Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACME v2 and Wildcard Certificate Support is Live

community.letsencrypt.org

Post reply on HN
Print view View original

171–180 of 321 posts

Re: ACME v2 and Wildcard Certificate Support is Live

#171

Post by josteink »

jakelazaroff wrote: post #166
rospaya wrote: post #157

Earlier quoted context omitted.

My point is that those sites don't need to be any more secure than they are. A hobbyist website written in HTML in Notepad with only text and images that can be run on IE 5.0 might not require HTTPS and Google and others might change that.

I don't get the notion that some sites don't "need" HTTPS. The threat model it protects against isn't only sensitive information being intercepted, it's also man-in-the-middle attacks that actually change what's delivered. Maybe a hobbyist website only has text and images sitting on its server, but the visitor might receive malware — and that can happen to literally any site served over HTTP.

> I don't get the notion that some sites don't "need" HTTPS.

Your failure to grasp this is fairly evident from the rest of your comment.

Re: ACME v2 and Wildcard Certificate Support is Live

#172

Post by [deleted] »

UncleMeat wrote: post #167
eric_b wrote: post #43

Earlier quoted context omitted.

The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren'…

> just want their software to work Your software does not work if it is not secure. Security is a correctness problem.

[deleted]

Re: ACME v2 and Wildcard Certificate Support is Live

#173

Post by josteink »

blibble wrote: post #46
0x0 wrote: post #17

DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)

is it common for DNS hosts to provide delegated access at the granularity of individual records? I don't want my webserver to have the ability to change my entire zonefile just so it can authorise certificates!

If you’re doing DNS-based auth you don’t need to renew the certainly on the web-server at all.

You can generate them on a secure host (or container) which pushes the certs to the machines which needs them.

Re: ACME v2 and Wildcard Certificate Support is Live

#174

Post by merb »

jsmthrowaway wrote: post #76
eric_b wrote: post #65

Earlier quoted context omitted.

But why did it make you so angry? My guess is because my viewpoint is completely unfathomable to you. You can't even believe that someone would advocate for it. In situations like that, I always try and put myself in the shoes of that person. Sometimes they are wrong, and sometimes they have a point. But it's always a useful exercise. To your parent comment - No, I don't think it's a cabal of "grumpy old men" - I thi…

What the gently caress does encrypting an HTTP connection have to do with morals or age? You are way outside the realm of making sense, man, and offer commentary that is openly harmful to securing the Internet. Please step back and revisit your woefully misinformed opinion on this. Most people who advocate for security, including myself, have worked on small teams and understand the resources involved. Putting a TLS…

> Putting a TLS certificate on your shit with LE takes minutes. Doing it through another CA is minutes

if you have one server, yes. else it's the other way around, because if you have multiple servers you need to do a lot of fancy stuff. And LE also does not work in your internal network if you do not have some stuff publicy accessible. And it also does not work against different ports.

Oh and it's extremly hard to have a proxy tls tls server that talks to tls backends, useful behind NAT if you only have one IP, but multiple services behind multiple domains.

IPv6 fixes a lot of these issues.

Re: ACME v2 and Wildcard Certificate Support is Live

#175

Post by keeperofdakeys »

16bytes wrote: post #105
fulafel wrote: post #95

Earlier quoted context omitted.

You could do this before too, without wildcards.

Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.

Instead of fetching the secret via a direct HTTP call, the secret is fetched from the DNS server (eg. _acme-challenge.example.com.) - where the DNS server is usually separate from the server getting the cert. This can be done with ACMEv1 for certs, and now is required for the new wildcard certs.

Most clients that support DNS-01 can use nsupdate or APIs of public DNS providers to make this an automated process.

Re: ACME v2 and Wildcard Certificate Support is Live

#176

Post by e12e »

Jaruzel wrote: post #116
16bytes wrote: post #105

Earlier quoted context omitted.

Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.

For the standard LE certs, you need a public facing web server for the domain name in question, and LE give you a keyfile to put into: '/.well-known/pki-validation' For the wildcard certs, you just need to add a TXT record to the public DNS entry, no public web server required. Even if you have no intention of using your internal DNS domain name on the internet, it's good practice to register it anyway.

You can use a dns challenge for v1 "regular" certs - there's no requirement for a web server, in order to use let's encrypt.

See eg point 4: 0https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert

Re: ACME v2 and Wildcard Certificate Support is Live

#177

Post by jen20 »

pwnna wrote: post #78
mholt wrote: post #49

Earlier quoted context omitted.

> developers who just want their software to work. Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with. > they either don't know or don't care about all the effort and pain they're creating You have not been paying attention to the hundreds of tools available to make HTTPS painless. > until someone at Big G decided they weren't. And Mozilla. And countle…

What about hosting HTTP content because you verify GPG signatures upon download? These content would then be super easy to cache on the local network. HTTPS defeats this and makes it uncachable. I hardly ever see people talk about this use case and how to solve it with https everywhere. AND it's super widely used: e.g. debian repositories.

There are a variety of attacks against GPG-signed repositories - an article [1] by Joe Damato explains them, and that all can be trivially mitigated by serving the repositories with TLS.

[1]: https://blog.packagecloud.io/eng/2018/02/21/attacks-against-...

Re: ACME v2 and Wildcard Certificate Support is Live

#178

Post by irq-1 »

jaas wrote: post #61
kyledrake wrote: post #7

First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them. > It is our intent to transition all clients and subscribers to ACMEv2, though we have not set an end-of-life date for our ACMEv1 API yet. Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lo…

The reason we haven't announced an EOL for ACMEv1 is that we won't announce one until we are confident we won't cause the kind of meltdown you describe.

You could block new domains (new to Lets Encrypt) from using v1.

Re: ACME v2 and Wildcard Certificate Support is Live

#180

Post by hyperion2010 »

Manozco wrote: post #131

I did not see it on the forum, but seeing that the wildcard feature requires DNS-01 challenge for getting the certificates, does it mean automatic renewal is impossible without DNS api ? (or is it possible to renew without the dns challenge ? )

This thread [0] suggests that you do.

0. https://www.reddit.com/r/programming/comments/84607r/lets_en...

Post reply on HN