Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

21–30 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#21

Post by traceroute66 »

organsnyder wrote: post #7
axus wrote: post #6

Earlier quoted context omitted.

No dependency on a registrar sounds nice. More anonymous.

IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).

> IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).

To be pedantic for a moment, ARIN etc. are registries.

The registrar is your ISP, cloud provider etc.

You can get a PI (Provider Independent) allocation for yourself, usually with the assistance of a sponsoring registrar. Which is a nice compromise way of cutting out the middleman without becoming a registrar yourself.

Re: 6-Day and IP Address Certificates Are Generally Available

#22

Post by inetknght »

michaelt wrote: post #16
meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

No, they will only give out certificates if you can prove ownership of the IP, which means it being publicly routable.

A lot of publicly routable IP addresses are assigned by DHCP...

Re: 6-Day and IP Address Certificates Are Generally Available

#23

Post by wolttam »

meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

Browsers consider ‘localhost’ a secure context without needing https

For local /network/ development, maybe, but you’d probably be doing awkward hairpin natting at your router.

Re: 6-Day and IP Address Certificates Are Generally Available

#24

Post by traceroute66 »

axus wrote: post #6
iamrobertismo wrote: post #4

This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.

No dependency on a registrar sounds nice. More anonymous.

> No dependency on a registrar sounds nice.

Actually the main benefit is no dependency on DNS (booth direct and root).

IP is a simple primitive, i.e. "is it routable or not ?".

Re: 6-Day and IP Address Certificates Are Generally Available

#25

Post by hojofpodge »

ycombinatrix wrote: post #20
hojofpodge wrote: post #17

Something about a 6 day long IP address based token brings me back to the question of why we are wasting so much time on utterly wrong TOFU authorization? If you are supposed to have an establishable identity I think there is DNSSEC back to the registrar for a name and (I'm not quite sure what?) back to the AS.for the IP.

Domains map one-to-one with registrars, but multiple AS can be using the same IP address.

Then it would be a grave error to issue an IP cert without active insight into BGP. (Or it doesn't matter which chain you have.. But calling a website from a sampling of locations can't be a more correct answer.)

Re: 6-Day and IP Address Certificates Are Generally Available

#26

Post by treve »

wolttam wrote: post #23
meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

Browsers consider ‘localhost’ a secure context without needing https For local /network/ development, maybe, but you’d probably be doing awkward hairpin natting at your router.

it's nice to be able to use https locally if you're doing things with HTTP/2 specifically.

Re: 6-Day and IP Address Certificates Are Generally Available

#27

Post by immibis »

traceroute66 wrote: post #21
organsnyder wrote: post #7

Earlier quoted context omitted.

IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).

> IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance). To be pedantic for a moment, ARIN etc. are registries. The registrar is your ISP, cloud provider etc. You can get a PI (Provider Independent) allocation for yourself, usually with the assistance of a sponsoring registrar. Which is a nice compromise way of cutting out the middleman without becoming a registrar yourself.

You can also become a registrar yourself - at least, RIPE allows it. However, fees are significantly higher and it's not clear why you'd want to, unless you were actually providing ISP services to customers (in which case it's mandatory - you're not allowed to use a PI allocation for that)

Re: 6-Day and IP Address Certificates Are Generally Available

#28

Post by mholt »

Svoka wrote: post #10
ivanr wrote: post #3

As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yesterday. Here's what worked for me: lego --domains 206.189.27.68 --accept-tos --http --disable-cn run --profile shortlived [1] https://go-acme.github.io/lego/

I wonder if the support made it to Caddy yet (seems to be WIP https://github.com/caddyserver/caddy/issues/7399 )

It works, but as another comment mentioned there may be quirks with IP certs, specifically IPv6, that I hope will be fixed by v2.11.

Re: 6-Day and IP Address Certificates Are Generally Available

#30

Post by wongarsu »

michaelt wrote: post #16
meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

No, they will only give out certificates if you can prove ownership of the IP, which means it being publicly routable.

Finally a reason to adopt IPv6 for your local development
Post reply on HN