Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

51–60 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#51

Post by buzer »

jeroenhd wrote: post #34
iamrobertismo wrote: post #4

This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.

One thing this can be useful for is encrypted client hello (ECH), the way TLS/HTTPS can be used without disclosing the server name to any listening devices (standard SNI names are transmitted in plaintext). To use it, you need a valid certificate for the connection to the server which has a hostname that does get broadcast in readable form. For companies like Cloudflare, Azure, and Google, this isn't really an issue,…

As far as I understand you cannot use IP address as the outer certificate as per https://www.ietf.org/archive/id/draft-ietf-tls-esni-25.txt

> In verifying the client-facing server certificate, the client MUST interpret the public name as a DNS-based reference identity [RFC6125]. Clients that incorporate DNS names and IP addresses into the same syntax (e.g. Section 7.4 of [RFC3986] and [WHATWG-IPV4]) MUST reject names that would be interpreted as IPv4 addresses.

Re: 6-Day and IP Address Certificates Are Generally Available

#53

Post by Sohcahtoa82 »

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

> Are IP addresses more transient than a domain within a 45 day window?

If I don't assign an EIP to my EC2 instance and shut it down, I'm nearly guaranteed to get a different IP when I start it again, even if I start it within seconds of shutdown completing.

It'd be quite a challenge to use this behavior maliciously, though. You'd have to get assigned an IP that someone else was using recently, and the person using that IP would need to have also been using TLS with either an IP address certificate or with certificate verification disabled.

Re: 6-Day and IP Address Certificates Are Generally Available

#54

Post by charcircuit »

buckle8017 wrote: post #48
charcircuit wrote: post #43

Earlier quoted context omitted.

>I won't have time to fix this Which should push you to automate the process.

He's expressly talking about broken automation.

You can have automation to fix the broken automation.

Re: 6-Day and IP Address Certificates Are Generally Available

#55

Post by [deleted] »

ivanr wrote: post #3

As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yesterday. Here's what worked for me: lego --domains 206.189.27.68 --accept-tos --http --disable-cn run --profile shortlived [1] https://go-acme.github.io/lego/

[deleted]

Re: 6-Day and IP Address Certificates Are Generally Available

#56

Post by progbits »

xg15 wrote: post #47

IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.

I mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.

Re: 6-Day and IP Address Certificates Are Generally Available

#57

Post by alibarber »

bigstrat2003 wrote: post #38
qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

Well they offer a money-back guarantee. And other providers of SSL certificates exist.

Re: 6-Day and IP Address Certificates Are Generally Available

#58

Post by Sohcahtoa82 »

meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

What's stopping you from creating a "localhost.mydomain.com" DNS record that initially resolves to a public IP so you can get a certificate, then copying the certificate locally, then changing the DNS to 127.0.0.1?

Other than basically being a pain in the ass.

Re: 6-Day and IP Address Certificates Are Generally Available

#59

Post by saltcured »

traceroute66 wrote: post #24
axus wrote: post #6

Earlier quoted context omitted.

No dependency on a registrar sounds nice. More anonymous.

> No dependency on a registrar sounds nice. Actually the main benefit is no dependency on DNS (booth direct and root). IP is a simple primitive, i.e. "is it routable or not ?".

The popular HTTP validation method has the same drawback whether using DNS or IP certificates? Namely, if you can compromise routes to hijack traffic, you can also hijack the validation requests. Right?
Post reply on HN