Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt to transition to ISRG root

scotthelme.co.uk

Post reply on HN
Print view View original

61–70 of 114 posts

Re: Let’s Encrypt to transition to ISRG root

#61

Post by kalleboo »

Fradow wrote: post #30
p4bl0 wrote: post #6

Earlier quoted context omitted.

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?

Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…

- FAIL on a Kindle Fire 7 (which is still for sale new) in Chrome running the latest update from November 2018 [based on Android 5.1.1].

Re: Let’s Encrypt to transition to ISRG root

#62

Post by pas »

cyphar wrote: post #56
founderling wrote: post #28

Earlier quoted context omitted.

So you need to execute 3rd party software on your machine and let it fiddle with your DNS settings? Personally, I would not want to do that.

They now support wildcards, but in order to verify you are authorised to get a wildcard certificate you need to be able to pass the DNS challenge. Unfortunately there simply isn't another universal, trust-less (and automatable) way of verifying that someone owns a domain -- other than DNS. However, because the DNS check doesn't require writing to the webroot, you could run this on any server you like and then distrib…

Hm, doesn't Caddy support wildcards without DNS auth? It seems that they work around this by generating a few random subdomains and verify those.

Re: Let’s Encrypt to transition to ISRG root

#63

Post by shawnz »

tcd wrote: post #52
londons_explore wrote: post #42

Earlier quoted context omitted.

The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…

If you want to use an old, unsupported OS then don't expect support. Expecting XP or say Windows 98 to still work on modern day standards is just laughable. Upgrade, or get left behind. The concept of 'never updating' isn't one that is practical and you'll pay the penalty for it later on.

Consider that for mobile users, updated software might not be available for their hardware and they might not be able to afford new hardware.

Re: Let’s Encrypt to transition to ISRG root

#64

Post by theandrewbailey »

rocqua wrote: post #27

I'm not an expert of certificates, but some quick skimming of https://tools.ietf.org/html/rfc5280#section-4.1 suggests that a certificate only references the issuer certificate by name. Since, according to the article, the two different Lets encrypt intermediates have the same key, and the same name, they are interchangeable? As in, could I just replace the intermediate in my cert-chain and have everything continue s…

Yes, they are interchangeable.

On my blog ( https://theandrewbailey.com/ ), I have a "health check" page that includes all available trust chains. For my Let's Encrypt certificate, it shows 2: one through an intermediate to the DST Root, and another intermediate to the ISRG Root. I can verify that both exist and are used (though one certificate and intermediate are loaded and served): the current Firefox release (and all other browsers I've tried) uses the DST root, but Firefox Developer Edition uses the ISRG root.

It seems to make sense: certificates don't sign certificates, keys sign certificates (more specifically, certificate requests). I don't see an obvious reason that a single certificate request can't be signed more than once. If one is, trust should flow through either certificate, since the certificate says that the signer verified that the holder has the associated private key, and if that private key signed another certificate, it should not matter which intermediate the trust goes through, so long as the root on the other end is trusted.

Re: Let’s Encrypt to transition to ISRG root

#65

Post by aroch »

pas wrote: post #62
cyphar wrote: post #56

Earlier quoted context omitted.

They now support wildcards, but in order to verify you are authorised to get a wildcard certificate you need to be able to pass the DNS challenge. Unfortunately there simply isn't another universal, trust-less (and automatable) way of verifying that someone owns a domain -- other than DNS. However, because the DNS check doesn't require writing to the webroot, you could run this on any server you like and then distrib…

Hm, doesn't Caddy support wildcards without DNS auth? It seems that they work around this by generating a few random subdomains and verify those.

From the Caddy release announcement that supports wildcards[1]:

"This release introduces support for wildcard certificates, a new offering from Let's Encrypt. Getting a wildcard certificate requires enabling the DNS challenge. Fortunately, that is extremely simple with Caddy, and it works with over 20 different providers!"

1: https://caddyserver.com/blog/caddy-0_10_12-released

Re: Let’s Encrypt to transition to ISRG root

#66

Post by cyphar »

pas wrote: post #62
cyphar wrote: post #56

Earlier quoted context omitted.

They now support wildcards, but in order to verify you are authorised to get a wildcard certificate you need to be able to pass the DNS challenge. Unfortunately there simply isn't another universal, trust-less (and automatable) way of verifying that someone owns a domain -- other than DNS. However, because the DNS check doesn't require writing to the webroot, you could run this on any server you like and then distrib…

Hm, doesn't Caddy support wildcards without DNS auth? It seems that they work around this by generating a few random subdomains and verify those.

Caddy requires configuring their DNS provider as well[1]. LetsEncrypt (and ACMEv2) only allow you to get a wildcard if you use the dns-01 challenge.

[1]: https://caddyserver.com/docs/automatic-https#wildcards

Re: Let’s Encrypt to transition to ISRG root

#67

Post by pard68 »

shawnz wrote: post #63
tcd wrote: post #52

Earlier quoted context omitted.

If you want to use an old, unsupported OS then don't expect support. Expecting XP or say Windows 98 to still work on modern day standards is just laughable. Upgrade, or get left behind. The concept of 'never updating' isn't one that is practical and you'll pay the penalty for it later on.

Consider that for mobile users, updated software might not be available for their hardware and they might not be able to afford new hardware.

Work for a university. We have a number of students in Africa, southeast Asia, and eastern Europe taking online courses. We do not support Windows XP or Vista, except for in the case of these students. Some of these guys don't have the resources for anything else.

I also know that we get a number of students connecting with Android v3 or earlier from these same locales.

Re: Let’s Encrypt to transition to ISRG root

#68

Post by jeroenhd »

Fradow wrote: post #30
p4bl0 wrote: post #6

Earlier quoted context omitted.

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?

Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…

As a tip to you/your company: unlike Chrome and most Chrome-based browsers, Firefox for Android has a separate root certificate store and your old devices will still be able to access Letsencrypt websites if you switch browsers.

Re: Let’s Encrypt to transition to ISRG root

#69

Post by isostatic »

tcd wrote: post #52
londons_explore wrote: post #42

Earlier quoted context omitted.

The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…

If you want to use an old, unsupported OS then don't expect support. Expecting XP or say Windows 98 to still work on modern day standards is just laughable. Upgrade, or get left behind. The concept of 'never updating' isn't one that is practical and you'll pay the penalty for it later on.

Anyone running XP or whatever for a good reason will be able to install the new root certificate

Re: Let’s Encrypt to transition to ISRG root

#70

Post by aeorgnoieang »

founderling wrote: post #5

Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.

From [Rate Limits - Let's Encrypt - Free SSL/TLS Certificates](https://letsencrypt.org/docs/rate-limits/):

> If you have a lot of subdomains, you may want to combine them into a single certificate, up to a limit of 100 Names per Certificate. Combined with the above limit, that means you can issue certificates containing up to 5,000 unique subdomains per week.

Post reply on HN