Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

81–90 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#81

Post by cm2187 »

mschuster91 wrote: post #75
cm2187 wrote: post #49

Earlier quoted context omitted.

A couple of lines of code to enforce domain black lists if the relevant activits apply enough pressure.

Why should anyone do this? It's way easier and more effective to put pressure on hosters, anti-DDOS services and the payment providers to get Nazis booted off the net, see e.g. Stormfront.

It is easier to apply pressure when a single provider has a quasi monopoly, which let's encrypt is quickly building up. And I am not suggesting these attacks are mutually exclusive.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#82

Post by cutler »

superkuh wrote: post #61
staticassertion wrote: post #31

Earlier quoted context omitted.

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

>are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by im…

Agreed. I'm sick to the back teeth of fscking with HTTPS/SSL on all the client static sites I manage. Certbot-apache was so flaky I had to switch every client to Nginx so that I could use certbot-nginx. The web has become a no-go zone for do-it-yourselfers. If I didn't setup my clients in VPSs I don't know how we would manage all the mailserver blacklisting and endless HTTPS/SSL requirements.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#83

Post by xg15 »

demersb wrote: post #72
xg15 wrote: post #66

Earlier quoted context omitted.

Without buying a domain. (and continously spending money to keep it owned)

~$5/year (US) for a domain, and a one time investment of setting up a few scripts might save you a lot of time in the long run.

Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed.

The device will also only be accessible if an internet connection is present, even if both the device and the client are in the same LAN - because the client has to access the device through the domain.

This means, should I ever lose the capacity to support the device and renew the domain, the device will become useless, even if technically, it is still completely functional.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#84

Post by lawnchair_larry »

dharmab wrote: post #65
paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

This is a ridiculous requirement that is not at all practical.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#85

Post by pilif »

paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Backdate your self-signed cert. so far that works around any validity length restrictions.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#86

Post by lawnchair_larry »

dharmab wrote: post #67
xg15 wrote: post #66

Earlier quoted context omitted.

Without buying a domain. (and continously spending money to keep it owned)

Run your own CA internally and handle the CA distribution problem with MDM tools.

That is also an insane and unrealistic suggestion.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#87

Post by xg15 »

dharmab wrote: post #67
xg15 wrote: post #66

Earlier quoted context omitted.

Without buying a domain. (and continously spending money to keep it owned)

Run your own CA internally and handle the CA distribution problem with MDM tools.

I admit, that's a solution, even if a very unpleasant one: Installing a custom root CA is intentionally complicated, so this is hardly doable as an onboarding experience. The setup must be repreated for every single client device that should access the server.

There remains the question how I would get the CA certificate onto client devices in the first place.

Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate. This seems like a step backwards security-wise.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#88

Post by cpncrunch »

pilif wrote: post #85
paledot wrote: post #57

With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use…

Backdate your self-signed cert. so far that works around any validity length restrictions.

No, that won't work.

https://chromium.googlesource.com/chromium/src/+/ae4d6809912...

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#89

Post by cutler »

floatingatoll wrote: post #23
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

One reason for these proposals was to put pressure on the SSL certificate ecosystem to provide (CAs) and adopt (hosting) automated SSL renewal practices. Businesses have had three years since Let's Encrypt first went live to adopt such practices, but many chose not to — not just hosting providers, but e.g. bigcorp load balancers too.

Guess what - not all websites are businesses. In fact not all websites are dynamically-generated so why the fsck do we all have to put up with this madness? Make HTTPS/SSL necessary for transactional sites but for simple static sites give me a break.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#90

Post by lawnchair_larry »

staticassertion wrote: post #31
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

This is silly to use as a blanket statement. There is nothing harmful about hosting a website. Especially personal sites, internal sites, or small businesses who use it as little more than a brochure that serves static content. My roof repair guy is not harming anyone by posting his information on a basic website.
Post reply on HN