Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Decreasing Certificate Lifetimes to 45 Days

letsencrypt.org

Post reply on HN
Print view View original

71–80 of 158 posts

Re: Decreasing Certificate Lifetimes to 45 Days

#71

Post by nine_k »

imtringued wrote: post #65
homebrewer wrote: post #52

Earlier quoted context omitted.

In circles I'm running in, automatic certificate renewal has not caused a single problem over 7 years of using it, and whatever time was spent on setting it up, has paid many times over, both in saving effort on renewal, and in putting out fires when (not if ) someone forgets to renew a certificate. You just have to be careful picking your automation — I haven't been impressed with certbot, for example. Also, everyth…

Forcing automation would be fine if the default software package (certbot) was any good but from my experience certbot is simply not fit for purpose. Certbot doesn't support the industry standard PKCS#12 format, which makes it extremely brittle for anyone using a Java based webserver. Instead it uses the non-standard PEM format which requires conversion before usage. That conversion step breaks all the time and requi…

PEM is very standard. Calling `openssl pkcs12` also should not be hard; IDK about certbot, but there is a hook for acmetool (which I use) that does just that for you: https://github.com/dlitz/acmetool-pkcs12-hooks

Re: Decreasing Certificate Lifetimes to 45 Days

#72

Post by cpach »

bananapub wrote: post #70
redrove wrote: post #16

Earlier quoted context omitted.

Big news for both the lazy homelab admin that can set a TXT once and ultimately be more secure without spraying DNS Zone Edit tokens all over their infra AND for the poor enterprise folks that have to open a ticket and wait 3 weeks for a DNS record.

a perhaps non-obvious option is to CNAME (or NS) the `_acme_challenge` record from your main zone to another zone you can control better and can't affect production traffic the same way the main zone could. `acme-dns` is a neat little tool for exactly this, that has an https api for your ACME client to request a cert from, and a dns server to respond to dns-01 challenges from your provider.

Yep, being able to “redirect” the “challenge record” is very handy in some cases. Did a writeup here with some examples of how it can be arranged: https://hsm.tunnel53.net/article/dns-for-acme-challenges/

Re: Decreasing Certificate Lifetimes to 45 Days

#73

Post by [deleted] »

ZeroConcerns wrote: post #21
crote wrote: post #14

Earlier quoted context omitted.

It's not single-vendor. The ACME protocol is also supported by the likes of GlobalSign, Sectigo, and Digicert. You've got to remember that the reduction to a 45-day duration is industry-wide - driven by the browsers. Any CA not offering automated renewal (which in practice means ACME) is going to lose a lot of customers over the next few years.

Effectively single-vendor. I'm not aware of any ACME-compatible CAs that don't have pernicious limits on their free plans (and if there are, I'd love to hear!), and here in the EU we've even recently lost a rather big player...

[deleted]

Re: Decreasing Certificate Lifetimes to 45 Days

#74

Post by mkj »

flowerthoughts wrote: post #27
secret-noun wrote: post #4

> The key advantage of [DNS-PERSIST-01] is that the DNS TXT entry used to demonstrate control does not have to change every renewal. > We expect DNS-PERSIST-01 to be available in 2026 Very exciting! https://datatracker.ietf.org/doc/html/draft-sheurich-acme-dn...

This replaces an anonymous token with a LetsEncrypt account identifier in DNS. As long as accounts are not 1:1 to humans, that seems fine. But I hope they keep the other challenges. I really would have felt better with a random token that was tied to the account, rather than the account number itself. The CA side can of course decide to implement it either way , but all examples are about the account ID.

That seems worth suggesting to the acme working group mailing list, if it hasn't already been discussed there.

Re: Decreasing Certificate Lifetimes to 45 Days

#75

Post by ndsipa_pomu »

mike_d wrote: post #31

I understand all of the benefits with regards to compromise and pushing automation, but I really hope they don't push the maximum lower. It is already getting dangerously close to the duration of holiday freeze windows, compliance/audit enforced windows, etc. Not to mention the undue bloat of CT logs.

> It is already getting dangerously close to the duration of holiday freeze windows, compliance/audit enforced windows, etc.

How do those affect automated processes though? If the automation were to fail somehow during a freeze window, then surely that would be a case of fixing a system and thus not covered by the freeze window.

> Not to mention the undue bloat of CT logs.

I'm not sure what you mean by "CT logs", but I assume it's something to do with the certificate renewal automation. I can't see that you'd be creating GBs of logs that would be difficult to handle. Even a home-based selfhosted system would easily cope with certificate logs from running it hourly.

Re: Decreasing Certificate Lifetimes to 45 Days

#76

Post by cpach »

imtringued wrote: post #65
homebrewer wrote: post #52

Earlier quoted context omitted.

In circles I'm running in, automatic certificate renewal has not caused a single problem over 7 years of using it, and whatever time was spent on setting it up, has paid many times over, both in saving effort on renewal, and in putting out fires when (not if ) someone forgets to renew a certificate. You just have to be careful picking your automation — I haven't been impressed with certbot, for example. Also, everyth…

Forcing automation would be fine if the default software package (certbot) was any good but from my experience certbot is simply not fit for purpose. Certbot doesn't support the industry standard PKCS#12 format, which makes it extremely brittle for anyone using a Java based webserver. Instead it uses the non-standard PEM format which requires conversion before usage. That conversion step breaks all the time and requi…

I hear ya. I’m also not fond of certbot and other existing clients.

The best solution I’ve found so far was to implement a custom cert manager using the formidable acmez library.

Re: Decreasing Certificate Lifetimes to 45 Days

#77

Post by cpach »

ptman wrote: post #64
supriyo-biswas wrote: post #11

The relevant section of the CA/Browser forum requirements that resulted in this change are here: https://cabforum.org/working-groups/server/baseline-requirem...

That's the decision. Do you know the reasoning?

The primary reason: Revocation doesn’t work for webscale (OCSP is now obsolete). So instead, shorter cert lifetimes.

Re: Decreasing Certificate Lifetimes to 45 Days

#79

Post by cpach »

kyledrake wrote: post #22
0x1ceb00da wrote: post #9

Earlier quoted context omitted.

What kind of issues do you usually face?

Without getting into specific stuff I've run into, automated stuff just, breaks. This is a living organism with moving parts and a time limit - you update nginx with a change that breaks .well-known by accident, or upgrade to a new version of Ubuntu and suddenly some dependency isn't loading correctly, or that UUID generator you depended on to generate the name for the challenge doesn't get loaded, or certbot becomes…

“Aside from all that, what happens if a hacker manages to wreck the let’s encrypt infra so badly they need 2 weeks to get it back online?”

There are other CAs that offer certs via ACME. For example, Google Trust Services.

Re: Decreasing Certificate Lifetimes to 45 Days

#80

Post by kemotep »

ZeroConcerns wrote: post #56
arp242 wrote: post #47

Earlier quoted context omitted.

Doesn't ZeroSSL do this? acme.sh has been using it as the default for the last few years. As I understand it, it basically offers the same as Let's Encrypt.

https://zerossl.com/pricing/ suggests a 3-cert limit on the free tier, as well as a huge influx of expected spam...

I believe that is 3 hosts not total certs.

Zerossl is integrated with Caddy by default and there’s no indication from Caddy that you would only be able to renew the cert twice before needing to cough up some money.

Post reply on HN