31–40 of 112 posts
I want DANE!
But DNS does not have a good reliable authenticated transport mechanism. I wonder if there was a way to build this that would have worked.
I'm sure those six-day lifetime certificates will work out real nice.
Shall we have some way of freely encrypting the web that is relying on one authority? Especially something that needed to be renewed every 90 or is it 40 days now. How about issuing 100 years certificates as a default?
You've always been able to do this. Whether its useful to your clients has always been the problem. In a practical sense you likely wouldn't like the alternatives, because for most people's usage of the internet there's exactly one authority which matters: the local government, and it's legal system - i.e. most of my necessary use of TLS is for ecommerce. Which means the ultimate authority is "are you a trusted busin…
Your users that visit your website and get a TLS warning are the authority to worry about, if you're running a business that needs security. Depending on what you're selling, that one user could be a gigantic chunk of your business. Showing your local government that you have a process in place to renew your TLS certificates, and your provider was down is most likely going to be more than enough to indemnify you for any kind of maliciousness or ignorance (ignorantia juris non excusat). Obviously, different countries/locations have varying laws, but I highly doubt you'd be held liable for such a major outage for a company that is in such heavy use. Honestly, if you were held liable, or think you would be for this type of event, I'd think twice about operating from that location.
It's DNS, we're working on it. Sorry, thank you for bearing with us.
Shall we have some way of freely encrypting the web that is relying on one authority? Especially something that needed to be renewed every 90 or is it 40 days now. How about issuing 100 years certificates as a default?
> Shall we have some way of freely encrypting the web that is relying on one authority? Caddy uses ZeroSSL as a fallback if Let’s Encrypt fails!
I'm using Caddy here and it's not falling back on ZeroSSL. Thanks for your help
EDIT: hmm, it should be automatic...! https://caddyserver.com/docs/automatic-https#issuer-fallback interesting, I'll double check my config
woah... it's probably related to this! https://github.com/caddyserver/caddy/issues/7084 TLDR: "Caddy doesn't fall back to ZeroSSL for domains added using API" (which is my case)
It's DNS, we're working on it. Sorry, thank you for bearing with us.
It's not DNS There's no way it's DNS It was DNS
1. Denial: It’s not DNS.
2. Anger: What the fuck is it!
3. Bargaining: Maybe it’s a firewall, or Cloudflare!
4. Depression: We’ve checked everything…
5. Acceptance: It’s DNS.
Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…
> As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. Shouldn't that happen automatically a bit beforehand?
Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…
They have been communicating the ending of the email notices for quite a while and have been telling users that you should have some other monitoring in place to avoid just this situation