Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LetsEncrypt Outage

letsencrypt.status.io

Post reply on HN
Print view View original

81–90 of 112 posts

Re: LetsEncrypt Outage

#81

Post by ocdtrekkie »

phillipseamore wrote: post #74
ocdtrekkie wrote: post #70

Earlier quoted context omitted.

Realistically there's no reason except Google retaining centralized control of the Internet for there to be a specific group of trusted CAs that meet Google's arcane specifications which can issue certificates the entire world trusts. Your registrar should be able to validate your ownership of the domain, ergo your registrar should be your CA. Instead of a bunch of arbitrary and capricious rules to be trusted, a CA s…

s/Google/Apple, Google, Microsoft, and Mozilla/

Not in any realistic way, no. Because Chrome is by far the majority of the market, so what Google ships is what is available on the web. If Google unilaterally decides it is going to distrust a CA, it doesn't really matter who else does or not, the CA is dead.

Not that the other parties are that independent anyways: Microsoft's browser is a Google fork, and is wholly dependent on it. Mozilla's entire funding is Google. Apple is arguably the only somewhat independent party here, but that multibillion dollar annual search deal... let's say it incentivizes collaboration.

Re: LetsEncrypt Outage

#82

Post by pepa65 »

jasonthorsness wrote: post #11

Mostly this should be a non-event due to renewal long before expiration? Although huge deal I suppose for services that require issuing new certifications constantly; Let's Encrypt would be major failure mode for them. As they move to shorter-lifetime certs (6 days now https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/?utm_s... ) this puts it in the realm of possibility that an incident could impact long-running…

From the announcement:

Subscribers will be able to optin to short-lived certificates via a certificate profile mechanism being added to our ACME API.

We hope to make short-lived certificates generally available by the end of 2025.

The earliest short-lived certificates we issue may not support IP addresses, but we intend to enable IP address support by the time short-lived certificates reach general availability.

Re: LetsEncrypt Outage

#83

Post by grodriguez100 »

ninjin wrote: post #61
greyface- wrote: post #17

Good time to note that Buypass offers free certificates over ACME. I have a few of my domains configured to use them instead of LetsEncrypt, just for redundancy and to ensure I have a working non-LE cert source in case LE suffers problems like this over a longer time period. Example OpenBSD /etc/acme-client.conf: authority buypass { api url "https://api.buypass.com/acme/directory" account key "/etc/acme/buypass-privk…

Cheers! They look like decent chaps and also outside the US for some additional certificate diversity. Are there other trustworthy Acme issuers out there? A pity that acme-client(1) does not allow for fallbacks, but I will add a mental note about it being an easy enough patch to contribute if I ever find the time.

ZeroSSL works very well for me. I found it because it is now the default for the acme.sh client.

Re: LetsEncrypt Outage

#84

Post by attentive »

Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Monitoring the health of your site is your job.

You should have it on auto-renewal anyway.

You can grab a cert from ZeroSSL and probably some others.

You can also get 1year cert from aws for like $15 though I'd stick with auto renews.

Re: LetsEncrypt Outage

#85

Post by attentive »

CGamesPlay wrote: post #43
greyface- wrote: post #17

Good time to note that Buypass offers free certificates over ACME. I have a few of my domains configured to use them instead of LetsEncrypt, just for redundancy and to ensure I have a working non-LE cert source in case LE suffers problems like this over a longer time period. Example OpenBSD /etc/acme-client.conf: authority buypass { api url "https://api.buypass.com/acme/directory" account key "/etc/acme/buypass-privk…

This is neat. Does cert-manager have facilities to automatically use a fallback ACME provider, so I could automate using this? I'd also accept a pool of ACME providers, but a priority ordering seems ideal. I don't see the functionality listed anywhere, maybe there's some security argument that this is a bad idea?

caddy will auto-issue/renew LE or ZeroSSL depending on availability

Re: LetsEncrypt Outage

#86

Post by ffsm8 »

cpach wrote: post #79
ffsm8 wrote: post #78

Earlier quoted context omitted.

Yes, we had lengthy discussions in itops (I had a admin role when LE was launched) about it. The team lead couldn't get over the slogan "devops, automating downtimes since 2010" whenever someone wanted to add a new nonessential automation that does things on prod servers. I mean he wasn't completely wrong, it was a non essential automation with high risk and very little reward (<1h saved every 2 yrs), which is why we…

Perhaps you know this already but in the future, certs issued by a “real” CA will not be allowed to live for more than 47 days. https://www.digicert.com/blog/tls-certificate-lifetimes-will...

I didn't know that, interesting.

I was merely retelling an anecdote about how LE was always positioned to be exclusively about refreshing certs automatically, though. As I've moved out of (dev-)ops roles around 2016/2017 so I'm really not up to date with operations topics

Re: LetsEncrypt Outage

#87

Post by cpach »

attentive wrote: post #84
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Monitoring the health of your site is your job. You should have it on auto-renewal anyway. You can grab a cert from ZeroSSL and probably some others. You can also get 1year cert from aws for like $15 though I'd stick with auto renews.

And quite soon, 1-year certs will not be available from any vendor at all: https://news.ycombinator.com/item?id=44643826

Re: LetsEncrypt Outage

#88

Post by cpach »

haiku2077 wrote: post #57
NooneAtAll3 wrote: post #41

Earlier quoted context omitted.

what's the alternative to PKI?

Certainly something a hell of a lot simpler then x509 - and without assumptions from the 1990s hardcoded into it

Is it really X.509 that is the big “problem”? If so, I fail to see how.

Re: LetsEncrypt Outage

#90

Post by throw0101d »

tbrownaw wrote: post #63
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)?

> Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)?

And?

Automation sometimes breaks, both for internal reasons (OS patching) or external. For the latter, LE at some point in the past changed CDNs, and this caused JWST headers to be sent back differently, which broke different clients, e.g.:

* https://community.letsencrypt.org/t/jws-has-no-anti-replay-n...

* https://github.com/dehydrated-io/dehydrated/issues/684

Being able to get e-mails was an extra level of monitoring that was handy, even if you had automation.

Post reply on HN