Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

171–180 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#171

Post by j1elo »

secabeen wrote: post #112
paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.

For some reason, iOS Safari won't do like all the other browsers, show a warning and then let you access. No, it outright rejects self-signed certs. You have to go through the trouble of installing the root CA into the phone, which is not practical.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#172

Post by heavenlyblue »

superkuh wrote: post #61
staticassertion wrote: post #31

Earlier quoted context omitted.

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

>are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by im…

It’s free to own a certificate today, so doesn’t matter.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#173

Post by rad_gruchalski »

geerlingguy wrote: post #99
gsich wrote: post #93

Earlier quoted context omitted.

You can also run your own CA.

> This is a ridiculous requirement that is not at all practical.

Really. This: https://jamielinux.com/docs/openssl-certificate-authority/ gives you a CA in about an hour. HashiCorp Vault will give you a CA in 5 minutes. certstrap will give you a CA in 15 seconds. It’s 2020, it ain’t voodoo anymore.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#174

Post by namibj »

toast0 wrote: post #165
est31 wrote: post #98

Earlier quoted context omitted.

> Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate. CA certificates can be constrained. https://tools.ietf.org/html/rfc5280#section-4.2.1.10

Are common certificate validation libraries honoring these constraints? When I tried to use this many moons ago, most things ignored the constraints; although I could mark the extension critical, and then some (but not all, yay) of the things that didn't understand would refuse the CA.

Can you name and shame those that ignored the critical extension? Sounds CVE-worthy. A date to guess the versions you used would also help.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#175

Post by Sebb767 »

paledot wrote: post #151
elcritch wrote: post #147

Earlier quoted context omitted.

It’s a glaring security hole, IMHO. I create such devices and the only way I know is self-signed certs, but the browsers complain a lot about that. Ideally there’d be a way to sign .local domains with browsers handling it while letting people know to verify the identity of their local devices/services and that the identity isn’t verified by https like most sites. The issue lies between the browsers and https system.…

I love this idea. There are enough influential tech people who read HN, can we make this happen please?

Thirded. This sounds like a sound solution.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#176

Post by tialaramex »

floatingatoll wrote: post #4

This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing…

Nit: It's CA/B Forum (Certificate Authority / Browser Forum, a standing meeting between the major browser vendors - which are also roughly the set of major OS vendors except Mozilla stands in for the Free Unixes - and the major publicly trusted Certificate Authorities). The original purpose of this meeting was to find common ground between these two groups and this has borne considerable fruit over the years in the from of the Baseline Requirements.

CCADB is a totally different service run by Mozilla and Microsoft (using Salesforce, I presume because they both agree this is terrible but neither can accuse the other of using their preferred pet technologies?) notionally open to other trust stores to track lots of tedious paperwork for the relationship with trusted CAs. Audit documents, huge lists of what was issued by who and to do what, when it expires, blah blah blah. Like a public records office it's simultaneously fascinating and a total snooze fest. Mozilla is using it in this case to conduct their routine survey of CAs to check they understand what they're obliged to do, they're not asleep at the wheel and so on.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#178

Post by brian-bk »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

> It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time.

If you want to run a webserver but are unable to set up a cronjob that does

  certbot renew
you don't deserve external users. Full stop.

If it's just you and you don't care about your own security, then do whatever you want in your own browser.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#179

Post by toast0 »

kspacewalk2 wrote: post #38
nieve wrote: post #32

It's a positive for security, but unless you're going through Let's Encrypt it adds another entity that you have to disclose PII to simply to host your own blog or side project.

What are some valid reasons not to use LetsEncrypt?

If you accidentally leave DNS pointing at an old IP that gets recycled to someone else, you've authorized LetsEncrypt to issue a certificate to the lucky winner.

Most old school CAs do domain validations against the root of the domain, so it's a lot harder to accidentally delegate that.

That's not a reason not to use LetsEncrypt, but it's a reason not to include it in certificate pinning.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#180

Post by j1elo »

superkuh wrote: post #61
staticassertion wrote: post #31

Earlier quoted context omitted.

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

>are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by im…

> How is HTTP harmful when you visit my website about amateur radio?

"Unharmful" HTTP sites are used to silently hack people's computers and keep them under observation for months. Every unsecured site contributes their small piece to keep the web unsafe for people who needs it to be safe.

https://www.amnesty.org/en/latest/research/2020/06/moroccan-...

Post reply on HN