Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

171–180 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#171

Post by stackghost »

xg15 wrote: post #47

IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.

>so still no way to support TLS for LAN devices without manual setup or angering security researchers.

Arguably setting up letsencrypt is "manual setup". What you can do is run a split-horizon DNS setup inside your LAN on an internet-routable tld, and then run a CA for internal devices. That gives all your internal hosts their own hostname.sub.domain.tld name with HTTPS.

Frankly: it's not that much more work, and it's easier than remembering IP addresses anyway.

Re: 6-Day and IP Address Certificates Are Generally Available

#172

Post by notepad0x90 »

cpach wrote: post #155
notepad0x90 wrote: post #79

It's a huge ask, but i'm hoping they'll implement code-signing certs some day, even if they charge for it. It would be nice if appstores then accepted those certs instead of directly requiring developer verification.

Would be cool. But since they’re a non-profit, they would need some way to make it scalable.

I see no problem with outsourcing id verification to a trusted partner. Or they could verify payment by charging you $1 to verify you control the payment card, and combine that with address verification by paper-mailing a verification code.

Re: 6-Day and IP Address Certificates Are Generally Available

#173

Post by cryptonector »

PunchyHamster wrote: post #133
cryptonector wrote: post #66

I wonder if transport mode IPsec can be relevant again if we're going to have IP address certificates. Ditto RFC 5660 (which -full disclosure- I authored).

IPSec is terrible, huge, and messy standard that company that made it took 20 years to stop getting CVE every year

But the very nice thing about ESP (over UDP or not) is that it's much simpler to build HW offload than for TLS.

Using the long ago past as FUD here is not useful.

Re: 6-Day and IP Address Certificates Are Generally Available

#174

Post by cpach »

bflesch wrote: post #167
cpach wrote: post #103

Earlier quoted context omitted.

That’s not relevant though. These CAs will gladly give you a .se/.dk/.in/whatever cert as long as validation passes.

I hope so, but can we really be sure that .se or .de would still work in such a scenario? Is the TLD root management really split up vertically or is the (presumably US-based) TLD parent organization also the final authority for every country TLD? It would be nice to at least have a very high level contingency plan because in worst case I won't be able to google it.

Not sure what the exact concern is here. So far, virtually all countries on Earth are still represented in DNS. Venezuela, Iran, Somalia, etc etc.

You can also read a lot of anti-Trump articles and comments on countless web-sites, some under .com and some under other top-domains. As lunatic as Trump is, he hasn’t shut that down.

“Is the TLD root management really split up vertically”

AFAIK, yes, it is.

But if the global DNS would somehow break down I guess you either have to find an alternative set of root servers. Or communicate outside of the regular Internet. Such an event surely would shock the global economy.

Re: 6-Day and IP Address Certificates Are Generally Available

#175

Post by charcircuit »

buckle8017 wrote: post #121
charcircuit wrote: post #54

Earlier quoted context omitted.

You can have automation to fix the broken automation.

Are you serious? real question

Yes, as expiration times get smaller people will increase automation and robustness to deal with it. One way to increase robustness is to automatically diagnose why something failed and try and repair it.

Re: 6-Day and IP Address Certificates Are Generally Available

#176

Post by cpach »

bflesch wrote: post #166
iso1631 wrote: post #132

Earlier quoted context omitted.

Lets Encrypt do not control the US president. You could argue that The Don in charge of the US is in control of letsencrypt

Yeah, it's a bit far fetched but after Cloudflare CEO basically threatening to cut off Italy I was wondering what would happen if US really invades Greenland. A simple windows to linux migration is not enough. If certificates expire without a way to refresh you'd either need to manually touch every machine to swap root certificates or have some of other contingency plan.

Remember that there are lots of CAs, and quite many of them are based outside of the US. Those CAs currently do not offer ACME services for free, but there’s nothing stopping them from doing so.

I would say that the WebPKI system seems to be quite resilient, even in the face of strong geopolitical tension.

Re: 6-Day and IP Address Certificates Are Generally Available

#177

Post by 0xbadcafebee »

dextercd wrote: post #92
razakel wrote: post #60

Has anyone actually given a good explanation as to why TLS Client Auth is being removed?

It's a requirement from the Chrome root program. This page is probably the best resource on why they want this: https://googlechrome.github.io/chromerootprogram/moving-forw...

I get why Chrome doesn't want it (it doesn't serve Chrome's interests), but that doesn't explain why Let's Encrypt had to remove it. The reason seems to be "you can't be a Chrome CA and not do exactly what Chrome wants, which is... only things Chrome wants to do". In other words, CAs have been entirely captured by Chrome. They're Chrome Authorities.

Am I the only person that thinks this is insane? All web security is now at the whims of Google?

Re: 6-Day and IP Address Certificates Are Generally Available

#178

Post by GTP »

kibwen wrote: post #129
bayindirh wrote: post #112

Earlier quoted context omitted.

Because it allows to you to work for six days, and rest on the seventh. Like God did.

² By the seventh day God had finished the work He had been doing; so on the seventh day He rested from all His work. ³ Then the on-call tech, Lucifer, the Son of Dawn, was awoken at midnight because God did not renew the heavens' and the earths' HTTPS certificate. ⁴ Thusly Lucifer drafted his resignation in a great fury.

This made my day :D

Re: 6-Day and IP Address Certificates Are Generally Available

#179

Post by reincarnate0x14 »

cryptonector wrote: post #66

I wonder if transport mode IPsec can be relevant again if we're going to have IP address certificates. Ditto RFC 5660 (which -full disclosure- I authored).

Maybe but probably not. Various always-on , SDN, or wide scale site-to-site VPN schemes are deployed widely enough for long enough now that it's expected infrastructure at this point.

Even getting people to use certificates on IPSEC tunnels is a pain. Which reminds me, I think the smallest models of either Palo Alto or Checkpoint still have bizarre authentication failures if the certificate chain is too long, which was always weird to me because the control planes had way more memory than necessary for well over a decade.

Re: 6-Day and IP Address Certificates Are Generally Available

#180

Post by cpach »

nottorp wrote: post #163
akerl_ wrote: post #147

Earlier quoted context omitted.

Which wider world? These changes are coming from the CAB forum, which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. There are use cases for certificates that exist outside of that umbrella, but they are by definition niche.

>which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. So no one that actually has to renew these certificates. Hey! How long does a root certificate from a certificate authority last? 10 to 25 years? Why don't those last 120 minutes? They're responsible for the "security" of the whole internet aren't they?

It’s capped to 15 years.

In another comment someone linked to a document from the Chrome team.

Here’s a quote that I found interesting:

“In Chrome Root Program Policy 1.5, we landed changes that set a maximum ‘term-limit’ (i.e., period of inclusion) for root CA certificates included in the Chrome Root Store to 15 years.

While we still prefer a more agile approach, and may again explore this in the future, we encourage CA Owners to explore how they can adopt more frequent root rotation.”

https://googlechrome.github.io/chromerootprogram/moving-forw...

Post reply on HN