41–50 of 114 posts
Earlier quoted context omitted.
The greatest motivator of all, money!
How much money are we talking here? Because most businesses, if you ask them "How much $$$ to destroy your business?" will respond "absolutely loads"
Earlier quoted context omitted.
On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks. To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017). On iOS, it was first added in iOS 10 (2016).…
I was eating breakfast with a multitude of Android phones around me and four "older ones" could not access that site. The oldest that could connect was ~5 months old, all using new Mobile Chrome versions.
So Windows XP...
There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to having no encryption.
Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.
Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the possibility to revoke bad or unused certs.
Earlier quoted context omitted.
They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?
Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…
If I recall correctly, Android >=5 has pretty decent support for modern crypto (such as TLS V1.2, ECC). So, Android 5/6 could still just work, if the vendor is bothered to update the CA root store.
Earlier quoted context omitted.
No need for individual servers, let alone public ones, to have your DNS API key. Have a separate machine that isn't publicly addressable generate the keys and request the certificates, and then push them out to where they need to be. You don't even need to give that box privileged access to the places the certificates need to be, if you arrange things right. Only one box then needs your API key.
That separate machine doesn't need the private keys. Depending on your scenario it may well make more sense for the DNS privileged machine not to know the keys, and be given Certificate Signing Requests (CSRs) for the certificates it's to go get from Let's Encrypt. Most good ACME clients will accept a CSR you provide as an alternative to making their own keys or using a private key you generated. A CSR is a signed do…
That and I've not played with doing that myself yet, so while I know it is possible I can't talk about it authoritatively.
Earlier quoted context omitted.
I was eating breakfast with a multitude of Android phones around me and four "older ones" could not access that site. The oldest that could connect was ~5 months old, all using new Mobile Chrome versions.
I have a first-generation Pixel, so a couple years old now, and it accessed the test site fine.
Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.
Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…
Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.
Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…
Earlier quoted context omitted.
I was eating breakfast with a multitude of Android phones around me and four "older ones" could not access that site. The oldest that could connect was ~5 months old, all using new Mobile Chrome versions.
The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…
Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.
Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…