Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

351–360 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#351

Post by GordonS »

certera wrote: post #114
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Check out Certera https://docs.certera.io It's PKI for Let's Encrypt certificates. Helps you issue, renew, revoke certs from a central place. Also get alerts so you know when things have changed, expired, failed to renew. While a lot of places give you certs built in, there's a whole world of places you still need certs. Like FTP, mail, behind load balancers, disparate environments and systems, etc. In the future, I'…

This looks interesting as a log of Let's Encrypt certificate operations, but is it more than that, and why would I want to use it?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#352

Post by GordonS »

chucky_z wrote: post #3

I’m so torn here. Personally I like this a lot and think it will really help enforce good practices and allow easier things like root/int key rotation. Professionally it sucks, as there are a ton of valid use cases for real certs in areas that require manual work and tracking them all is a hard problem. If internal PKIs were easier to make work across all OS and Browser combos I’d just use those instead.

> If internal PKIs were easier to make work across all OS and Browser combos I’d just use those instead

Even if you use your own PKI, if your certs have a validity > 1 year, won't browsers still complain?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#353

Post by GordonS »

yjftsjthsd-h wrote: post #206
sschueller wrote: post #80

Earlier quoted context omitted.

The only other CA I know that has this service available is https://www.buypass.com/ssl/products/acme

https://zerossl.com/features/acme/ Free, even.

ZeroSSL are a commercial CA... I can't figure out what's in it for them to offer free 90-day certs with auto ACME renewal?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#354

Post by GordonS »

tialaramex wrote: post #297
cm2187 wrote: post #63

Earlier quoted context omitted.

But what about Chromium and Mozilla?

if (verify_result->is_issued_by_known_root && HasTooLongValidity(*cert)) { verify_result->cert_status |= CERT_STATUS_VALIDITY_TOO_LONG; Chromium's code (linked as the story) only applies these rules to certificates from the Web PKI, not to a private CA. Mozilla has no checks, I presume the story title names them because they've agreed on this policy but they don't actually enforce policy in the browser code itself. O…

> verify_result->is_issued_by_known_root

Let's take Windows as an example, as it has a root certificate store. Now, if I operate a private CA, I install my private root certificate to the root certificate store - does that make it a "known_root" for Chromium, or does this check only cover a specific set of known-to-Chromium CAs?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#355

Post by jt2190 »

Karunamon wrote: post #237
jt2190 wrote: post #102

Earlier quoted context omitted.

There’s always the .local TLD, which is reserved for this use case: https://en.m.wikipedia.org/wiki/.local

That article goes on to state that .local is reserved by RFC6762 (multicast DNS), which if you use that domain on your network, will cause problems with any services using it, usually Macs or iPhones. This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local." is link-local, and names within this domain are meanin…

I think you’re talking about running DNS locally (not sure) and resolving .local addresses by DNS. In that case, yes, the devices that do lookups by mDNS will experience a delay caused by first querying mDNS before falling back onto DNS. The solution is to set up mDNS for the internal resources.

Using an unregistered domain like .lan has serious security implications. See here: https://serverfault.com/a/17566

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#356

Post by jt2190 »

xg15 wrote: post #109
jt2190 wrote: post #102

Earlier quoted context omitted.

There’s always the .local TLD, which is reserved for this use case: https://en.m.wikipedia.org/wiki/.local

I haven't heard about that yet. this sounds interesting indeed. But how would I get a valid certificate for a .local domain?

You need to set up your own “chain of trust” to verify your self-generated certificates. You can run your own Certificate Authority for example. (There are other approaches too.)

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#357

Post by arwineap »

paledot wrote: post #213
arwineap wrote: post #195

Earlier quoted context omitted.

> It handles it by asking "Do you want to trust this new server?" That's basically how it works though; your OS packages a group of trusted CA certs. You can add additional trusted CA certs, even ones minted by you to ensure your apps trust the connection

There are two options: * Manually install a root certificate, which is a confusing process for most end users and a non-starter for anyone who cares about security. (Imagine walking your parents through the process.) * Trust a self-signed certificate, which is an increasingly difficult and counterintuitive process since Chrome and Firefox started competing to see who could destroy their usefulness faster. I'm not eve…

Honestly, I don't trust most end users to install root certificates

If you are doing something for an end user, I think it makes a lot of sense just to get a certificate; it's just not a large barrier anymore.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#358

Post by Karunamon »

jt2190 wrote: post #355
Karunamon wrote: post #237

Earlier quoted context omitted.

That article goes on to state that .local is reserved by RFC6762 (multicast DNS), which if you use that domain on your network, will cause problems with any services using it, usually Macs or iPhones. This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local." is link-local, and names within this domain are meanin…

I think you’re talking about running DNS locally (not sure) and resolving .local addresses by DNS. In that case, yes, the devices that do lookups by mDNS will experience a delay caused by first querying mDNS before falling back onto DNS. The solution is to set up mDNS for the internal resources. Using an unregistered domain like .lan has serious security implications. See here: https://serverfault.com/a/17566

.lan is called out in appendix G of the MDNS RFC as "not recommended, but many people do this".

Personally speaking, I'm not too worried about .lan getting registered as a gTLD anytime soon. I'm a lot more worried about forgetting to renew my domain and having things horrifically break if/when that domain gets picked up by someone else. This is a lot more likely...

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#359

Post by tgsovlerkhgsel »

AdamJacobMuller wrote: post #262
tgsovlerkhgsel wrote: post #191

Earlier quoted context omitted.

I have a nasty habit of requesting revocation of such compromised keys whenever I find them. CAs are required to revoke within 24 hours, I think, though unfortunately revocation is surprisingly ineffective.

Do you actually find those often? I've actually never seen one. I will admit I've also never specifically looked very hard.

I'd say one every couple of years.

https://letsencrypt.org/docs/certificates-for-localhost/ has great documentation on that topic, including more examples.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#360

Post by staticassertion »

superkuh wrote: post #244
j1elo wrote: post #180

Earlier quoted context omitted.

> How is HTTP harmful when you visit my website about amateur radio? "Unharmful" HTTP sites are used to silently hack people's computers and keep them under observation for months. Every unsecured site contributes their small piece to keep the web unsafe for people who needs it to be safe. https://www.amnesty.org/en/latest/research/2020/06/moroccan-...

This is exactly the same as blaming getting shot at a neighbor's BBQ on the neighbor for not hiring private security to deal with the government army specifically attacking you. If your threat model includes nation state attacks you're gonna have problems no matter what. Change your personal behavior accordingly. Don't tell everyone else they need to wear bullet proof vests around the house and hire corporate securit…

The problem with your analogy is that it downplays certain aspects and plays up others.

Attacks on HTTP sites are known threats that we have evidence for, they aren't ridiculous or unheard of. The defense is not "everyone where a bulletproof vest", it's get a certificate and set up HTTPS - a one time cost that will protect thousands of people.

You're making the choice for your users, who may not be as informed as you are, to not protect them. That's very different from asking them to wear a bulletproof vest.

Post reply on HN