Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

201–210 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#201

Post by andrewaylett »

huhhuh wrote: post #113
gizmo686 wrote: post #110

Earlier quoted context omitted.

It would give you a certificate chain which may authenticate the onion service as being operated as who it purports to. Of course, depending on context, a certificate that is useful for that purpose might itself be too much if an information leak

DV certificates (that lets encrypt) provides offer no verification of the owner. EV certificates for .onion could be actually useful though, but one generally has to pay for EV cert.

A certificate that's valid for both a regular domain and an onion domain gives you a degree of confidence of common ownership.

Re: 6-Day and IP Address Certificates Are Generally Available

#202

Post by andrewaylett »

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

You should probably be running your renewal pipeline more frequently than that: if you had let your ACME client set itself up on a single server, it would probably run every 12h for a 90-day certificate. The ACME client won't actually give you a new certificate until the old one is old enough to be worth renewing, and you have many more opportunities to notice that the pipeline isn't doing what you expect than if you only run when you expect to receive a new certificate.

Re: 6-Day and IP Address Certificates Are Generally Available

#204

Post by meling »

michaelt wrote: post #16
meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

No, they will only give out certificates if you can prove ownership of the IP, which means it being publicly routable.

Sorry, I wasn’t precise enough. I’m at a university and our IP addresses are publicly routable, I think.

Re: 6-Day and IP Address Certificates Are Generally Available

#205

Post by dextercd »

0xbadcafebee wrote: post #177
dextercd wrote: post #92

Earlier quoted context omitted.

It's a requirement from the Chrome root program. This page is probably the best resource on why they want this: https://googlechrome.github.io/chromerootprogram/moving-forw...

I get why Chrome doesn't want it (it doesn't serve Chrome's interests), but that doesn't explain why Let's Encrypt had to remove it. The reason seems to be "you can't be a Chrome CA and not do exactly what Chrome wants, which is... only things Chrome wants to do". In other words, CAs have been entirely captured by Chrome. They're Chrome Authorities. Am I the only person that thinks this is insane? All web security is…

All major root store programs (Chrome, Apple, Microsoft, Mozilla) have this power. They set the requirements that CAs must follow to be included in their root store, and for most CAs their certs would be useless if they aren't included in all major ones.

I don't think the root programs take these kind of decisions lightly and I don't see any selfish motives they could have. They need to find a balance between not overcomplicating things for site operators and CAs (they must stay reliable) while also keeping end users secure.

A lot of CAs and site operators would love if nothing ever changed: don't disallow insecure signature/hash algorithms, 5+ year valid certs, renewals done manually, no CT, no MPIC, etc. So someone else needs to push for these improvements.

The changes the root programs push for aren't unreasonable, so I'm not really concerned about the power they have over CAs.

That doesn't mean the changes aren't painful in the short term. For example, the move to 45 day certificates is going to cause some downtime, but of course the root programs/browsers don't benefit from that. They're still doing this because they believe that in the long term it's going to make WebPKI more robust.

There's also the CA/Browser Forum where rule changes are discussed and voted on. I'm not sure how root programs decide on what to make part of their root policy vs. what to try to get voted into the baseline requirements. Perhaps in this case Chrome felt that too many CAs would vote against for self-interested reasons, but that's speculation.

Re: 6-Day and IP Address Certificates Are Generally Available

#206

Post by alwillis »

iso1631 wrote: post #132
bflesch wrote: post #100

Earlier quoted context omitted.

I'm pretty sure that the .org TLD can be shut off by the US at any point in time.

Lets Encrypt do not control the US president. You could argue that The Don in charge of the US is in control of letsencrypt

> You could argue that The Don in charge of the US is in control of letsencrypt

He's not in control of letsencrypt or any other US-based CA.

It may not be well known, but Trump's administration loses about 80% of the time when they've been sued by companies, cities and states.

There's much more risk of state-sponsored cyber attacks against US companies.

Re: 6-Day and IP Address Certificates Are Generally Available

#207

Post by mcpherrinm »

dextercd wrote: post #205
0xbadcafebee wrote: post #177

Earlier quoted context omitted.

I get why Chrome doesn't want it (it doesn't serve Chrome's interests), but that doesn't explain why Let's Encrypt had to remove it. The reason seems to be "you can't be a Chrome CA and not do exactly what Chrome wants, which is... only things Chrome wants to do". In other words, CAs have been entirely captured by Chrome. They're Chrome Authorities. Am I the only person that thinks this is insane? All web security is…

All major root store programs (Chrome, Apple, Microsoft, Mozilla) have this power. They set the requirements that CAs must follow to be included in their root store, and for most CAs their certs would be useless if they aren't included in all major ones. I don't think the root programs take these kind of decisions lightly and I don't see any selfish motives they could have. They need to find a balance between not ove…

The "client cert" requirements were specifically not a CABF rule because that would rule it out for everyone complying with those rules, which is much broader than just the CAs included in Chrome.

Some CAs will continue to run PKIs which support client certs, for use outside of Chrome.

In general, the "baseline requirements" are intended to be just that: A shared baseline that is met by everyone. All the major root programs today have requirements which are unique to their program.

Re: 6-Day and IP Address Certificates Are Generally Available

#208

Post by akerl_ »

bayindirh wrote: post #159
PunchyHamster wrote: post #130

Earlier quoted context omitted.

> 6 days means on a long enough enough timeframe the load will end up evenly distributed across a week. people will put */5 in cron and result will be same, because that's obvious, easy and nice number.

ACME doesn't renew certificates when there's enough time, so it'll always renew around 6 days, even if you check more aggressively. Currently ACME sets its cron job to 12 days on 90 day certificates.

Which ACME client are you referring to?

Re: 6-Day and IP Address Certificates Are Generally Available

#209

Post by alwillis »

bflesch wrote: post #76
cpach wrote: post #75

Earlier quoted context omitted.

“Are they a single point of failure in that regard?” It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.

Makes sense. I assume each of them is in control and at the whims of US president?

> Makes sense. I assume each of them is in control and at the whims of US president?

Absolutely not.

If the president attempted to force a US-based CA to do something bad they don't want to do, they would sue the government. So far, this administration loses 80% of the lawsuits brought against it.

Re: 6-Day and IP Address Certificates Are Generally Available

#210

Post by cortesoft »

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

> Are IP addresses more transient than a domain within a 45 day window? The static IPs you get when you rent a vps, they're not transient.

They can be as transient as you want. For example, on AWS, you can release an elastic IP any time you want.

So imagine I reserve an elastic IP, then get a 45 day cert for it, then release it immediately. I could repeat this a bunch of times, only renting the IP for a few minutes before releasing it.

I would then have a bunch of 45 day certificates for IP addresses I don't own anymore. Those IP addresses will be assigned to other users, and you could have a cert for someone else's IP.

Of course, there isn't a trivial way to exploit this, but it could still be an issue and defeats the purpose of an IP cert.

Post reply on HN