Letsencrypt's default validity is for an year right? Is this not a game?
Let's Encrypt doesn't offer anything longer than 90 days.
Chromium and Mozilla to enforce 1 year validity for TLS certificates
181–190 of 375 posts
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#182With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…
Plex uses a combination of wildcard certificates and a custom DNS resolver to offer HTTPS on local networks, but it does require a working internet connection to work. [1]
You can also get a certificate through the Let's Encrypt DNS challenge without having to expose a server to the Internet, but you'll still need ownership of a domain name and either an internet connection or a local DNS server to support HTTPS using that certificate.
There is always the option of creating a local certificate authority for your devices, but this is kind of a pain. There are some new applications that aim to make this easier [2], but there is no easy way around having to install the root certificate on each device.
[1] https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... [2] https://github.com/smallstep/certificates
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#183This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…
> It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. If you want to run a webserver but are unable to set up a cronjob that does certbot renew you don't deserve external users. Full stop. If it's just you and you don't care about your own security, then do whatever you want in your own browser.
> you don't deserve external users. Full stop.
It’s shit attitudes like this that killed the old internet we all loved
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#184Letsencrypt's default validity is for an year right? Is this not a game?
It's 90 days, and they renew it when there are 30 days left.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#185With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…
If you just want the green lock to show up, the device can get a certificate from Let's Encrypt. The manufacturer would need to provide an API that lets the device pass the DNS challenge.
For example, you could have serialnumber.manufactuerer-homedevices.net, and each device would get a cert for its serial's host name. Ideally, you should properly secure that API with some form of attestation key included on the device. Alternatively, the host name could be e.g. the hash of the devices' generated key (that way you could ship the devices without placing individual keys on them, but the host name would change after a factory reset).
Making this actually secure is hard, though, because you need the user to visit the URL for his device. If an attacker can simply get a cert for differentserial.manufacturer-homedevices.net and direct the victim there, you don't win much actual security.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#186Earlier quoted context omitted.
This is a ridiculous requirement that is not at all practical.
How is it not practical? It's really not hard to set up and there is great documentation out there
I get the feeling you have no real experience either running a company network or dealing with end users and home networks. Any of these solutions work fine for a majority of people who just use their laptop in Starbucks, but they really break down when you need to start doing anything more complicated than that.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#187Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…
>Compared to the good old time, like traditional pc software installation, where it was you, the user that was free to decide the websites that you wanted to trust: google.com vs myshaddyfraudyweb.com
People can barely tell whether it's really microsoft calling them saying their computer is infected. What makes you think they'll be able to tell the difference between google.com and google-secure-login.com, or whether they should download the "codec pack" that their shady streaming site is offering?
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#188Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…
You mean the good old days of IE 5.5?
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#189It’s disgusting. It’s not up to them to decide how long a certificate should be valid. Especially when they’re so expensive to buy and complicated to replace.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#190Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…
> Yes, we can think that shorter certificates are a little bit better to trust for the user, but that should be the choice of the website that you visit.
That sounds like a disagreement; it benefits the user, so let the website opt out? Because websites are known to have users' well-being in mind?