Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Six day and IP address certificate options in 2025

letsencrypt.org

Post reply on HN
Print view View original

101–110 of 166 posts

Re: Six day and IP address certificate options in 2025

#101

Post by xorcist »

ryandrake wrote: post #37
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

I don't know what your issues are, but perhaps the know-it-all people who comments on this with a variation of "you're doing it wrong" or a problem of "not enough automation" could cool down a bit and realize the web PKI is hacks build from hacks and there are many reasons why the public ACME system may not be entirely robust for every application.

On the top of my head, that could be because one or more domains are not accessible from the public Internet (which could be for a variety of reasons), a subset of the subject domains having expired for legitimate reasons but you might not know which in advance (certificates being what they are some application rely on them having alternative names), intermittently flaky routing (which might not be a problem for the application), and a number of other reasons. That's without including potentially hostile actors. Then there are plenty of offline uses for certificates!

That said, Let's Encrypt has really been a revolution and made life better for many people. But it's not perfect and the PKI system itself has many warts. It's absolutely a system that may need a non negligible amount of babysitting when you venture outside the absolute mainstream.

Re: Six day and IP address certificate options in 2025

#102

Post by tptacek »

xorcist wrote: post #101
ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

I don't know what your issues are, but perhaps the know-it-all people who comments on this with a variation of "you're doing it wrong" or a problem of "not enough automation" could cool down a bit and realize the web PKI is hacks build from hacks and there are many reasons why the public ACME system may not be entirely robust for every application. On the top of my head, that could be because one or more domains are…

If you're using LetsEncrypt without automation you're doing it wrong, and the reason that the WebPKI is so hacky is that it was insulated from basic computer science for 2 decades and run by enterprise software companies.

You have to automate certificates. You can't do these by hand anymore. Certificate lifetimes are going to get inexorably shorter.

Re: Six day and IP address certificate options in 2025

#103

Post by mholt »

ghxst wrote: post #77
Rodeoclash wrote: post #72

Earlier quoted context omitted.

Is it possible for you to run Caddy as a reverse proxy in front of your services? I've done this in the past and it really is set and forget when it's configured correctly.

Heard positive things about Caddy before, do you know if it works with ip adresses as well?

It does.

Re: Six day and IP address certificate options in 2025

#104

Post by bolognafairy »

ryandrake wrote: post #37
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

I’ve been using Let’s Encrypt since its release, including for identical-sounding home / hobbyist uses, and have never had these uses.

I’m not saying that our use cases are truly identical, but from what you’ve described, I don’t think that your experience is simply “how things are”.

Re: Six day and IP address certificate options in 2025

#105

Post by bolognafairy »

dingnuts wrote: post #61
jonas21 wrote: post #49

Earlier quoted context omitted.

Or perhaps, "I'm going to give up and switch to gmail once and for all"

there are other email providers, you know. the choices are not "do it all myself" and "be Google's product."

How could the person you’re replying to have reasonably phrased their comment to avoid this snark from you?

I’m 1,000% sure that they know what you’re trying to espouse. Nowhere in the comment does it say “here is an exhaustive list of hosted email providers”. It’s a JOKE.

Re: Six day and IP address certificate options in 2025

#106

Post by bolognafairy »

likeabatterycar wrote: post #56
rfoo wrote: post #39

Earlier quoted context omitted.

... which means automation was not setup correctly and 90 days is still too long that you just tolerated it. If it was 6 days after a few turns you would have decided "fuck it I'm going to spend time fixing it once and for all".

These are the attitudes we get when we have a WebPKI cabal drunk on power.

[flagged]

Re: Six day and IP address certificate options in 2025

#107

Post by tialaramex »

duskwuff wrote: post #40
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

When Let's Encrypt got started in 2014, CAs could issue certificates valid for up to five years - and many did. The CA/Browser Forum has slowly been ratcheting that down.

That (five year certs) was technically true, but the CA/B BRs already told you that was going away in 2015 when Let's Encrypt was started. I don't know how many were still actually selling such a product by the point Let's Encrypt is on the scene.

I think the drop-dead date for this product was like April 2015 or so. The ideal customer for a product like this (lazy and also incompetent but with plenty of money) is also likely to leave it too late. I won't guarantee we'd have caught that, but unlike forbidden steps taken to avert a bigger mess of ones own making (as happened for SHA-1 deprecation, some notable financial outfits secured certs which should not have existed, to cover for the fact they hadn't properly managed their own technical risks) this seems like a product category thing, nobody was openly selling certs that would just break in Chrome, that's a bad product.

[Why would such certificates break in Chrome? Google hate these long lived certs so Chrome treats certificates which have validity exceeding what the BRs authorise as immediately invalid, if you want to moan to Google about why your prohibited certs don't work you're basically admitting you violated your agreement with them so it's like showing up to claim your stolen rucksack full of cocaine from the cops...]

Re: Six day and IP address certificate options in 2025

#108

Post by xorcist »

tptacek wrote: post #102
xorcist wrote: post #101

Earlier quoted context omitted.

I don't know what your issues are, but perhaps the know-it-all people who comments on this with a variation of "you're doing it wrong" or a problem of "not enough automation" could cool down a bit and realize the web PKI is hacks build from hacks and there are many reasons why the public ACME system may not be entirely robust for every application. On the top of my head, that could be because one or more domains are…

If you're using LetsEncrypt without automation you're doing it wrong, and the reason that the WebPKI is so hacky is that it was insulated from basic computer science for 2 decades and run by enterprise software companies. You have to automate certificates. You can't do these by hand anymore. Certificate lifetimes are going to get inexorably shorter.

Not really. PKI has always been that way since before the web. Mainly because the use cases are so varied and it there is the tendency to support every possibility under the sun.

For the longest time the web PKI lacked a singular view on what exactly they were supposed to be signing. Its usage reflects that.

That is deeply rooted in culture. I mean, we do speak about a culture in which X.509 was a reasonable choice. Years after the X.500 universe was cold to the touch at that.

The rest of your comment seems directed at someone else. Framing this on automation is misleading, which is what the examples in my comment were intended to show.

Re: Six day and IP address certificate options in 2025

#109

Post by tialaramex »

TacticalCoder wrote: post #74

Curiosity killed the cat: is it possible to get a valid cert for IPs on private LANs, like for example 192.168.1.42 or 10.0.0.84?

No. The certificates are for a claim that this is your IP, but it's not your IP, it isn't anybody's IP.

Same way you can't get a cert for some.name.in-an-internal-domain-we-use-internally

Re: Six day and IP address certificate options in 2025

#110

Post by lmz »

While we're on the subject of cert lifetimes. Is there a longer lived, public CA-issued cert for TLS client purposes?

I sometimes deal with a relying party that insists on public CA issued certs for TLS client use, and then makes rotation very painful behind a portal with 2FA etc. This would be fine if public CAs issued certs for 5 years but they seem to be limited to 1 year now because of browser policy.

Post reply on HN