Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS-Persist-01: A New Model for DNS-Based Challenge Validation

letsencrypt.org

Post reply on HN
Print view View original

101–110 of 164 posts

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#101

Post by tptacek »

cyberax wrote: post #100
tptacek wrote: post #84

Earlier quoted context omitted.

I don't really understand most of this comment but you opened up this subthread with "Come on. It's not dangerous", and, as you're acknowledging here, it clearly is quite dangerous.

DNSSEC is not dangerous. Pretty much the worst thing is breakage, not an accidental compromise. It's also more secure, compared to ACME. An on-path attacker can impersonate the site operator and get credentials. DNSSEC is immune to that.

This is a very strange definition of "dangerous".

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#102

Post by eichin »

9dev wrote: post #57
itintheory wrote: post #36

I'm really excited for this. We moved 120+ hand renewed certs to ACME, but still manually validate the domains annually. Many of them are on private/internal load balancers (no HTTP-01 challenge possible), and our DNS host doesn't support automation (no DNS-01 challenges either). While manually renewing the DCV for ~30 domains once a year isn't too bad, when the lifetime of that validity shrinks, ultimately to 9 days…

For the love of god, switch to a DNS provider with an API. Whatever legacy behemoth you’re working with doesn’t justify a gap this wide.

What open source DNS servers have an API? (I saw someone elsewhere in the thread talking about doing this with dnsmasq, but it sounded like they'd cobbled something together, rather than the software handling it.)

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#103

Post by amluto »

toast0 wrote: post #76
amluto wrote: post #65

Earlier quoted context omitted.

Name one that doesn’t have an AWS-style per-query cost. (There might well be a nice one, but I haven’t found it yet.)

If it's for a business, I would contact them to see if they have a commercial offering, but I think the Hurricane Electric Free DNS might actually fit. https://dns.he.net/

Interestingly, HE’s commercial offerings are in some respects excellent, but their login system is every bit as primitive as the free stuff.

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#104

Post by tkel »

IgorPartola wrote: post #72

Am I just stupidly missing something or does this in theory allow anyone who controls a DNS server for my domain or anyone who controls traffic between LE and the DNS server for my domain to get a TLS certificate they can use to impersonate my domain? I suppose the same is true for DNS-01 but this would make it even easier because the attacker can just put up their LE account instead of mine into the DNS response and…

That's the approach that DANE takes

https://www.sidn.nl/en/modern-internet-standards/e-mail-secu...

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#105

Post by tripdout »

For local services, I don't see the benefit of using DNS challenges and a Let's Encrypt certificate over running my own CA and generating my own certificates. It's not that much work to trust my root certificate on each device, and then I don't need an internet connection to verify local service certificates.

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#106

Post by skinner927 »

eichin wrote: post #102
9dev wrote: post #57

Earlier quoted context omitted.

For the love of god, switch to a DNS provider with an API. Whatever legacy behemoth you’re working with doesn’t justify a gap this wide.

What open source DNS servers have an API? (I saw someone elsewhere in the thread talking about doing this with dnsmasq, but it sounded like they'd cobbled something together, rather than the software handling it.)

BIND 9, for starters

https://datatracker.ietf.org/doc/html/rfc2136

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#107

Post by sebiw »

tripdout wrote: post #105

For local services, I don't see the benefit of using DNS challenges and a Let's Encrypt certificate over running my own CA and generating my own certificates. It's not that much work to trust my root certificate on each device, and then I don't need an internet connection to verify local service certificates.

> It's not that much work to trust my root certificate on each device

Sure, but is trusting your homebrewed CA on all your devices for essentially everything really a good idea?

When your homebrewed CA somehow gets compromised, all your devices are effectively compromised and not only for local connections, but everything that uses PKIX.

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#109

Post by NewJazz »

sebiw wrote: post #107
tripdout wrote: post #105

For local services, I don't see the benefit of using DNS challenges and a Let's Encrypt certificate over running my own CA and generating my own certificates. It's not that much work to trust my root certificate on each device, and then I don't need an internet connection to verify local service certificates.

> It's not that much work to trust my root certificate on each device Sure, but is trusting your homebrewed CA on all your devices for essentially everything really a good idea? When your homebrewed CA somehow gets compromised, all your devices are effectively compromised and not only for local connections, but everything that uses PKIX.

Name constraints

https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...

Re: DNS-Persist-01: A New Model for DNS-Based Challenge Validation

#110

Post by cyberax »

tptacek wrote: post #101
cyberax wrote: post #100

Earlier quoted context omitted.

DNSSEC is not dangerous. Pretty much the worst thing is breakage, not an accidental compromise. It's also more secure, compared to ACME. An on-path attacker can impersonate the site operator and get credentials. DNSSEC is immune to that.

This is a very strange definition of "dangerous".

I'm mostly thinking about dangerous from the security point of view. I agree that it might not be the best from the operational point of view. DNSSEC in its current state makes DNS updates even more risky than they are, I agree with that.
Post reply on HN