to the server which needs it. Compromising a web-server will thus not compromise my DNS.

I like the sound of this idea, happen to have a Dockerfile/scripts for it on GitHub?

Re: Let’s Encrypt to transition to ISRG root

#19

Post by emj » Wed, Apr 17, 2019, 6:58 AM UTC

regecks wrote: post #12

viraptor wrote: post #4

They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.

On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks. To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017). On iOS, it was first added in iOS 10 (2016).…

I was eating breakfast with a multitude of Android phones around me and four "older ones" could not access that site. The oldest that could connect was ~5 months old, all using new Mobile Chrome versions.

Re: Let’s Encrypt to transition to ISRG root

#20

Post by sihoang » Wed, Apr 17, 2019, 6:59 AM UTC

nimbius wrote: post #2

ISRG stands for Internet Security Research Group.

This is in their latest blog post "Christine expands our board’s global perspective with her career experience. She worked for many years in the Australian government"

I was wondering what impact if she, a board member of ISRG, has to comply with the Australian encryption laws?