Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

61–70 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#61

Post by superkuh »

staticassertion wrote: post #31
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

>are not harming others

How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context.

The burden is real and completely unecessary for personal websites. This makes the web more commercial by imposing commercial requirements on everyone.

It's what killed off self-signing as a speed bump against massive surveillance and centralized everyone into the benign dictactorship of letsencrypt. But centralization will lead to problems when money is involved. Just look at dot org.

The real harm comes from this fetishism of commercial/institutional security models.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#62

Post by londons_explore »

Avamander wrote: post #43
altfredd wrote: post #36

Earlier quoted context omitted.

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

CAs are resting all and every changes because it's easier, it makes sense.

CA's are resisting because the only person to buy from them is someone who can't set up certbot and lets-encrypt. As soon as they cant issue for longer than a year, their market is being whittled away.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#63

Post by cm2187 »

jlgaddis wrote: post #58
cm2187 wrote: post #52

Does it also apply to certs issued by a private/own CA or just public certificates?

EDIT: Sorry, replied to the wrong comment! --- cf. https://support.apple.com/en-us/HT211025 : > This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. > This change will not affect certificates issued from user-added or administrator-added Root CAs.

But what about Chromium and Mozilla?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#64

Post by staticassertion »

superkuh wrote: post #61
staticassertion wrote: post #31

Earlier quoted context omitted.

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

>are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by im…

> It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context.

I did miss that but I did not assume a business context.

> The burden is real and completely unecessary for personal websites.

Users who visit your website are still at risk of having their connection hijacked - they could be phished, exploited, etc. This is maybe not something you consider important, it is certainly a sort of "boil the ocean" approach, but given the efforts put in up until this point I think it's already the case that most users are probably not visiting HTTP sites on the average day. Continuing that effort seems reasonable.

> This makes the web more commercial by imposing commercial requirements on everyone.

I'm not sure what you mean.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#65

Post by dharmab »

paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days.

If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#66

Post by xg15 »

dharmab wrote: post #65
paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

Without buying a domain. (and continously spending money to keep it owned)

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#67

Post by dharmab »

xg15 wrote: post #66
dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

Without buying a domain. (and continously spending money to keep it owned)

Run your own CA internally and handle the CA distribution problem with MDM tools.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#69

Post by zozbot234 »

brnt wrote: post #45
altfredd wrote: post #36

Earlier quoted context omitted.

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

Will browsers start allowing self signed certificates though?

Aren't they allowed already, with a click-thru warning screen? And you can also choose to trust them permanently, aka trust on first use.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#70

Post by mschuster91 »

lixtra wrote: post #59
kspacewalk2 wrote: post #38

Earlier quoted context omitted.

What are some valid reasons not to use LetsEncrypt?

If Letsencrypt was the only CA left I would call it a big failure. Without a choice there cannot be trust.

LE is open standard, any CA can decide to implement it.
Post reply on HN