Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

211–220 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#211

Post by loeg »

arwineap wrote: post #195
elcritch wrote: post #147

Earlier quoted context omitted.

It’s a glaring security hole, IMHO. I create such devices and the only way I know is self-signed certs, but the browsers complain a lot about that. Ideally there’d be a way to sign .local domains with browsers handling it while letting people know to verify the identity of their local devices/services and that the identity isn’t verified by https like most sites. The issue lies between the browsers and https system.…

> It handles it by asking "Do you want to trust this new server?" That's basically how it works though; your OS packages a group of trusted CA certs. You can add additional trusted CA certs, even ones minted by you to ensure your apps trust the connection

The mechanism SSH uses is called Trust on First Use ("TOFU") and is closer to what used to be HTTPS certificate pinning. In this scheme, certificates never expire, and if they do, clients warn about the unexpected change in certificate.

It is different from the CA PKI system, where the client trusts any certificate signed by a trusted CA without prompting the user at all, and doesn't prompt the user if the certificate for a site changes.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#212

Post by yjftsjthsd-h »

csours wrote: post #14

> Enforce publicly trusted TLS server certificates have a lifetime of 398 days or less, if they are issued on or after 2020-09-01. Fortunately not enforced for currently issued certs. Will this ever be part of the TLS spec?

> Will this ever be part of the TLS spec?

I'm pretty sure TLS itself doesn't specify anything about certificate lifetimes. I could be wrong; I have actually read it, but as sibling comment notes, TLS is used in a lot more places than browsers, including mutual TLS between random services that don't use an external CA at all.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#213

Post by paledot »

arwineap wrote: post #195
elcritch wrote: post #147

Earlier quoted context omitted.

It’s a glaring security hole, IMHO. I create such devices and the only way I know is self-signed certs, but the browsers complain a lot about that. Ideally there’d be a way to sign .local domains with browsers handling it while letting people know to verify the identity of their local devices/services and that the identity isn’t verified by https like most sites. The issue lies between the browsers and https system.…

> It handles it by asking "Do you want to trust this new server?" That's basically how it works though; your OS packages a group of trusted CA certs. You can add additional trusted CA certs, even ones minted by you to ensure your apps trust the connection

There are two options:

* Manually install a root certificate, which is a confusing process for most end users and a non-starter for anyone who cares about security. (Imagine walking your parents through the process.)

* Trust a self-signed certificate, which is an increasingly difficult and counterintuitive process since Chrome and Firefox started competing to see who could destroy their usefulness faster. I'm not even sure if it's possible anymore.

Neither of these are acceptable.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#214

Post by yjftsjthsd-h »

lawnchair_larry wrote: post #119
joobus wrote: post #25

I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you.

Seeing how hard this comment is being downvoted somewhat illustrates your point. I don’t see how anything you just said is controversial or offtopic.

Charitably, it could be seen as inflammatory.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#215

Post by mrunkel »

loeg wrote: post #208

This is a tangent, and I apologize. Is there any good infrastructure for creating self-signed TLS CA/host certificates these days for people who don't sysadmin full time (grok OpenSSL)? I would like to create a self-signed CA with a name-constraint for certain internal (sub)domains, and have my browser trust the CA. And have it sign end-host certificates. And have httpd use those certificates (or certificate chains)…

https://github.com/redredgroovy/easy-ca

Pretty easy to use.

Letsencrypt with DNS validator also works great for servers that aren’t accessible externally.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#216

Post by Talanes »

tialaramex wrote: post #159
greatgib wrote: post #136

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…

CA/B isn't a cartel, indeed it jumps through a bunch of hoops to ensure it isn't a cartel. Cartels are illegal in many countries (the one you're most likely thinking of right now, OPEC, doesn't need to care that cartels are illegal because its members are sovereign entities, and thus they decide what the law is) Moreover, this didn't come from CA/B anyway, it was rejected there. CA/B agreed the previous 825 day limit…

I'm pretty sure Google, Mozilla, and Apple are who they meant in the first place, not CA/B.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#217

Post by [deleted] »

paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

[deleted]

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#218

Post by brian-bk »

maxmalysh wrote: post #37
wolf550e wrote: post #10

Earlier quoted context omitted.

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

http://www.paulgraham.com/

There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#219

Post by brian-bk »

superkuh wrote: post #120
wolf550e wrote: post #10

Earlier quoted context omitted.

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a…

Are those >5 year OSes receiving security patches?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#220

Post by skrause »

loeg wrote: post #208

This is a tangent, and I apologize. Is there any good infrastructure for creating self-signed TLS CA/host certificates these days for people who don't sysadmin full time (grok OpenSSL)? I would like to create a self-signed CA with a name-constraint for certain internal (sub)domains, and have my browser trust the CA. And have it sign end-host certificates. And have httpd use those certificates (or certificate chains)…

XCA is reasonably easy to use, it's open-source and cross-platform: https://hohnstaedt.de/xca/
Post reply on HN