Chromium and Mozilla to enforce 1 year validity for TLS certificates

Post by paledot » Sun, Jun 28, 2020, 5:11 PM UTC

elcritch wrote: post #147

paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

It’s a glaring security hole, IMHO. I create such devices and the only way I know is self-signed certs, but the browsers complain a lot about that. Ideally there’d be a way to sign .local domains with browsers handling it while letting people know to verify the identity of their local devices/services and that the identity isn’t verified by https like most sites. The issue lies between the browsers and https system.…

Post by [deleted] » Sun, Jun 28, 2020, 5:12 PM UTC

xg15 wrote: post #103

dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

This won't work either, btw: You'd have to request from Let's Encrypt a new certificate for each individual device . LE has several rate limits that will prevent that from working for anything more than a trivial number of devices: https://letsencrypt.org/docs/rate-limits/ The only way I see how this would work is if you not just purchase a domain but also an internet-facing server and do the renewal and certificate…

Post by patmorgan23 » Sun, Jun 28, 2020, 5:14 PM UTC

sschueller wrote: post #80

mschuster91 wrote: post #70

Earlier quoted context omitted.

LE is open standard, any CA can decide to implement it.

The only other CA I know that has this service available is https://www.buypass.com/ssl/products/acme

Post by koolba » Sun, Jun 28, 2020, 5:16 PM UTC

hannob wrote: post #146

greatgib wrote: post #136

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…

Yeah those good old times when Comodo was hacked and issued certificates for gmail.com and nobody really cared. Or when some shady CAs sold intermediate certificates in devices so you could man in the middle all your network connections (and everyone else's, too). So bad those times are over and we have this browser cartell enforcing some basic security standards for TLS. Screw them!

Post by tialaramex » Sun, Jun 28, 2020, 5:21 PM UTC

greatgib wrote: post #136

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…