ISRG stands for Internet Security Research Group.
thanks! i was amazed how this information is buried and how they assume everyone should know what ISRG means.
Let’s Encrypt to transition to ISRG root
71–80 of 114 posts
Re: Let’s Encrypt to transition to ISRG root
#72Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.
Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…
I have servers that are firewalled off from the wider internet, or indeed not even reachable (rfc1918 ips)
I could get around it by hosting split dns, but that’s quite messy
Even on those that are reachable I’d have to carve out port 80 and forward it somewhere else to do the cert generation.
Another option would be dynamic server names - where the host part contains a lot of information (or no info)
https://gafjsisi.slashdot.org I suspect has never been loaded before today. It seems to work from my phone so I assume it’s a wildcard cert
Re: Let’s Encrypt to transition to ISRG root
#73Is it still hard to do wildcard certs with them? That is one of the reasons I don't use let's encrypt.
Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…
Also, if you own a very big amount of subdomains (say > 100), you want to minimize the number of certificates you want to manage/renew for easier maintenance and renewal.
Re: Let’s Encrypt to transition to ISRG root
#74Earlier quoted context omitted.
They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?
Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…
This will indeed be a problem. Many old devices still run fine; outside of a password submission page, is https really worth the hundreds of dollars it would cost to replace my devices? I really don't know why people feel the need to get latest Android; outside of security, it's just gimmicks.
Re: Let’s Encrypt to transition to ISRG root
#75Earlier quoted context omitted.
Is there still a valid use-case for wildcard certificates when using Lets Encrypt? AFAIK wildcards were used for financial reasons and laziness (since the traditional method of acquiring a cert was cumbersome), but with LE none of those arguments make sense. Why not just fetch a different cert for every subdomain you use? It's also better security practice as this allows you to use different key per subdomain and the…
Also, if you own a very big amount of subdomains (say > 100), you want to minimize the number of certificates you want to manage/renew for easier maintenance and renewal.
I don't agree on this one. The whole point of the ACME protocol is that it allows for automated certificate management. Thus, it shouldn't matter if you manage 1 of 10000 subdomains, because you should automate it anyway.
Also, if for some reason the automated process fails, I'd rather have one subdomain go down, than all of them.
Re: Let’s Encrypt to transition to ISRG root
#76Earlier quoted context omitted.
They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?
Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…
Tried the test site on a Nexus 7 running Android 6.0.1, Firefox was ok (seems it ships with its own list of roots), but latest Chrome rejected it.
My wife runs a blog which generates substantial income and uses certs from Let's Encrypt. It's a non-tech blog with primarily US readership. Checking stats for this month, 7% of all visitors were using Android 4/5/6 (20% of all Android users). The percentage of users on old Android running Firefox was basically nil. Losing all these users would be very costly.
Hopefully certbot will be modified so it is possible to pick the current intermediate during automatic renewal. If I have to do a manual operation to switch intermediates each time the cert renews (currently done by cronjob) then it is probably safer (operationally speaking) to just buy a cert.
I don't really understand why Let's Encrypt is making this change now. Sure, the current root is expiring "soon", but not until September 2021. Switching roots could be safely pushed off to early 2021 at which point hopefully most of these older Androids would be cycled out.
Re: Let’s Encrypt to transition to ISRG root
#77Earlier quoted context omitted.
I was eating breakfast with a multitude of Android phones around me and four "older ones" could not access that site. The oldest that could connect was ~5 months old, all using new Mobile Chrome versions.
The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…
Most industrial devices and even consumer kiosks probably access sites that are under the control of the device's owner or manufacturer. So the sites can just use self-signed certificates in the first place.
Or, for industrial use a hundred bucks on a certificate from an older CA is nothing.
Re: Let’s Encrypt to transition to ISRG root
#78ISRG stands for Internet Security Research Group.
This is in their latest blog post "Christine expands our board’s global perspective with her career experience. She worked for many years in the Australian government" I was wondering what impact if she, a board member of ISRG, has to comply with the Australian encryption laws?
Not that I actually would be at all, but hypothetical I would be more concerned with them hiring an Australian engineer than adding an Australian board member. What is the board member going to do to compromise operational security?
Re: Let’s Encrypt to transition to ISRG root
#79Earlier quoted context omitted.
Tested on a few tablets my company sell / used to sell : - FAIL Galaxy Tab 4 7" (SM-T230) Android 4.4.2 - FAIL Galaxy Tab A 7" 2016 (SM-T280) Android 5.1.1 - SUCCESS Galaxy Tab A 9.7" (SM-T550) Android 7.1.1 - SUCCESS Galaxy Tab A 10.1" (SM-T580) Android 8.1.0 I don't have any Android 6 device at hand, but this is consistent with @regecks statement "On Android, the root was first added in Nougat" (which is Android 7)…
As a tip to you/your company: unlike Chrome and most Chrome-based browsers, Firefox for Android has a separate root certificate store and your old devices will still be able to access Letsencrypt websites if you switch browsers.
Thank you for the tip.
The issue is not so much about the browser, as I'm an app editor (which happens to also sell tablets with our apps preinstalled to reduce friction). The issue is that apps that rely on the device certificate store aren't going to be able to use https with a server using a Let's Encrypt certificate issued with the new root CA.
Shipping a root certificate store would be (for my scale) a bad practice. I made the mistake of pinning a SSL key in the past, never again (you run into issues when your clients never even connect the device to the internet in 3+ years, and then your updater doesn't work anymore).
Fortunately for me, I don't currently use Let's Encrypt for my API servers, and that news was the last straw to make the boss decide we will stop selling Android 5 devices.
Unfortunately, this means our users who recently bought those devices will have some third-party apps might be broken starting 9th of July, and some sites will give a scary warning.
Re: Let’s Encrypt to transition to ISRG root
#80They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.
On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks. To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017). On iOS, it was first added in iOS 10 (2016).…
That page seems to be out of date. I've filed an issue asking them to update it: https://community.letsencrypt.org/t/please-update-the-certif...