Issue with TLS-ALPN-01 Validation Method

community.letsencrypt.org

91–92 of 92 posts

Re: Issue with TLS-ALPN-01 Validation Method

#91

Post by GauntletWizard » Fri, Jan 28, 2022, 9:23 AM UTC

nulld3v wrote: post #18

mholt wrote: post #12

Earlier quoted context omitted.

Caddy does. https://community.letsencrypt.org/t/questions-about-renewing... And this is one reason why I keep advocating for certificate automation to be built into services/apps, rather than patched on the outside with duck tape. I look forward to the day when cert lifetimes are regularly about as short as OCSP responses. Then we can possibly do away with OCSP entirely.* (* I am of the opinion that revocation is fun…

I tried solving this a different way for my selfhosted services. Instead of running certbot on every server, I wrote a custom ACME client that runs on a master server and is responsible for requesting/renewing all certificates that I use. It also automatically deploys each cert to the correct server. It is a single point of failure but it makes tracking certificate expiry, renewal and revocation so much easier.

I wrote monitoring that was able to check all of my servers, all of my certificates, and alert me if certbot failed on any of them and their certificates were near expiry.

I call it "The Prometheus monitoring I already needed to make sure my servers are up and serving the websites they're supposed to"

Re: Issue with TLS-ALPN-01 Validation Method

#92

Post by octoberfranklin » Fri, Jan 28, 2022, 10:52 AM UTC

tialaramex wrote: post #66

octoberfranklin wrote: post #16

Earlier quoted context omitted.

That might work for you, but ALPN needs to exist because there's more to the Internet than just HTTP, and TLS can be used for those non-HTTP protocols. Some of those protocols are more fundamental than HTTP, and making them depend on HTTP would create a circular dependency. HN is choking again, so I must reply with edits *sigh* @tialaramex, you're confusing policies of one CA (LE) with the ALPN protocol. Lets Encrypt…

It's not about the ALPN protocol it's about the Baseline Requirements. Unless I'm gravely mistaken it certainly isn't the intention that you're allowed to accept tls-alpn-01 validation from some random service on say, port 8080 or 6697 as suitable for the purpose of validating control over a name for the Web PKI and I'd be grateful if you know of a public CA offering this that you'd say which ones and how you're awar…

TLS doesn't have a fixed port number. Ergo, TLS-ALPN doesn't either.

It is the intention of the ALPN spec that you can do tls-alpn-01 on whatever TCP port the two parties (issuer and recipient) care to use.

Post reply on HN