Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt to transition to ISRG root

scotthelme.co.uk

Post reply on HN
Print view View original

51–60 of 114 posts

Re: Let’s Encrypt to transition to ISRG root

#51

Post by StavrosK »

founderling wrote: post #28
watermelon0 wrote: post #10

Earlier quoted context omitted.

Hard in what way? Using my favorite client/library ( https://go-acme.github.io/lego/ ) I can generate wildcard cert with: lego \ --email="info@example.com" \ --accept-tos \ --path="./ssl" \ --domains="*.example.com" \ --dns="route53" (AWS credentials need to be available in the environment)

So you need to execute 3rd party software on your machine and let it fiddle with your DNS settings? Personally, I would not want to do that.

And that's fine. I just let my http server do it automatically.

Re: Let’s Encrypt to transition to ISRG root

#52

Post by tcd »

londons_explore wrote: post #42
emj wrote: post #19

Earlier quoted context omitted.

I was eating breakfast with a multitude of Android phones around me and four "older ones" could not access that site. The oldest that could connect was ~5 months old, all using new Mobile Chrome versions.

The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…

If you want to use an old, unsupported OS then don't expect support.

Expecting XP or say Windows 98 to still work on modern day standards is just laughable.

Upgrade, or get left behind. The concept of 'never updating' isn't one that is practical and you'll pay the penalty for it later on.

Re: Let’s Encrypt to transition to ISRG root

#53

Post by LeonM »

deadbunny wrote: post #48
LeonM wrote: post #43

Earlier quoted context omitted.

Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…

LE rate limits[1] can be a hassle in large environments. Their solution is SAN certs which are IMHO only mildly better than wildcards. 1. https://letsencrypt.org/docs/rate-limits/

I did not know about that, thanks for sharing that information!

Re: Let’s Encrypt to transition to ISRG root

#54

Post by gmueckl »

LeonM wrote: post #44
Fradow wrote: post #30

Earlier quoted context omitted.

Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…

> This is going to be problematic, as there are still devices currently for sale on Android 5/6 If I recall correctly, Android >=5 has pretty decent support for modern crypto (such as TLS V1.2, ECC). So, Android 5/6 could still just work, if the vendor is bothered to update the CA root store.

Vendor updates for cheap Android phones? Dream on!

Re: Let’s Encrypt to transition to ISRG root

#55

Post by tialaramex »

michaelt wrote: post #29

So what motivates one CA to cross-sign another? I would have thought, if you were a CA you'd prefer not to enable your competitors - especially one who's planning to give away the product for free.

I don't think anybody at Let's Encrypt has spoken on this topic, but in their case specifically there are both moral and pragmatic reasons to choose to cross-sign.

Morally is the easy one. If you work for a public CA you presumably think that the Web PKI is a good idea, and Let's Encrypt helped bring that benefit to lots more users, so that's a good thing. Consider the question of whether McDonalds should support a local soup kitchen. McDonalds thinks food helps bring people together, so why not?

Pragmatically, there are a number of benefits to Let's Encrypt for a commercial CA. It creates a "brand halo" for the "SSL Certificate" product class that you benefit from, where positive experiences with Let's Encrypt result in more customers for you. Growing the market means more opportunities for you as a seller. I see some misleading analysis of the "SSL Certificate" market that doesn't include "Does not have a cert" as one of the options. So they see Let's Encrypt crushing other outfits and assume that's got to hurt profits. But a site that goes from nothing to a Let's Encrypt cert makes no difference to sales at the for-profit CA. Even if 100 sites do that, if just one copies them but chooses to buy a cert, that's an extra sale they would not make otherwise.

Re: Let’s Encrypt to transition to ISRG root

#56

Post by cyphar »

founderling wrote: post #28
watermelon0 wrote: post #10

Earlier quoted context omitted.

Hard in what way? Using my favorite client/library ( https://go-acme.github.io/lego/ ) I can generate wildcard cert with: lego \ --email="info@example.com" \ --accept-tos \ --path="./ssl" \ --domains="*.example.com" \ --dns="route53" (AWS credentials need to be available in the environment)

So you need to execute 3rd party software on your machine and let it fiddle with your DNS settings? Personally, I would not want to do that.

They now support wildcards, but in order to verify you are authorised to get a wildcard certificate you need to be able to pass the DNS challenge. Unfortunately there simply isn't another universal, trust-less (and automatable) way of verifying that someone owns a domain -- other than DNS.

However, because the DNS check doesn't require writing to the webroot, you could run this on any server you like and then distribute the certificate to your edge nodes (meaning your edge nodes don't need to have access to write to your DNS). Some clients even have scripting hooks which could make this significantly easier.

(I assumed the "store my cloudflare API keys on my web host" aspect was your main concern with this method -- not necessarily who wrote the client because there are plenty of other clients.)

Re: Let’s Encrypt to transition to ISRG root

#58

Post by zAy0LfpBZLC8mAC »

michaelt wrote: post #40
jlgaddis wrote: post #34

Earlier quoted context omitted.

The greatest motivator of all, money!

How much money are we talking here? Because most businesses, if you ask them "How much $$$ to destroy your business?" will respond "absolutely loads"

But that wasn't the question. The question was "How much money do you want from us before we destroy your business?"

For one, there are so many CAs that could potentially cross-sign, it's unlikely none will "defect" and take the opportunity to earn some money, but also, if none had cross-signed, they simply would have started later with their own root-cert, destroying the business anyway, so that's another reason to earn some money while you can.

Re: Let’s Encrypt to transition to ISRG root

#59

Post by blattimwind »

tialaramex wrote: post #55
michaelt wrote: post #29

So what motivates one CA to cross-sign another? I would have thought, if you were a CA you'd prefer not to enable your competitors - especially one who's planning to give away the product for free.

I don't think anybody at Let's Encrypt has spoken on this topic, but in their case specifically there are both moral and pragmatic reasons to choose to cross-sign. Morally is the easy one. If you work for a public CA you presumably think that the Web PKI is a good idea, and Let's Encrypt helped bring that benefit to lots more users, so that's a good thing. Consider the question of whether McDonalds should support a l…

AIUI IdenTrust was set-up as a sort of self-servicing entity by banks mostly for banks and their clients, so IdenTrust probably doesn't really care too much about classic web CA business.

Re: Let’s Encrypt to transition to ISRG root

#60

Post by _0w8t »

founderling wrote: post #28
watermelon0 wrote: post #10

Earlier quoted context omitted.

Hard in what way? Using my favorite client/library ( https://go-acme.github.io/lego/ ) I can generate wildcard cert with: lego \ --email="info@example.com" \ --accept-tos \ --path="./ssl" \ --domains="*.example.com" \ --dns="route53" (AWS credentials need to be available in the environment)

So you need to execute 3rd party software on your machine and let it fiddle with your DNS settings? Personally, I would not want to do that.

In this case the third-party software implements a public protocol, comes with a full source written in a very readable language and is sufficiently small to permit a casual review.
Post reply on HN