Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

101–110 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#101

Post by p2t2p »

xg15 wrote: post #87
dharmab wrote: post #67

Earlier quoted context omitted.

Run your own CA internally and handle the CA distribution problem with MDM tools.

I admit, that's a solution, even if a very unpleasant one: Installing a custom root CA is intentionally complicated, so this is hardly doable as an onboarding experience. The setup must be repreated for every single client device that should access the server. There remains the question how I would get the CA certificate onto client devices in the first place. Lastly, with asking consumers to install a CA certificate…

It is no more complicated than a self signed certificate. Two clicks in Firefox, 4 taps in iOS

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#102

Post by jt2190 »

xg15 wrote: post #66
dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

Without buying a domain. (and continously spending money to keep it owned)

There’s always the .local TLD, which is reserved for this use case:

https://en.m.wikipedia.org/wiki/.local

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#103

Post by xg15 »

dharmab wrote: post #65
paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

This won't work either, btw: You'd have to request from Let's Encrypt a new certificate for each individual device. LE has several rate limits that will prevent that from working for anything more than a trivial number of devices: https://letsencrypt.org/docs/rate-limits/

The only way I see how this would work is if you not just purchase a domain but also an internet-facing server and do the renewal and certificate management centrally for all devices - at which point, your device is definitly not standalone anymore.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#104

Post by cutler »

maxmalysh wrote: post #27

I don't like seeing how the SSL hurdle affects small read-only websites.

Agreed. Talk about sledgehammer to crack a nut. Typical sysadmin solution to a problem assuming every Joe Blogger is going to setup his own VPS and fsck with certbot.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#105

Post by xg15 »

p2t2p wrote: post #97
xg15 wrote: post #83

Earlier quoted context omitted.

Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed. The device will also only be accessible if an internet connection is present, even if both the device and the client are in the…

> Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. That’s not true at all. I’ve created a CA and a script to generate and sign server certificates and I generated them left right and centre now for my very standalone, local network only with no access to the internet whatsoever services. I added my CA to my browsers and my iPhone and everything works perfectly.

Will you also add it to the iPhones of other people that would want to use the device? (Or more realistically, would they let you add it?)

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#106

Post by lawnchair_larry »

zozbot234 wrote: post #7
chucky_z wrote: post #3

I’m so torn here. Personally I like this a lot and think it will really help enforce good practices and allow easier things like root/int key rotation. Professionally it sucks, as there are a ton of valid use cases for real certs in areas that require manual work and tracking them all is a hard problem. If internal PKIs were easier to make work across all OS and Browser combos I’d just use those instead.

TOFU is a viable alternative for "long-living" certs, too. The very fact that the cert has longer validity makes it somewhat easier to trust it directly in the client.

TOFU doesn’t actually work. If you set up a TOFU cert environment, 100% of non-security people will click right through it, and 95% of security people will also click right through it.

They’ll just assume that because it was untrusted the first time, that cert errors are normal and ignore it. Especially since they will have a “first use” for every new device and every new browser they visit with.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#108

Post by gsich »

geerlingguy wrote: post #99
gsich wrote: post #93

Earlier quoted context omitted.

You can also run your own CA.

> This is a ridiculous requirement that is not at all practical.

For a company? Absolutely not. In private? Probably not worth the effort, just skip the cert warning.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#109

Post by xg15 »

jt2190 wrote: post #102
xg15 wrote: post #66

Earlier quoted context omitted.

Without buying a domain. (and continously spending money to keep it owned)

There’s always the .local TLD, which is reserved for this use case: https://en.m.wikipedia.org/wiki/.local

I haven't heard about that yet. this sounds interesting indeed. But how would I get a valid certificate for a .local domain?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#110

Post by gsich »

xg15 wrote: post #105
p2t2p wrote: post #97

Earlier quoted context omitted.

> Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. That’s not true at all. I’ve created a CA and a script to generate and sign server certificates and I generated them left right and centre now for my very standalone, local network only with no access to the internet whatsoever services. I added my CA to my browsers and my iPhone and everything works perfectly.

Will you also add it to the iPhones of other people that would want to use the device? (Or more realistically, would they let you add it?)

Depends on them I guess. If it's a corporate phone then it's no problem. The rest can either add it or get used to cert warnings.
Post reply on HN