161–166 of 166 posts
What are reasons to use a certificate for an IP? Why wouldn't you use a name? Someone already mentioned that it's needed for Discovery of Designated Resolvers (DDR) for DNS-over-HTTPS. Anything else?
Names cost cash; maybe you don't need/want one.
I can't remember if one or both are in the mozilla list of public domain prefixes though.
Earlier quoted context omitted.
> They're committed to breaking it further despite still virtually zero benefit from constantly making the Internet more fragile. I think that shorter cert lifetimes and the push for more automation is a valid direction to look in and work towards. But at the same time that means that there's a certain skill floor and also certain tech that you need to have in place to be able to work with all of that. Back in the da…
So first and foremost, nearly every enterprise organization is still shifting a few files every 11 months thanks to the CAB. This isn't the past, it's the present. Second, I think the statistic is that 81% of businesses have had an outage due to certificate expiry. So you need to understand that making certs expire more is inherently damaging . Automation breaks so even automated shorter-lifetime certificates will st…
Uh, no. Most of the outage due to certificate expiry is not caused by subtly broken automation. It's caused by non-existent automation or outright broken (never gonna work) automation.
So, if you make certificates expire in 6 days, you are not going to have these outages. They will be caught during develop.
People just pretend it's okay and forget about 1 year certs. With 6 days cert it would be impossible to pretend it's okay to shift a few files manually. Or maybe some organizations will setup a human-run rotation which actually does shifting a few files every 3 days, that's totally okay. You don't need automation. You just need a way to consistently make sure your certificate won't expire in prod (and in emergency, able to quickly replace a cert).
Certificates with 1 year expiry is nothing but a dangerous footgun. It's worse than 30 years expiry, at least with 30 years expiry you don't get outages.
What are reasons to use a certificate for an IP? Why wouldn't you use a name? Someone already mentioned that it's needed for Discovery of Designated Resolvers (DDR) for DNS-over-HTTPS. Anything else?
If you need https, but whatever device you want to serve to doesn't let you use hostnames.
Earlier quoted context omitted.
To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…
Speaking of the topic of automation, does anyone know of a domain registry that is suitable for issuing Let's Encrypt certificates for a machine behind a firewall (which requires using the DNS challenge)? I currently use Namecheap, but they started requiring you to manually whitelist the client IP address to use their API, which is annoying when your residential ISP changes your IP address. Edit: seems like using Clo…
Earlier quoted context omitted.
That just proves you have a way to manipulate DNS. Doesn’t prove you own the thing the IP routes to.
I mean that applies to DNS authentication for non-IP certificates, too
Right, but "show me you own foo.com" is a pretty reasonable bar to clear for issuing a certificate with a CN of "foo.com".
Show me you own `1.1.1.1` by manipulating the DNS for "foo.com" is ... not quite the same.
Earlier quoted context omitted.
I mean that applies to DNS authentication for non-IP certificates, too
> I mean that applies to DNS authentication for non-IP certificates, too Right, but "show me you own foo.com" is a pretty reasonable bar to clear for issuing a certificate with a CN of "foo.com". Show me you own `1.1.1.1` by manipulating the DNS for "foo.com" is ... not quite the same.