Chromium and Mozilla to enforce 1 year validity for TLS certificates • Hacker News Board

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#91

Post by cutler » Sun, Jun 28, 2020, 4:29 PM UTC

blibble wrote: post #77

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

it takes absolutely no time at all to set up for an individual on their VPS, compared to the faff of going through the openssl csr process + buying from a CA

"On their VPS". What are you smoking?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#92

Post by gsich » Sun, Jun 28, 2020, 4:29 PM UTC

xg15 wrote: post #83

demersb wrote: post #72

Earlier quoted context omitted.

~$5/year (US) for a domain, and a one time investment of setting up a few scripts might save you a lot of time in the long run.

Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed. The device will also only be accessible if an internet connection is present, even if both the device and the client are in the…

No. Your DNS can also be locally, so you have no Internet dependence.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#93

Post by gsich » Sun, Jun 28, 2020, 4:31 PM UTC

lawnchair_larry wrote: post #84

dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

This is a ridiculous requirement that is not at all practical.

You can also run your own CA.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#94

Post by cutler » Sun, Jun 28, 2020, 4:32 PM UTC

kspacewalk2 wrote: post #39

Almad wrote: post #20

Internet starts to have 1y memory retention. Unless refreshed by active learning, aka someone doing the refresh job. Or unless delegating the work to large players—either the memory or the hosting. EDIT: This feels wrong, even when done for right reasons. And I wonder whether this would fly without LE and whether this means we are officially making LE THE critical part of Internet infrastructure.

Websites marked "insecure" are still fully accessible.

Not always. Sometimes the browser presents a full-page response to the effect that the site is dangerous at which point, even if it's a harmless site, the non-savvy user will leave. Blanket HTTPS/SSL + Letsencrypt is a disaster.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#95

Post by luhn » Sun, Jun 28, 2020, 4:32 PM UTC

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

There are lots of good options for low-maintenance SSL certificates, from self-hosted (Let's Encrypt) to CDNs (CloudFlare) to hosting platforms (Netlify).

Even so, this doesn't actually change much. I've never bought a certificate valid for more than a year. I'm not aware of any major player that sells certificates valid for more than a year. So this rule has existed for a long time in practice, but is only now being codified.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#96

Post by profmonocle » Sun, Jun 28, 2020, 4:32 PM UTC

psim1 wrote: post #68

Help me understand why > 1 year server certs are problematic but issuers have 20 year roots. Isn’t the issuer’s cert a bigger concern?

Root certificates have their private keys in hardware security modules, which are kept in safes in secure facilities, only brought online when needed to sign intermediate certificates. Plus, it takes quite a while for new ones to be widely trusted - Let's Encrypt's root cert was issued in 2015 and still isn't trusted by a large percentage of older Android phones.

Intermediate certificates have shorter lifetimes. Even though they're kept online, they're also stored in HSMs. Even if the CA were compromised, the chance of the private key itself leaking is very small.

End user certificates, on the other hand, are usually handled much more cavalierly. Sure, you could store the key in an HSM, but most servers just keep them in memory (and in the file system). A server certificate's key is far, far more likely to be compromised than a CA key.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#97

Post by p2t2p » Sun, Jun 28, 2020, 4:32 PM UTC

xg15 wrote: post #83

demersb wrote: post #72

Earlier quoted context omitted.

~$5/year (US) for a domain, and a one time investment of setting up a few scripts might save you a lot of time in the long run.

Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed. The device will also only be accessible if an internet connection is present, even if both the device and the client are in the…

> Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore.

That’s not true at all. I’ve created a CA and a script to generate and sign server certificates and I generated them left right and centre now for my very standalone, local network only with no access to the internet whatsoever services. I added my CA to my browsers and my iPhone and everything works perfectly.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#98

Post by est31 » Sun, Jun 28, 2020, 4:32 PM UTC

xg15 wrote: post #87

dharmab wrote: post #67

Earlier quoted context omitted.

Run your own CA internally and handle the CA distribution problem with MDM tools.

I admit, that's a solution, even if a very unpleasant one: Installing a custom root CA is intentionally complicated, so this is hardly doable as an onboarding experience. The setup must be repreated for every single client device that should access the server. There remains the question how I would get the CA certificate onto client devices in the first place. Lastly, with asking consumers to install a CA certificate…

> Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate.

CA certificates can be constrained. https://tools.ietf.org/html/rfc5280#section-4.2.1.10

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#99

Post by geerlingguy » Sun, Jun 28, 2020, 4:33 PM UTC

gsich wrote: post #93

lawnchair_larry wrote: post #84

Earlier quoted context omitted.

This is a ridiculous requirement that is not at all practical.

You can also run your own CA.

> This is a ridiculous requirement that is not at all practical.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#100

Post by gsich » Sun, Jun 28, 2020, 4:33 PM UTC

cutler wrote: post #82

superkuh wrote: post #61

Earlier quoted context omitted.

>are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by im…

Agreed. I'm sick to the back teeth of fscking with HTTPS/SSL on all the client static sites I manage. Certbot-apache was so flaky I had to switch every client to Nginx so that I could use certbot-nginx. The web has become a no-go zone for do-it-yourselfers. If I didn't setup my clients in VPSs I don't know how we would manage all the mailserver blacklisting and endless HTTPS/SSL requirements.

dehydrated is nice and painless.