Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

261–270 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#261

Post by AlfeG »

dingaling wrote: post #259
polishdude20 wrote: post #41

Earlier quoted context omitted.

Check out Caddy Server. It was only a few days ago when I was still managing my own certs and renewing them with a Cron job. Caddy now acts as my proxy for my various web domains and it handles certs automatically. Like literally you fill out a few lines in the config called a Caddy file and you do Caddy run and it gets the certs itself. And as long as it's running, it renews them automatically.

Giving an Internet-connected program autonomous write-access to system-critical filesystems is not considered good practice in production environments. Much better to have a separate central cert management system that handles renewals and pushes the certs outwards to the DMZ systems.

This is true for enterprise, but for small business Caddy or Traefik is totally fine.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#262

Post by AdamJacobMuller »

tgsovlerkhgsel wrote: post #191
AdamJacobMuller wrote: post #144

Earlier quoted context omitted.

You can, but, you can't (by policy) distribute keys across multiple customers.

I have a nasty habit of requesting revocation of such compromised keys whenever I find them. CAs are required to revoke within 24 hours, I think, though unfortunately revocation is surprisingly ineffective.

Do you actually find those often? I've actually never seen one. I will admit I've also never specifically looked very hard.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#263

Post by nitrogen »

gsich wrote: post #108
geerlingguy wrote: post #99

Earlier quoted context omitted.

> This is a ridiculous requirement that is not at all practical.

For a company? Absolutely not. In private? Probably not worth the effort, just skip the cert warning.

Most hardware in this category really needs to be set-and-forget, whether online or not. You can't have every random sound system and light controller having to dial out to a third party every month. You need to be able to come back five years later and still be able to configure the hardware.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#264

Post by nitrogen »

hannob wrote: post #132
xg15 wrote: post #83

Earlier quoted context omitted.

Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed. The device will also only be accessible if an internet connection is present, even if both the device and the client are in the…

> Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. I'm wondering where the impression fo" not any more" comes from. Really the situation hasn't changed much. You can have your HTTP webinterface. You can have HTTPS with a selfsigned cert and click away the warning. The only thing that really has changed is that for your HTTP connection you will get a warning that the conn…

Aren't browsers preventing submission of form data over http now?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#265

Post by nitrogen »

Karunamon wrote: post #237
jt2190 wrote: post #102

Earlier quoted context omitted.

There’s always the .local TLD, which is reserved for this use case: https://en.m.wikipedia.org/wiki/.local

That article goes on to state that .local is reserved by RFC6762 (multicast DNS), which if you use that domain on your network, will cause problems with any services using it, usually Macs or iPhones. This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local." is link-local, and names within this domain are meanin…

Why not just use mDNS too and stick with .local?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#266

Post by csunbird »

brnt wrote: post #45
altfredd wrote: post #36

Earlier quoted context omitted.

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

Will browsers start allowing self signed certificates though?

They should at least allow for local addresses

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#267

Post by hedora »

kspacewalk2 wrote: post #38
nieve wrote: post #32

It's a positive for security, but unless you're going through Let's Encrypt it adds another entity that you have to disclose PII to simply to host your own blog or side project.

What are some valid reasons not to use LetsEncrypt?

It’s extremely insecure if you’re worried about things beyond passive mass surveillance.

If someone can intercept traffic to your server IP, they can get a Let’s Encrypt certificate. If they can’t reliably man in the middle that IP, then HTTP is reasonably secure already.

Such “certificates without certification” This is one reason browsers have added new UI elements for certified domains.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#268

Post by riffic »

brian-bk wrote: post #218
maxmalysh wrote: post #37

Earlier quoted context omitted.

http://www.paulgraham.com/

There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.

> no need for one in the first place ... it's obvious that there's nothing wrong with a static site with no cert

Oh yes, there is.

https://doesmysiteneedhttps.com

> YES

> Your site needs HTTPS.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#269

Post by Spivak »

CountSessine wrote: post #243
CydeWeys wrote: post #234

Earlier quoted context omitted.

Because 99.99%+ of users don't have the technical skill to do this, but still need to be able to access local devices and it would sure be good if they could do so in a secure manner?

So the answer is to subvert the global certificate infrastructure that protects web traffic? No, it isn’t. Your IoT device has no security at all if a non-technical user is setting it up or if it doesn’t have a way of accepting a user configured certificate, and you shouldn’t pretend otherwise by dressing it up in bad certificates and worthless encrypted tunnels. Just use HTTP.

I mean if they’re worthless tunnels then so is every SSH tunnel. Should we just go back to telnet?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#270

Post by jcims »

loeg wrote: post #238
secabeen wrote: post #112

Earlier quoted context omitted.

Do self-signed certs not work? Yes, you have to tell your browser to permanently accept them the first time you connect, but after that, they work.

Chrome seems to intentionally forget you accepted self-signed certificates after some period of time.

I feel like Chrome has generally become much more amnesic as of the past few months. Lost more signing in to various services, which isn't a bad thing, I'm just not sure what (if anything) changed.
Post reply on HN