Related from before:
Why I still have an old-school cert on my HTTPS site - https://news.ycombinator.com/item?id=34242028 - Jan 2023 (63 comments)
Why I no longer have an old-school cert on my HTTPS site
121–130 of 437 posts
Re: Why I no longer have an old-school cert on my HTTPS site
#122If you want to actually implement an ACME client from first principles, reading the RFC (plus related RFCs for JOSE etc) is probably easier than you think. I did exactly that when I made a client for myself.
I also wrote up a digested description of the issuance flow here: https://www.arnavion.dev/blog/2019-06-01-how-does-acme-v2-wo... It's not a replacement for reading the RFCs, but it presents the information in the sequence that you would follow for issuance, so think of it like an index to the RFC sections.
Re: Why I no longer have an old-school cert on my HTTPS site
#123> So, yes, instead of saying that "e" equals "65537", you're saying that "e" equals "AQAB". Aren't you glad you did those extra steps? Oh JSON. For those unfamiliar with the reason here, it’s that JSON parsers cannot be relied upon to treat numbers properly. Is 4723476276172647362476274672164762476438 a valid JSON number? Yes, of course it is. What will a JSON parser due with it? Silently truncate it to a 64-bit or 6…
“Worse is better” is still having ravaging success.
Re: Why I no longer have an old-school cert on my HTTPS site
#124Earlier quoted context omitted.
Im not a container guru by any means (at least not yet?) but would docker not suffice these concerns?
The issue is that the client needs to access the private key, tell web server where various temporary files are during the certificate generation (unless the client uses DNS mode) and tell the web server about a new certificate to reload. To implement that many clients run as a root. Even if that root is in a docket container, this is needlessly elevated privileges especially given the complexity (again, needless) of…
Apache comes with built-in ACME support. Just enable the mod_md module:
https://httpd.apache.org/docs/2.4/mod/mod_md.html
Re: Why I no longer have an old-school cert on my HTTPS site
#125Earlier quoted context omitted.
Given her experience and work history, it's much more likely that she views any text-based protocol as an unnecessary abstraction over simply processing raw TCP.
Is this a joke? I don't even know where to begin with this comment... It reads like a joke, but I suspect it's not? TCP is just a bunch of bytes... You can't process a bunch of bytes without understanding what they are, and that requires signaling information at a different level (ex - in the bytes themselves as a defined protocol like SSH, SCP, HTTP, etc - or some other pre-shared information between server and clie…
> or some other pre-shared information between server and client [the worst of protocols - custom bullshit])
Why is this worse than JSON?
"{'protected': {'protected': { 'protected': 'QABE' }}}" is just as custom as 66537 imo. It's easier to reverse engineer than 66537 but that's not less custom.
Re: Why I no longer have an old-school cert on my HTTPS site
#126> So, yes, instead of saying that "e" equals "65537", you're saying that "e" equals "AQAB". Aren't you glad you did those extra steps? Oh JSON. For those unfamiliar with the reason here, it’s that JSON parsers cannot be relied upon to treat numbers properly. Is 4723476276172647362476274672164762476438 a valid JSON number? Yes, of course it is. What will a JSON parser due with it? Silently truncate it to a 64-bit or 6…
What I don't understand is why you (and a lot of other people) just expect S-expression parsers to not have the exact same problems.
Re: Why I no longer have an old-school cert on my HTTPS site
#127At some stage you need to update your TXT records, and if you register a wildcard domain you have to do it twice for the same request! And you have to propagate these TXT records twice to all your DNS servers, and wait for some third party like google dns to request the TXT record. And it all has to be done within a minute in order to not time out. DNS servers are not made to change records from one second to another…
Fortunately that’s only needed if you’re using the DNS validation method — necessary if you’re getting wildcards (but…eek, wildcards). For HTTP-01, no DNS changes are needed unless you want to add CAA records to block out other CAs.
Wildcard Certificates are your friend if you don't want all of your hostnames becoming public knowledge.
Re: Why I no longer have an old-school cert on my HTTPS site
#128Devs need to be sysadmins also.
Re: Why I no longer have an old-school cert on my HTTPS site
#129tangentially, for anyone looking to make their lives easier, you can run `acme-dns` on a spared 53/udp somewhere, CNAME the _acme_challenge. from your real DNS hosting to that, then have `lego` or whatever do DNS challenges via acme-dns - no need to let inscrutable scripts touch your real DNS config, no need for anything to touch your HTTP config.
I wish DNS providers offered more granular access control. Some offer an API key per zone, others have a single key which grants access to every single zone in your account. I haven't come across any that offer "acme-only" APIs.
It's on my long list of potential side projects, but I don't think I'll ever gey around to it
Re: Why I no longer have an old-school cert on my HTTPS site
#130Earlier quoted context omitted.
Some people don't want to be forced to run a bunch of stuff they don't understand on the server, and I agree with them. Sadly, security is a cat and mouse game, which means it's always evolving and you're forced to keep up - and it's inherent by the nature of the field, so we can't really blame anyone (unlike, say, being forced to integrate with the latest Google services to be allowed on the Play Store). At least yo…
> Some people don't want to be forced to run a bunch of stuff they > don't understand on the server, and I agree with them. Honest question: * Do you understand OS syscalls in detail? * Do you understand how your BIOS initializes your hardware? * Do you understand how modern filesystems work? * Do you understand the finer details of HTTP or TCP? Because... I don't. But I know enough about them that I'm quite convince…
I get where you’re going with this, but in this particular case it might not be relevant because there’s a decent chance that Rachel By The Bay does actually understand all those things.