Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

111–120 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#111

Post by tptacek »

altfredd wrote: post #36
floatingatoll wrote: post #4

This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing…

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

Good!

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#112

Post by secabeen »

paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#113

Post by tptacek »

brnt wrote: post #45
altfredd wrote: post #36

Earlier quoted context omitted.

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

Will browsers start allowing self signed certificates though?

Self-signed certificates are insecure, so, no.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#114

Post by certera »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Check out Certera https://docs.certera.io

It's PKI for Let's Encrypt certificates. Helps you issue, renew, revoke certs from a central place. Also get alerts so you know when things have changed, expired, failed to renew.

While a lot of places give you certs built in, there's a whole world of places you still need certs. Like FTP, mail, behind load balancers, disparate environments and systems, etc.

In the future, I'm planning on creating a way to automate the certificate exchange process. This should help with using and exchanging certs used in client authentication and things like SAML SSO. If expiration get down to a month or less, I see a need for a system to help do all of these things and more.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#115

Post by MikeHardman »

xg15 wrote: post #103
dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

This won't work either, btw: You'd have to request from Let's Encrypt a new certificate for each individual device . LE has several rate limits that will prevent that from working for anything more than a trivial number of devices: https://letsencrypt.org/docs/rate-limits/ The only way I see how this would work is if you not just purchase a domain but also an internet-facing server and do the renewal and certificate…

You can do wildcard certs with LE, I run hundreds of k8s services all secured with LE and wildcard certs.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#116

Post by lawnchair_larry »

mschuster91 wrote: post #75
cm2187 wrote: post #49

Earlier quoted context omitted.

A couple of lines of code to enforce domain black lists if the relevant activits apply enough pressure.

Why should anyone do this? It's way easier and more effective to put pressure on hosters, anti-DDOS services and the payment providers to get Nazis booted off the net, see e.g. Stormfront.

Nobody is talking about Nazis. And all of those things are not easier, especially if the site is self-hosted. His point is that it’s one more gatekeeper and point of failure. It doesn’t matter that there are existing means to target websites. Adding another makes freedom even more fragile.

It’s very naive to assume that censorship is only a problem for Nazis that the world shouldn’t listen to anyway.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#117

Post by stefan_ »

secabeen wrote: post #112
paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.

Why as a vendor would you use a self-signed certificate that causes the browser to scream at the customer when you could just not use TLS, plain old HTTP.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#118

Post by slenk »

lawnchair_larry wrote: post #84
dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

This is a ridiculous requirement that is not at all practical.

How is it not practical? It's really not hard to set up and there is great documentation out there

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#119

Post by lawnchair_larry »

joobus wrote: post #25

I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you.

Seeing how hard this comment is being downvoted somewhat illustrates your point. I don’t see how anything you just said is controversial or offtopic.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#120

Post by superkuh »

wolf550e wrote: post #10
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a catch that prevents it from working.
Post reply on HN