41–50 of 166 posts
Earlier quoted context omitted.
AFAIK, Caddy is the only integrated ACME client that is tuned for short-lived certificates. All its own self-signed certs are already 24-hour certificates, so 6-day certs will be no problem.
Why would that matter? Replacing the cert and sighup'ing nginx or whatever isn't functionally different from doing it in-process.
If I wanted to get a cert for an IP address today , what the cheapest CA?
Earlier quoted context omitted.
Impossible to say, as most people probably don't even know that their private key is stolen. I've personally seen it only once on a real certificate revocation. Yet another reason to have shorter lifespan.
If they don't know they were breached, don't the odds favor the replaced key likewise getting re-stolen immediately?
It feels like there's something of an attack vector here with cloud providers who lease IPs for hours at a time. 1. Lease IP 2. Obtain cert (verify can receive traffic to IP on port 80) 3. Give IP back 4. Cloud provider gives IP to another customer 5. Bgp attack IP with 6 days. While I support the idea of IP certs I do wonder how thought through this is and what the future consequences for security are. I agree with…
You've got to be pretty lucky, or do a lot of IP cycling for your vector to be terribly useful. A paranoid user of IP certs would let their new public facing assignments settle for a week before using them; but I suspect few people will start using IP address certs, because of usability.
I don't disagree with anything they say here: https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/#short... But... How often do these types of compromises happen? I can't say I've ever seen or heard of it happening.
Kinda funny to call the current 90 day certs "long lived". When Let's Encrypted started out more than 10 years ago most certs from major vendors had a 1 year life span. Let's Encrypt was (one of) the first to use drastically shorter life spans, hence all the ACME automation effort.
To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…
Other than that, I've never had to babysit certbot. It's just a systemd timer job.
It feels like there's something of an attack vector here with cloud providers who lease IPs for hours at a time. 1. Lease IP 2. Obtain cert (verify can receive traffic to IP on port 80) 3. Give IP back 4. Cloud provider gives IP to another customer 5. Bgp attack IP with 6 days. While I support the idea of IP certs I do wonder how thought through this is and what the future consequences for security are. I agree with…
If you control the IP or domain via a BGP hack, you can get a certificate issued while you control it, as long as you control it from the perspective of their CA. You've got to be pretty lucky, or do a lot of IP cycling for your vector to be terribly useful. A paranoid user of IP certs would let their new public facing assignments settle for a week before using them; but I suspect few people will start using IP addre…
AFAIK IP address certs would provide a way to create a secure browsing context in your browser, which is required for service worker ('offline' background threads) and some File API, which could open up a new class of programs that host for friends and family.
Earlier quoted context omitted.
To someone like me with hobby-level serving needs, the 90 day certificate life is pretty inconvenient, despite having automation set up. I run a tiny VPS that hosts basic household stuff like e-mail and a few tiny web sites for people, and letsencrypt/certbot automation around certificate renewal is the only thing that I seem to need to regularly babysit and log in to manually run/fix. Everything else just hums along…
... which means automation was not setup correctly and 90 days is still too long that you just tolerated it. If it was 6 days after a few turns you would have decided "fuck it I'm going to spend time fixing it once and for all".
This will get interesting for many CT transparency monitors which for many are already seeing scalability issues. I am operating https://www.merklemap.com/ and the current scale is already impressive.