Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LetsEncrypt Outage

letsencrypt.status.io

Post reply on HN
Print view View original

51–60 of 112 posts

Re: LetsEncrypt Outage

#51

Post by schoen »

CGamesPlay wrote: post #48
kyrra wrote: post #8

Earlier quoted context omitted.

Many of the cloud providers give free certs via acme. https://cloud.google.com/certificate-manager/docs/public-ca-... (EDIT: Google is their own CA, with https://pki.goog/ ) The browsers and security people have been pushing towards shorter certs, not longer ones. Knowing how to rotate a cert every year, if not shorter, helps when your certificate or any of your parent certs are compromised and require an emergency r…

Does AWS provide something similar? I found ACM "exportable certificates", but that involves AWS managing your private key.

Last I knew, AWS would issue a free certificate to people using certain AWS services, but, as you say, only if Amazon is managing the private key. You can also use ACM APIs to import keys and certificates from other CAs.

Re: LetsEncrypt Outage

#52

Post by phillipseamore »

rocqua wrote: post #31
phillipseamore wrote: post #14

I want DANE!

That ship has sailed. DNSsec is not liked even a little bit. Given that control over DNS is how domain validated certs are handed out, it would make a lot of sense to cut out the middle man. But DNS does not have a good reliable authenticated transport mechanism. I wonder if there was a way to build this that would have worked.

My biggest problem is how centralized issuance is.

Half the year I live on an island that is reliant on submarine cables and has historically had weeks and months long outages and with a changing world I suspect that might become reality once again. Locally this wasn't much of an issue, the ccTLD continues to function, most services (but now about 35%) are locally hosted. Then HTTPS comes along. Zero certificates could be (re-)issued during an outage. A locally run CA isn't really an option (standalone simply isn't feasible and getting into root stores takes time and money), so you are left with teaching users to ignore certificate errors a few weeks into an extended outage.

I could see someone like LE working with TLD registrars to enable local issuance (with delegated/sub-CA certificates restricted to the TLD), that could also mitigate problems like today (decentralize issuance) and the registrars are already the primary source of truth for DV validation.

Re: LetsEncrypt Outage

#53

Post by andrewmcwatters »

mixdup wrote: post #26
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

They have been communicating the ending of the email notices for quite a while and have been telling users that you should have some other monitoring in place to avoid just this situation

Yes, but what’s weird is the recommended service they referred people to for new email notifications was not… sending me emails.

So, what gives?

Re: LetsEncrypt Outage

#54

Post by RiverCrochet »

keysdev wrote: post #7

Shall we have some way of freely encrypting the web that is relying on one authority? Especially something that needed to be renewed every 90 or is it 40 days now. How about issuing 100 years certificates as a default?

Long expiration times = compromised certs that hang around longer than they should. It's bad.

Note that you can make your own self-signed CA certificate, create any server and client certificates you want signed with that CA cert, and deploy them whenever and wherever you want. Of course you want the root CA private key securely put somewhere and all that stuff.

The only reason it won't work at large without a bit of friction is because your CA cert isn't in the default trusted root store of major browsers (phone and PC). It's easy enough to add it - it does pop up warnings and such on Windows, Android, iOS and hopefully Mac OS X, but they're necessary here.

No, it's not going to let the whole world do TLS with you warning-free without doing some sort of work, but for small scales (the type that Let's Encrypt is often used for anyway) it's fine.

Re: LetsEncrypt Outage

#55

Post by tialaramex »

0xbadcafebee wrote: post #28
keysdev wrote: post #7

Shall we have some way of freely encrypting the web that is relying on one authority? Especially something that needed to be renewed every 90 or is it 40 days now. How about issuing 100 years certificates as a default?

The bigger question that's going unasked: what the hell is the point of an expiration date if it keeps getting shorter? At some point we will refresh the cert every second. The whole point of the expiration is in case a hacker gets the private key to the cert and can then MITM, they can keep MITMing successfully until the cert the hacker gives to the clients expires (or was revoked by something like OCSP, assuming th…

> The whole point of the expiration is in case a hacker gets the private key to the cert and can then MITM

Nope. So all that happened here is that you were wrong.

Re: LetsEncrypt Outage

#56

Post by greyface- »

NooneAtAll3 wrote: post #41
ocdtrekkie wrote: post #32

Earlier quoted context omitted.

I think I am going to become a fan of shorter certificate lifetimes because as soon as the chuckleheads in the CAB truly break the Internet on the level they are pushing for, the sooner we get to discard the entire PKI dumpster fire.

what's the alternative to PKI?

https://en.wikipedia.org/wiki/Decentralized_identifier

Re: LetsEncrypt Outage

#57

Post by haiku2077 »

NooneAtAll3 wrote: post #41
ocdtrekkie wrote: post #32

Earlier quoted context omitted.

I think I am going to become a fan of shorter certificate lifetimes because as soon as the chuckleheads in the CAB truly break the Internet on the level they are pushing for, the sooner we get to discard the entire PKI dumpster fire.

what's the alternative to PKI?

Certainly something a hell of a lot simpler then x509 - and without assumptions from the 1990s hardcoded into it

Re: LetsEncrypt Outage

#58

Post by benlivengood »

Hopefully the thundering herd when service is restored doesn't knock things offline again. I know LE designs for huge throughput (something like 3X total outstanding certificates in 24 hours, at one point) and the automated client recommendations for backoff are pretty good, but there will be a lot of manual applications/renewals I'm sure.

Re: LetsEncrypt Outage

#59

Post by mr_toad »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Isn’t the recommended practice to update every ~60 days or so, regardless?

Re: LetsEncrypt Outage

#60

Post by adamcharnock »

pgporada wrote: post #24

It's DNS, we're working on it. Sorry, thank you for bearing with us.

It's always either DNS or MTU.

(Or, as I recently encountered, it can also be a McAfee corporate firewall trying to be helpful by showing a download progress bar in place of an HTTP SSE stream. I was sure that was being caused by MTU, but alas no.)

Post reply on HN