Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

61–70 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#61

Post by alibarber »

progbits wrote: post #56
xg15 wrote: post #47

IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.

I mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.

Also I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert?

There would be no way of determining that I can connecting to my-organisation's 10.0.0.1 and not bad-org's 10.0.0.1.

Re: 6-Day and IP Address Certificates Are Generally Available

#62

Post by jsheard »

alibarber wrote: post #57
bigstrat2003 wrote: post #38

Earlier quoted context omitted.

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

Well they offer a money-back guarantee. And other providers of SSL certificates exist.

For better or worse the push down to 47-day certificates is an industry-wide thing, in a few years no provider will issue certificates for longer than that.

Nobody is being forced to use 6-day certs for domains though, when the time comes Let's Encrypt will default to 47 days just like everyone else.

Re: 6-Day and IP Address Certificates Are Generally Available

#64

Post by cryptonector »

razakel wrote: post #60

Has anyone actually given a good explanation as to why TLS Client Auth is being removed?

One reason is that the client certificate with id-kp-clientAuth EKU and a dNSName SAN doesn't actually authenticate the client's FQDN. To do that you'd have to do something of a return routability check at the app layer where the server connects to the client by resolving its FQDN to check that it's the same client as on the other connection. I'm not sure how seriously to take that complaint, but it's something.

Re: 6-Day and IP Address Certificates Are Generally Available

#68

Post by mholt »

qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

It's less about IP address transience, and more about IP address control. Rarely does the operator of a website or service control the IP address. It's to limit the CA's risk.

Re: 6-Day and IP Address Certificates Are Generally Available

#69

Post by londons_explore »

charcircuit wrote: post #41

Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .onion has a key pair for it, so proving ownership is more trustworthy than even DNS.

But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?

Re: 6-Day and IP Address Certificates Are Generally Available

#70

Post by wang_li »

Sohcahtoa82 wrote: post #45
bigstrat2003 wrote: post #38

Earlier quoted context omitted.

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.

My browser on my work laptop has 219 root certificates trusted. Some of those may be installed from my employer, but I suspect most of them come from MS as it's Edge on Windows 11. I see in that list things like "Swedish Government Root Authority" "Thailand National Root Certification Authority" "Staat der Nederlanden Root CA" and things like "MULTICERT Root Certification Authority" "ACCVRAUZ1". I don't think there is any reason to believe any certificate. If a government wants a cert for a given DNS they will get it, either because they directly control a trusted root CA, or because they will present a warrant to a company that wants to do business in their jurisdiction and said company will issue the cert.

TLS certs should be treated much more akin to SSH host keys in the known hosts file. Browsers should record the cert the first time they see it and then warn me if it changes before it's expiration date, or some time near the expiration date.

Post reply on HN