Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LetsEncrypt Outage

letsencrypt.status.io

Post reply on HN
Print view View original

71–80 of 112 posts

Re: LetsEncrypt Outage

#71

Post by hoherd »

rfv6723 wrote: post #64
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

I use self-hosted gatus to monitor my certs and other services' status. It can send alerts to multiple alerting providers. https://github.com/TwiN/gatus

I use uptime-kuma[1] with notifications sent out through the included Apprise integration[2]

1. https://github.com/louislam/uptime-kuma

2. https://github.com/caronc/apprise

Re: LetsEncrypt Outage

#72

Post by trinsic2 »

deadbabe wrote: post #36
Titan2189 wrote: post #29

Earlier quoted context omitted.

It's not DNS There's no way it's DNS It was DNS

Five stages of DNS outage: 1. Denial: It’s not DNS. 2. Anger: What the fuck is it! 3. Bargaining: Maybe it’s a firewall, or Cloudflare! 4. Depression: We’ve checked everything… 5. Acceptance: It’s DNS.

LOL. I just went though this the other day. my site was intermittently non-accessible. DNS was the last thing I thought it was until I ran a crawler on my site and spotted some 404 errors. Found that my non-www. url was pointed at the wrong IP and I forgot to update it when I transfered my domain to a new host.

Re: LetsEncrypt Outage

#73

Post by superkuh »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

If it's a personal website you should consider HTTP+HTTPS. It offers the best of both worlds and your website would always be accessible even if some third party CA is not (or if there's some local issue, or if the HTTP client connecting has cert issues). MITM attacks on personal websites are extremely, extremely rare.

Re: LetsEncrypt Outage

#74

Post by phillipseamore »

ocdtrekkie wrote: post #70
phillipseamore wrote: post #52

Earlier quoted context omitted.

My biggest problem is how centralized issuance is. Half the year I live on an island that is reliant on submarine cables and has historically had weeks and months long outages and with a changing world I suspect that might become reality once again. Locally this wasn't much of an issue, the ccTLD continues to function, most services (but now about 35%) are locally hosted. Then HTTPS comes along. Zero certificates cou…

Realistically there's no reason except Google retaining centralized control of the Internet for there to be a specific group of trusted CAs that meet Google's arcane specifications which can issue certificates the entire world trusts. Your registrar should be able to validate your ownership of the domain, ergo your registrar should be your CA. Instead of a bunch of arbitrary and capricious rules to be trusted, a CA s…

s/Google/Apple, Google, Microsoft, and Mozilla/

Re: LetsEncrypt Outage

#76

Post by 0xbadcafebee »

schoen wrote: post #50
0xbadcafebee wrote: post #28

Earlier quoted context omitted.

The bigger question that's going unasked: what the hell is the point of an expiration date if it keeps getting shorter? At some point we will refresh the cert every second. The whole point of the expiration is in case a hacker gets the private key to the cert and can then MITM, they can keep MITMing successfully until the cert the hacker gives to the clients expires (or was revoked by something like OCSP, assuming th…

The other benefit of expiration dates in a PKI is in case the subject information is no longer accurate. In old-school X.509 PKI this might be "in case this person is no longer affiliated with the issuer" (for organizational PKI) or "in case this contact information for this person is otherwise no longer accurate". In web PKI this might be "in case this person no longer controls this domain name" or "in case this per…

TLS 1.0, 1.1 and 1.2 are still in use, despite 1.0 and 1.1 being deprecated, and only 1.3 requires forward secrecy. So any attacker that can MITM can just force a protocol that doesn't require forward secrecy.

In terms of "no longer controls this domain name", or "no longer controls this IP address", there are a raft of other issues related to this that expiration doesn't cover:

- Does the real domain owner still have a DNS record pointing to an IP address they no longer own? If yes, attacker that now has that IP can serve valid TLS.

- Does the attacker control either the registrar account, or the name server account, or can poison DNS, or an HTTP server, or an email server, or BGP? If yes, the attacker can make new certs.

There's so many holes in TLS it's swiss cheese. Expiration as security is like a cardboard box as a bulletproof vest. Yet that cardboard box is so bulky and cumbersome it makes normal life worse.

Re: LetsEncrypt Outage

#77

Post by zerof1l »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Because you're not supposed to rely on emails. You should have an automated certificate renewal in place. I'm under the impression that Let's Encrypt wants to reduce certificate validity even further from the current 90 days.

Re: LetsEncrypt Outage

#78

Post by ffsm8 »

tbrownaw wrote: post #63
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)?

Yes, we had lengthy discussions in itops (I had a admin role when LE was launched) about it.

The team lead couldn't get over the slogan "devops, automating downtimes since 2010" whenever someone wanted to add a new nonessential automation that does things on prod servers.

I mean he wasn't completely wrong, it was a non essential automation with high risk and very little reward (<1h saved every 2 yrs), which is why we never switched to LE for our main site, only internal tooling was allowed to use it

Re: LetsEncrypt Outage

#79

Post by cpach »

ffsm8 wrote: post #78
tbrownaw wrote: post #63

Earlier quoted context omitted.

Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)?

Yes, we had lengthy discussions in itops (I had a admin role when LE was launched) about it. The team lead couldn't get over the slogan "devops, automating downtimes since 2010" whenever someone wanted to add a new nonessential automation that does things on prod servers. I mean he wasn't completely wrong, it was a non essential automation with high risk and very little reward (<1h saved every 2 yrs), which is why we…

Perhaps you know this already but in the future, certs issued by a “real” CA will not be allowed to live for more than 47 days.

https://www.digicert.com/blog/tls-certificate-lifetimes-will...

Re: LetsEncrypt Outage

#80

Post by cpach »

mr_toad wrote: post #59
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Isn’t the recommended practice to update every ~60 days or so, regardless?

Either that, or use an ACME client that has support for ARI so that the CA can signal to the client when it’s time to renew.

https://letsencrypt.org/2024/04/25/guide-to-integrating-ari-...

Post reply on HN