IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.
One can also use a private CA for that scenario.
6-Day and IP Address Certificates Are Generally Available
71–80 of 290 posts
Re: 6-Day and IP Address Certificates Are Generally Available
#72Earlier quoted context omitted.
The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.
It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.
> broken by some government agency or hacker group
Probably not. For browsers to accept this certificate it has to be logged in a certificate transparency log for anyone to see, and no such certificates have been seen to be logged.
Re: 6-Day and IP Address Certificates Are Generally Available
#73Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .onion has a key pair for it, so proving ownership is more trustworthy than even DNS.
But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?
Yes, but browsers moan if you connect to a website without https, no matter if it's on localhost or an onion service.
Re: 6-Day and IP Address Certificates Are Generally Available
#74Earlier quoted context omitted.
It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.
My browser on my work laptop has 219 root certificates trusted. Some of those may be installed from my employer, but I suspect most of them come from MS as it's Edge on Windows 11. I see in that list things like "Swedish Government Root Authority" "Thailand National Root Certification Authority" "Staat der Nederlanden Root CA" and things like "MULTICERT Root Certification Authority" "ACCVRAUZ1". I don't think there i…
Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked.
Obviously you might still be victim #1 of such a scheme... But in general the CA's now aren't really trusted anymore - the real root of trust is the CT logs.
Re: 6-Day and IP Address Certificates Are Generally Available
#75Earlier quoted context omitted.
With a 6 day lifetime you'd typically renew after 3 days. If Lets Encrypt is down or refuses to issue then you'd have to choose a different provider. Your browser trusts many different "top of the chain" providers. With a 30 day cert with renewal 10-15 days in advance that gives you breathing room Personally I think 3 days is far too short unless you have your automation pulling from two different suppliers.
Thank you, I missed the part with several "top of the chain" providers. So all of them would need to go down at the same time for things to really stop working. How many "top of chain" providers is letsencrypt using? Are they a single point of failure in that regard? I'd imagine that other "top of chain" providers want money for their certificates and that they might have a manual process which is slower than letsenc…
“Are they a single point of failure in that regard?”
It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.
Re: 6-Day and IP Address Certificates Are Generally Available
#76Earlier quoted context omitted.
Thank you, I missed the part with several "top of the chain" providers. So all of them would need to go down at the same time for things to really stop working. How many "top of chain" providers is letsencrypt using? Are they a single point of failure in that regard? I'd imagine that other "top of chain" providers want money for their certificates and that they might have a manual process which is slower than letsenc…
“Are they a single point of failure in that regard?” It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.
Makes sense. I assume each of them is in control and at the whims of US president?
Re: 6-Day and IP Address Certificates Are Generally Available
#77I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…
> Are IP addresses more transient than a domain within a 45 day window? If I don't assign an EIP to my EC2 instance and shut it down, I'm nearly guaranteed to get a different IP when I start it again, even if I start it within seconds of shutdown completing. It'd be quite a challenge to use this behavior maliciously, though. You'd have to get assigned an IP that someone else was using recently, and the person using t…
Ok, though if you're in that situation, is an IP cert the correct solution?
Re: 6-Day and IP Address Certificates Are Generally Available
#78Earlier quoted context omitted.
With a 6 day lifetime you'd typically renew after 3 days. If Lets Encrypt is down or refuses to issue then you'd have to choose a different provider. Your browser trusts many different "top of the chain" providers. With a 30 day cert with renewal 10-15 days in advance that gives you breathing room Personally I think 3 days is far too short unless you have your automation pulling from two different suppliers.
Thank you, I missed the part with several "top of the chain" providers. So all of them would need to go down at the same time for things to really stop working. How many "top of chain" providers is letsencrypt using? Are they a single point of failure in that regard? I'd imagine that other "top of chain" providers want money for their certificates and that they might have a manual process which is slower than letsenc…
LE has 2 primary production data centers: https://letsencrypt.status.io/
But in general, one of the points of ACME is to eliminate dependence on a single provider, and prevent vendor lock-in. ACME clients should ideally support multiple ACME CAs.
For example, Caddy defaults to both LE and ZeroSSL. Users can additionally configure other CAs like Google Trust Services.
This document discusses several failure modes to consider: https://github.com/https-dev/docs/blob/master/acme-ops.md#if...
Re: 6-Day and IP Address Certificates Are Generally Available
#79It's a huge ask, but i'm hoping they'll implement code-signing certs some day, even if they charge for it. It would be nice if appstores then accepted those certs instead of directly requiring developer verification.
Re: 6-Day and IP Address Certificates Are Generally Available
#80I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…
The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.
At some point it makes sense to just let us use self signed certs. Nobody believes SSL is providing attestation anyways.