Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let’s Encrypt to transition to ISRG root

scotthelme.co.uk

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Let’s Encrypt to transition to ISRG root

#81

Post by vbezhenar »

regecks wrote: post #12
viraptor wrote: post #4

They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.

On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks. To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017). On iOS, it was first added in iOS 10 (2016).…

So iPhone 4S is out of luck. That's terrible move. Suddenly half of the Internet becomes inaccessible to a perfectly working device. Though I think that user can install new CA certificate, so it's possible to manuall work around that problem.

Re: Let’s Encrypt to transition to ISRG root

#83

Post by cpach »

vbezhenar wrote: post #81
regecks wrote: post #12

Earlier quoted context omitted.

On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks. To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017). On iOS, it was first added in iOS 10 (2016).…

So iPhone 4S is out of luck. That's terrible move. Suddenly half of the Internet becomes inaccessible to a perfectly working device. Though I think that user can install new CA certificate, so it's possible to manuall work around that problem.

”Though I think that user can install new CA certificate, so it's possible to manuall work around that problem.”

Good point. Generally it’s a bad idea for users to install any CA certificates on their devices, but in this case I think it makes sense.

Re: Let’s Encrypt to transition to ISRG root

#84

Post by cpach »

aasasd wrote: post #77
londons_explore wrote: post #42

Earlier quoted context omitted.

The reality is, for a bunch of usecases, you're gonna need to support 15 plus year old devices. So Windows XP... There are a lot of old systems out there running API's, automation, industrial systems, etc. They never get updates, and are expected to last decades. Most of them aren't on the public internet, but HTTPS would still be a good idea. This change is going to mean a bunch of them just get changed over to havi…

Most industrial devices and even consumer kiosks probably access sites that are under the control of the device's owner or manufacturer. So the sites can just use self-signed certificates in the first place. Or, for industrial use a hundred bucks on a certificate from an older CA is nothing.

Or, as 'vbezhenar hinted at elsewhere, the operators of the systems can distribute and install the ISRG root certificate to the devices that need them.

Re: Let’s Encrypt to transition to ISRG root

#85

Post by tomschlick »

pard68 wrote: post #67
shawnz wrote: post #63

Earlier quoted context omitted.

Consider that for mobile users, updated software might not be available for their hardware and they might not be able to afford new hardware.

Work for a university. We have a number of students in Africa, southeast Asia, and eastern Europe taking online courses. We do not support Windows XP or Vista, except for in the case of these students. Some of these guys don't have the resources for anything else. I also know that we get a number of students connecting with Android v3 or earlier from these same locales.

Something like Ubuntu sounds like a great fit then.

Re: Let’s Encrypt to transition to ISRG root

#86

Post by throw0101a »

p4bl0 wrote: post #6
viraptor wrote: post #4

They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?

* https://www.ssllabs.com/ssltest/analyze.html?d=valid%2disrgr...

Re: Let’s Encrypt to transition to ISRG root

#87

Post by bdhess »

vbezhenar wrote: post #81
regecks wrote: post #12

Earlier quoted context omitted.

On Android, the root was first added in Nougat (~half of devices according to Android Distribution Dashboard). But I think that browsers (like Firefox and Chrome) on Android tend to bring their own cacerts rather than using the device's, so it's probably not as bad as it looks. To that end, it was added to NSS 3.26/Firefox 50 (November 2016) and to Chrome 57 (March 2017). On iOS, it was first added in iOS 10 (2016).…

So iPhone 4S is out of luck. That's terrible move. Suddenly half of the Internet becomes inaccessible to a perfectly working device. Though I think that user can install new CA certificate, so it's possible to manuall work around that problem.

The iPhone 4S has not received a security update in >2 years, and has >700 known security vulnerabilities, so it is not a "perfectly working device," it's a "probably compromised device."

https://nvd.nist.gov/vuln/search/results?adv_search=true&for...

Re: Let’s Encrypt to transition to ISRG root

#88

Post by rocqua »

theandrewbailey wrote: post #64
rocqua wrote: post #27

I'm not an expert of certificates, but some quick skimming of https://tools.ietf.org/html/rfc5280#section-4.1 suggests that a certificate only references the issuer certificate by name. Since, according to the article, the two different Lets encrypt intermediates have the same key, and the same name, they are interchangeable? As in, could I just replace the intermediate in my cert-chain and have everything continue s…

Yes, they are interchangeable. On my blog ( https://theandrewbailey.com/ ), I have a "health check" page that includes all available trust chains. For my Let's Encrypt certificate, it shows 2: one through an intermediate to the DST Root, and another intermediate to the ISRG Root. I can verify that both exist and are used (though one certificate and intermediate are loaded and served): the current Firefox release (and…

Thanks! I can't seem to find the direct 'health-check' page though.

Also, according to the spec, certificates sign a 'tbsCertificate' which contains all data of a certificate except for the actual signature and the field that determines what signing algorithm was used.

Re: Let’s Encrypt to transition to ISRG root

#89

Post by seba_dos1 »

p4bl0 wrote: post #6
viraptor wrote: post #4

They haven't really published a list of good/bad clients. I'm interested in what's the practical cutoff point with mobile phones? I expect desktop browsers will be less of an issue.

They provide a test site. It works on my Android One: https://valid-isrgrootx1.letsencrypt.org/ People with other versions of Android and iOS can test and report here?

Works on Nokia N900.

Re: Let’s Encrypt to transition to ISRG root

#90

Post by xnyan »

blattimwind wrote: post #59
tialaramex wrote: post #55

Earlier quoted context omitted.

I don't think anybody at Let's Encrypt has spoken on this topic, but in their case specifically there are both moral and pragmatic reasons to choose to cross-sign. Morally is the easy one. If you work for a public CA you presumably think that the Web PKI is a good idea, and Let's Encrypt helped bring that benefit to lots more users, so that's a good thing. Consider the question of whether McDonalds should support a l…

AIUI IdenTrust was set-up as a sort of self-servicing entity by banks mostly for banks and their clients, so IdenTrust probably doesn't really care too much about classic web CA business.

I was going to add this. The choice of IdenTrust was not an accident. It was and is a very reputable CA but for banking reasons and so is not threatened by LA's entry into the market.
Post reply on HN