Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

131–140 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#131

Post by blibble »

halifaxbeard wrote: post #117
midtake wrote: post #101

Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!

> 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout There’s your answer. 6 days means on a long enough enough timeframe the load will end up evenly distributed across a week. 8 days would result in things getting hammered on specific days of the week.

so now people that want humans around will now renew twice in a week instead of once?

Re: 6-Day and IP Address Certificates Are Generally Available

#132

Post by iso1631 »

bflesch wrote: post #100
mholt wrote: post #82

Earlier quoted context omitted.

They are not in control of the US president.

I'm pretty sure that the .org TLD can be shut off by the US at any point in time.

Lets Encrypt do not control the US president.

You could argue that The Don in charge of the US is in control of letsencrypt

Re: 6-Day and IP Address Certificates Are Generally Available

#133

Post by PunchyHamster »

cryptonector wrote: post #66

I wonder if transport mode IPsec can be relevant again if we're going to have IP address certificates. Ditto RFC 5660 (which -full disclosure- I authored).

IPSec is terrible, huge, and messy standard that company that made it took 20 years to stop getting CVE every year

Re: 6-Day and IP Address Certificates Are Generally Available

#134

Post by PunchyHamster »

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

What worries me more about the push for shorter and shorter cert terms instead of making revoking that works is that if provider fails now you have very little time to switch to new one

Re: 6-Day and IP Address Certificates Are Generally Available

#135

Post by fuomag9 »

rsync wrote: post #93

IP address certificates are particularly interesting for iOS users who want to run their own DoH servers. A properly configured DoH server (perhaps running unbound) with a properly constructed configuration profile which included a DoH FQDN with a proper certificate would not work in iOS. The reason, it turns out, is that iOS insisted that both the FQDN and the IP have proper certificates. This is why the configurati…

I use DoH behind a reverse proxy with my own domain daily without any kind of issue

Re: 6-Day and IP Address Certificates Are Generally Available

#136

Post by PunchyHamster »

londons_explore wrote: post #74
wang_li wrote: post #70

Earlier quoted context omitted.

My browser on my work laptop has 219 root certificates trusted. Some of those may be installed from my employer, but I suspect most of them come from MS as it's Edge on Windows 11. I see in that list things like "Swedish Government Root Authority" "Thailand National Root Certification Authority" "Staat der Nederlanden Root CA" and things like "MULTICERT Root Certification Authority" "ACCVRAUZ1". I don't think there i…

Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. Obviously you might still be victim #1 of such a scheme... But in general the CA's now aren't really trusted anymore - the real root of trust is the CT logs.

> Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked.

the ENTIRE reason the short lifetime is used for the LE certs is that they haven't figured out how to make revoking work at scale.

Now if you're on latest browser you might be fine but any and every embedded device have their root CAs updated only on software update, which means compromise of CA might easily get access to hundreds of thousands devices.

Re: 6-Day and IP Address Certificates Are Generally Available

#137

Post by hypeatei »

rsync wrote: post #93

IP address certificates are particularly interesting for iOS users who want to run their own DoH servers. A properly configured DoH server (perhaps running unbound) with a properly constructed configuration profile which included a DoH FQDN with a proper certificate would not work in iOS. The reason, it turns out, is that iOS insisted that both the FQDN and the IP have proper certificates. This is why the configurati…

OpenSSL is quite particular about the IP address being included in the SAN field of the cert when making a TLS connection, fwiw. iOS engineers may not have explicitly added this requirement and it might just be a side effect of using a crypto library.

Re: 6-Day and IP Address Certificates Are Generally Available

#138

Post by iso1631 »

cpach wrote: post #102
bflesch wrote: post #76

Earlier quoted context omitted.

Makes sense. I assume each of them is in control and at the whims of US president?

It seems that currently most free CAs have a big presence in the US, and employ quite a few US employees. ZeroSSL/HID Global seems to be quite multi-national though, and it’s owned by a Swedish company (Assa Abloy). I don’t know what what kind of mitigations these orgs have in place if the shit really hits the fan in the US. It’s an interesting question for sure.

Fundamentally, Microsoft, Google and Apple are all run by American citizens living in America. Firefox is pretty much the same.

The US has strong institutions which prevent the President or Government at large controlling these on a whim. If those institutions fail then they could all push out an update which removes all "top of chain" trusted certificate authorities other than ones approved by the US government.

In that situation the internet is basically finished as it stands now, and the OSes would be non-trustworthy anyway.

Fixing the SSL problems is the easy part, the free world would push its own root certificate out -- which people would have to manually install from a trusted source, but that's nothing compared to the real problem.

Sure, Ubuntu, Suse etc aren't based in the US, but the number of phones without a US based OS is basically zero, you'd have to start from scratch with a forked version of android which likely has NSA approved backdoors in it anyway. Non-linux based machines would also need to be wiped.

Re: 6-Day and IP Address Certificates Are Generally Available

#139

Post by jsheard »

PunchyHamster wrote: post #134
qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

What worries me more about the push for shorter and shorter cert terms instead of making revoking that works is that if provider fails now you have very little time to switch to new one

Some ACME clients can failover to another provider automatically if the primary one doesn't work, so you wouldn't necessarily need manual intervention on short notice as long as you have the foresight to set up a secondary provider.

Re: 6-Day and IP Address Certificates Are Generally Available

#140

Post by cpach »

PunchyHamster wrote: post #134
qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

What worries me more about the push for shorter and shorter cert terms instead of making revoking that works is that if provider fails now you have very little time to switch to new one

People have tried. Revocation is a very hard problem to solve on this scale.
Post reply on HN