Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Six day and IP address certificate options in 2025

letsencrypt.org

Post reply on HN
Print view View original

121–130 of 166 posts

Re: Six day and IP address certificate options in 2025

#121

Post by memset »

ryandrake wrote: post #37
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

I’ve been working on a different way to automate. Basically a script that does the renewal and then knows how to install to any destination.

https://github.com/poundifdef/certmaster

Re: Six day and IP address certificate options in 2025

#122

Post by ocdtrekkie »

likeabatterycar wrote: post #56
rfoo wrote: post #39

Earlier quoted context omitted.

... which means automation was not setup correctly and 90 days is still too long that you just tolerated it. If it was 6 days after a few turns you would have decided "fuck it I'm going to spend time fixing it once and for all".

These are the attitudes we get when we have a WebPKI cabal drunk on power.

Unsurprisingly the 100% true comment in here is gray: PKI is breaking the Internet and because the PKI folks have literally no guardrails of any kind, they're committed to breaking it further despite still virtually zero benefit from constantly making the Internet more fragile.

But hey, there's an upside: When they finally break this toy badly enough, everyone will finally evict the CAB from their lives and do something else.

Re: Six day and IP address certificate options in 2025

#123

Post by ranger207 »

What's the end goal here? A new cert per connection? I think if, hypothetically, that were the case, where Let's Encrypt validates the domain owner on every connection, then that'd move the attack surface from trying to get private cert keys to... other attacks, in general. Is there reason to believe that "other attacks" are less likely? Have there been many cases of should-have-been-revoked certs being used improperly?

Re: Six day and IP address certificate options in 2025

#124

Post by supriyo-biswas »

ryandrake wrote: post #37
rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

You could also terminate TLS or implement HTTPS with Caddy, which will auto-renew your certs for you.

Re: Six day and IP address certificate options in 2025

#125

Post by snailmailman »

captn3m0 wrote: post #6

I remember being surprised when Cloudflare launched https://1.1.1.1 with a valid cert and I immediately wanted one, but couldn’t find an easy way to get one. I am gonna try to run a DoH resolver on this and see how it goes.

I’m really glad they have a page on that IP. I use it decently often for “is the problem DNS?” troubleshooting.

Because if zero pages load, but that one does, the issue is DNS.

Ping is easy too of course, but I can ask people to type four ones with periods between into their search bar over the phone. No command line required.

Re: Six day and IP address certificate options in 2025

#126

Post by Crosseye_Jack »

ape4 wrote: post #26
Crosseye_Jack wrote: post #22

Earlier quoted context omitted.

Because your are redirected to one.one.one.one via the location header and 301 status code from the ip address. http://1.1.1.1 redirects to https://1.1.1.1 which then redirects to https://one.one.one.one but the TLS cert on https://1.1.1.1 (or https://[2606:4700:4700::1111] on ipv6) is still valid for the ipaddress otherwise your browser would put up a warning during the tls handshake.

Its too bad it does the last redirect.

They didn’t used to. Guess they wanted to show off their shiny one.one domain.

Also (and just speculating here), it could be they wanted to get away from promoting https://1.1.1.1 because of legacy spam filtering. But that’s just me thinking out loud as to why they would prefer the domain over the ip

Re: Six day and IP address certificate options in 2025

#127

Post by KronisLV »

rickette wrote: post #17

Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

> Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.

Surely there are tradeoffs in having to rotate the certs that often, right? Notably, considerable load on their infrastructure. I get that urging people to automate their renewals makes sense (though I've also heard people unironically saying: "I want it to be a manual process, so I know how it works instead of relying on some black box"), but it seems that shorter and shorter cert lifetimes might put more strain on a service that nigh everyone seems to just be using for free.

Edit: at least there are a lot of prominent companies here https://letsencrypt.org/sponsors/

Re: Six day and IP address certificate options in 2025

#128

Post by KronisLV »

supriyo-biswas wrote: post #124
ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

You could also terminate TLS or implement HTTPS with Caddy, which will auto-renew your certs for you.

Curiously, even Apache2 has functionality in the form of mod_md: https://httpd.apache.org/docs/2.4/mod/mod_md.html

Not as advanced as in Caddy (which will be a more pleasant option to use in many cases), but it's curious to see them adding something like that! Makes me wonder whether we'll also get some Nginx functionality like that out of the box sometime so certbot won't have to always be installed alongside it for sites that need to use ACME.

Re: Six day and IP address certificate options in 2025

#129

Post by 5d41402abc4b »

tasuki wrote: post #85
ryandrake wrote: post #37

Earlier quoted context omitted.

To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…

> To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I also have hobby-level serving needs. I've been using LetsEncrypt since whenever it was they started. I have two top level domains and a whole lot of subdomains. I've never had to babysit certificate renewal, nor had to log in manually to fix anything. Not once. How comes?

If your server is not accessible from the internet you need to use DNS based authentication for which you need to have a DNS API key lying around on your server which is a significant risk.

Re: Six day and IP address certificate options in 2025

#130

Post by KronisLV »

ocdtrekkie wrote: post #122
likeabatterycar wrote: post #56

Earlier quoted context omitted.

These are the attitudes we get when we have a WebPKI cabal drunk on power.

Unsurprisingly the 100% true comment in here is gray: PKI is breaking the Internet and because the PKI folks have literally no guardrails of any kind, they're committed to breaking it further despite still virtually zero benefit from constantly making the Internet more fragile . But hey, there's an upside: When they finally break this toy badly enough, everyone will finally evict the CAB from their lives and do somet…

> They're committed to breaking it further despite still virtually zero benefit from constantly making the Internet more fragile.

I think that shorter cert lifetimes and the push for more automation is a valid direction to look in and work towards. But at the same time that means that there's a certain skill floor and also certain tech that you need to have in place to be able to work with all of that.

Back in the day, you'd just have someone sit down once in a year, move a few files around your server and call it a day. With the current trends, that won't really be possible, at least not for any of the certs that you can get for free.

For my public facing stuff, I just bit the bullet and went through with the automation (certbot is nice, mod_md is okay, Caddy is great), but for my personal stuff I settled on running my own CA and self-signing stuff. If I want a 10 year cert expiry for something that I don't really care that much about, I'll go ahead and do that because I'm in control. The server itself is unlikely to survive for long anyways and other development stuff is more likely to break first, so I'd rather spend my time there, rather than on automation that I don't need. Plus, mTLS is suddenly easy to do as an added security layer if I ever need to expose something to-the-outside-but-actually-just-for-myself-when-on-the-move.

Post reply on HN