Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

31–40 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#31

Post by bflesch »

This sounds like a very good thing, like a lot of stuff coming from letsencrypt.

But what risks are attached with such a short refresh?

Is there someone at the top of the certificate chain who can refuse to give out further certificates within the blink of an eye?

If yes, would this mean that within 6 days all affected certificates would expire, like a very big Denial of Service attack?

And after 6 days everybody goes back to using HTTP?

Maybe someone with more knowledge about certificate chains can explain it to me.

Re: 6-Day and IP Address Certificates Are Generally Available

#32

Post by sgtcodfish »

mcpherrinm wrote: post #8
gruez wrote: post #2

For people who want IP certificates, keep in mind that certbot doesn't support it yet, with a PR still open to implement it: https://github.com/certbot/certbot/pull/10495 I think acme.sh supports it though.

Some ACME clients that I think currently support IP addresses are acme.sh, lego, traefik, acmez, caddy, and cert-manager. Certbot support should hopefully land pretty soon.

cert-manager maintainter chiming in to say that yes, cert-manager should support IP address certs - if anyone finds any bugs, we'd love to hear from you!

We also support ACME profiles (required for short lived certs) as of v1.18 which is our oldest currently supported[1] version.

We've got some basic docs[2] available. Profiles are set on a per-issuer basis, so it's easy to have two separate ACME issuers, one issuing longer lived certs and one issuing shorter, allowing for a gradual migration to shorter certs.

[1]: https://cert-manager.io/docs/releases/ [2]: https://cert-manager.io/docs/configuration/acme/#acme-certif...

Re: 6-Day and IP Address Certificates Are Generally Available

#33

Post by pdntspa »

iamrobertismo wrote: post #18
pdntspa wrote: post #15

Earlier quoted context omitted.

Maybe you want TLS but getting a proper subdomain for your project requires talking to a bunch of people who move slowly?

Very very true, never thought about orgs like that. However, I don't think someone should use this like a bandaid like that. If the idea is that you want to have a domain associated with a service, then organizationally you probably need to have systems in place to make that easier.

Ideally, sure. But in some places you're what you're proposing is like trying to boil the oceans to make a cup of tea

VBA et al succeeded because they enabled workers to move forward on things they would otherwise be blocked on organizationally

Also - not seeing this kind of thing could be considered a gap in your vision. When outsiders accuse SV of living in a high-tech ivory tower, blind to the realities of more common folk, this is the kind of thing they refer to.

Re: 6-Day and IP Address Certificates Are Generally Available

#34

Post by jeroenhd »

iamrobertismo wrote: post #4

This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.

One thing this can be useful for is encrypted client hello (ECH), the way TLS/HTTPS can be used without disclosing the server name to any listening devices (standard SNI names are transmitted in plaintext).

To use it, you need a valid certificate for the connection to the server which has a hostname that does get broadcast in readable form. For companies like Cloudflare, Azure, and Google, this isn't really an issue, because they can just use the name of their proxies.

For smaller sites, often not hosting more than one or two domains, there is hardly a non-distinct hostname available.

With IP certificates, the outer TLS connection can just use the IP address in its readable SNI field and encrypt the actual hostname for the real connection. You no longer need to be a third party proxying other people's content for ECH to have a useful effect.

Re: 6-Day and IP Address Certificates Are Generally Available

#35

Post by traceroute66 »

immibis wrote: post #27
traceroute66 wrote: post #21

Earlier quoted context omitted.

> IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance). To be pedantic for a moment, ARIN etc. are registries. The registrar is your ISP, cloud provider etc. You can get a PI (Provider Independent) allocation for yourself, usually with the assistance of a sponsoring registrar. Which is a nice compromise way of cutting out the middleman without becoming a registrar yourself.

You can also become a registrar yourself - at least, RIPE allows it. However, fees are significantly higher and it's not clear why you'd want to, unless you were actually providing ISP services to customers (in which case it's mandatory - you're not allowed to use a PI allocation for that)

> and it's not clear why you'd want to

The biggest modern-era reason is direct access to update your RPKI entries.

But this only matters if you are doing stuff that makes direct access worthwhile.

If your setup is mostly "set and forget" then you should just accept the lag associated with needing to open a ticket with your sponsor to update the RPKI.

Re: 6-Day and IP Address Certificates Are Generally Available

#36

Post by iso1631 »

bflesch wrote: post #31

This sounds like a very good thing, like a lot of stuff coming from letsencrypt. But what risks are attached with such a short refresh? Is there someone at the top of the certificate chain who can refuse to give out further certificates within the blink of an eye? If yes, would this mean that within 6 days all affected certificates would expire, like a very big Denial of Service attack? And after 6 days everybody goe…

With a 6 day lifetime you'd typically renew after 3 days. If Lets Encrypt is down or refuses to issue then you'd have to choose a different provider. Your browser trusts many different "top of the chain" providers.

With a 30 day cert with renewal 10-15 days in advance that gives you breathing room

Personally I think 3 days is far too short unless you have your automation pulling from two different suppliers.

Re: 6-Day and IP Address Certificates Are Generally Available

#37

Post by qwertox »

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate?

This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window.

I'm certain there are some who need this, but it's not me. Also the rationale is a bit odd:

> IP address certificates must be short-lived certificates, a decision we made because IP addresses are more transient than domain names, so validating more frequently is important.

Are IP addresses more transient than a domain within a 45 day window? The static IPs you get when you rent a vps, they're not transient.

Re: 6-Day and IP Address Certificates Are Generally Available

#38

Post by bigstrat2003 »

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

Re: 6-Day and IP Address Certificates Are Generally Available

#40

Post by medmunds »

iamrobertismo wrote: post #4

This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.

The July announcement for IP address certs listed a handful of potential use cases: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-addr...
Post reply on HN