Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

81–90 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#81

Post by londons_explore »

alibarber wrote: post #61
progbits wrote: post #56

Earlier quoted context omitted.

I mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.

Also I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert? There would be no way of determining that I can connecting to my-organisation 's 10.0.0.1 and not bad-org 's 10.0.0.1.

Perhaps by providing some identifier in the URL?

ie. https://10.0.0.1(af81afa8394fd7aa)/index.htm

The identifier would be generated by the certificate authority upon your first request for a certificate, and every time you renew you get to keep the same one.

Re: 6-Day and IP Address Certificates Are Generally Available

#82

Post by mholt »

bflesch wrote: post #76
cpach wrote: post #75

Earlier quoted context omitted.

“Are they a single point of failure in that regard?” It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.

Makes sense. I assume each of them is in control and at the whims of US president?

They are not in control of the US president.

Re: 6-Day and IP Address Certificates Are Generally Available

#83

Post by creatonez »

rnhmjoj wrote: post #73
londons_explore wrote: post #69

Earlier quoted context omitted.

But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?

Yes, but browsers moan if you connect to a website without https, no matter if it's on localhost or an onion service.

Tor Browser handles this, it treats `.onion` as a secure context.

Re: 6-Day and IP Address Certificates Are Generally Available

#84

Post by charcircuit »

londons_explore wrote: post #69
charcircuit wrote: post #41

Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .onion has a key pair for it, so proving ownership is more trustworthy than even DNS.

But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?

For example HTTP/2 and HTTP/3 require HTTPS. While technically HTTPS is redundant, .onion sites should avoid requiring browsers to add special casing for them due to their low popularity compared to regular web sites.

Re: 6-Day and IP Address Certificates Are Generally Available

#85

Post by jofla_net »

bigstrat2003 wrote: post #38
qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

Rule by the few, us little people don't matter.

Thing is, NOTHING, is stopping anyone from already getting short lived certs and being 'proactive' and rotating through. What it is saying is, well, we own the process so we'll make Chrome not play ball with your site anymore unless you do as we say...

The CA system has cracks, that short lived certs don't fix, so meanwhile we'll make everyone as uncomfortable as possible while we rearrange deck chairs.

awaiting downvotes in earnest.

Re: 6-Day and IP Address Certificates Are Generally Available

#86

Post by vimda »

jdsully wrote: post #80
bigstrat2003 wrote: post #38

Earlier quoted context omitted.

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

At some point it makes sense to just let us use self signed certs. Nobody believes SSL is providing attestation anyways.

A lot corporate environments load their root cert and MITM you anyway

Re: 6-Day and IP Address Certificates Are Generally Available

#87

Post by toast0 »

qwertox wrote: post #77
Sohcahtoa82 wrote: post #53

Earlier quoted context omitted.

> Are IP addresses more transient than a domain within a 45 day window? If I don't assign an EIP to my EC2 instance and shut it down, I'm nearly guaranteed to get a different IP when I start it again, even if I start it within seconds of shutdown completing. It'd be quite a challenge to use this behavior maliciously, though. You'd have to get assigned an IP that someone else was using recently, and the person using t…

Ok, though if you're in that situation, is an IP cert the correct solution?

It's probably not a good solution if you're dealing with clients you control.

Otoh, if you're dealing with browsers, they really like WebPKI certs, and if you're directing load to specific servers in real time, why add DNS and/or a load balancer thing in the middle?

Re: 6-Day and IP Address Certificates Are Generally Available

#88

Post by alibarber »

londons_explore wrote: post #81
alibarber wrote: post #61

Earlier quoted context omitted.

Also I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert? There would be no way of determining that I can connecting to my-organisation 's 10.0.0.1 and not bad-org 's 10.0.0.1.

Perhaps by providing some identifier in the URL? ie. https://10.0.0.1(af81afa8394fd7aa)/index.htm The identifier would be generated by the certificate authority upon your first request for a certificate, and every time you renew you get to keep the same one.

I see what you're getting at - but to me this sounds almost exactly like just using DNS, even if the (A/AAAA) record you want to use resolves to an un-routable address: https://letsencrypt.org/docs/challenge-types/#dns-01-challen... - you just create a DNS TXT record instead of them trying to access a server at the address for verification.

Re: 6-Day and IP Address Certificates Are Generally Available

#89

Post by cryptonector »

SahAssar wrote: post #67
cryptonector wrote: post #63

How are IP address certificates useful?

* DoT/DoH * An outer SNI name when doing ECH perhaps * Being able to host secure http/mail/etc without being beholden to a domain registrar

Oh nice! I hadn't considered DoT/DoH. The ECH angle is interesting. Thanks.

Re: 6-Day and IP Address Certificates Are Generally Available

#90

Post by singpolyma3 »

jsheard wrote: post #62
alibarber wrote: post #57

Earlier quoted context omitted.

Well they offer a money-back guarantee. And other providers of SSL certificates exist.

For better or worse the push down to 47-day certificates is an industry-wide thing, in a few years no provider will issue certificates for longer than that. Nobody is being forced to use 6-day certs for domains though, when the time comes Let's Encrypt will default to 47 days just like everyone else.

> Nobody is being forced to use 6-day certs for domains though

Yet

Post reply on HN