Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LetsEncrypt Outage

letsencrypt.status.io

Post reply on HN
Print view View original

91–100 of 112 posts

Re: LetsEncrypt Outage

#91

Post by indigodaddy »

gregsadetsky wrote: post #35
Marsymars wrote: post #10

Earlier quoted context omitted.

> Shall we have some way of freely encrypting the web that is relying on one authority? Caddy uses ZeroSSL as a fallback if Let’s Encrypt fails!

But it's not on by default, right..? (i.e. is there a particular config needed for that?) I'm using Caddy here and it's not falling back on ZeroSSL. Thanks for your help EDIT: hmm, it should be automatic...! https://caddyserver.com/docs/automatic-https#issuer-fallback interesting, I'll double check my config woah... it's probably related to this! https://github.com/caddyserver/caddy/issues/7084 TLDR: "Caddy doesn't f…

Wonder if caddy-docker-proxy uses the API..?

Re: LetsEncrypt Outage

#93

Post by gregsadetsky »

indigodaddy wrote: post #91
gregsadetsky wrote: post #35

Earlier quoted context omitted.

But it's not on by default, right..? (i.e. is there a particular config needed for that?) I'm using Caddy here and it's not falling back on ZeroSSL. Thanks for your help EDIT: hmm, it should be automatic...! https://caddyserver.com/docs/automatic-https#issuer-fallback interesting, I'll double check my config woah... it's probably related to this! https://github.com/caddyserver/caddy/issues/7084 TLDR: "Caddy doesn't f…

Wonder if caddy-docker-proxy uses the API..?

From what I see, yes:

https://github.com/lucaslorentz/caddy-docker-proxy/blob/mast...

caddy-docker-proxy generates a Caddyfile in memory, and then it calls the internal Caddy API `/load`. So - yes, it would presumably have been affected, at least from what I saw yesterday (with our own Caddy) and if the github issue I mentioned is correct.

Re: LetsEncrypt Outage

#94

Post by mholt »

mr_toad wrote: post #59
Kholin wrote: post #23

Let's Encrypt stopped its certificate expiration email notification service a while ago, and I hadn't found a replacement yet. As a result, I didn't receive an expiration notice this time and failed to renew my certificate in advance. The certificate expired today, making my website inaccessible. I logged into my VPS to renew it manually, but the process failed every time. I then checked my cloud provider's platform…

Isn’t the recommended practice to update every ~60 days or so, regardless?

Yeah but if you need a cert for a new site you have to use another CA.

Re: LetsEncrypt Outage

#95

Post by mixdup »

ocdtrekkie wrote: post #81
phillipseamore wrote: post #74

Earlier quoted context omitted.

s/Google/Apple, Google, Microsoft, and Mozilla/

Not in any realistic way, no. Because Chrome is by far the majority of the market, so what Google ships is what is available on the web. If Google unilaterally decides it is going to distrust a CA, it doesn't really matter who else does or not, the CA is dead. Not that the other parties are that independent anyways: Microsoft's browser is a Google fork, and is wholly dependent on it. Mozilla's entire funding is Googl…

Edge may be a fork of Chromium but they have the capability of shipping whatever roots they want or setting whatever trust policies they want

And the push-down in certificate age is, or at least was at the beginning, a push from Apple. The others have come around/along for the ride

Re: LetsEncrypt Outage

#96

Post by Jedd »

throw0101d wrote: post #90
tbrownaw wrote: post #63

Earlier quoted context omitted.

Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)?

> Haven't they always, from day one, insisted that their primary goal was to encourage (force) automation of certificate maintenance, as a mechanism to make tls ubiquitous (mandatory everywhere)? And? Automation sometimes breaks, both for internal reasons (OS patching) or external. For the latter, LE at some point in the past changed CDNs, and this caused JWST headers to be sent back differently, which broke differen…

> And?

And you set up your own monitoring systems for your own infrastructure, as you have always done.

Or better yet, set up auto-renewal as per vendors recommendation.

Vendors - especially vendors you aren't paying - may provide some reminder services, but assuming those to be your sole method for 'managing' your renewals is a deeply poor operational position.

This is going to get really important as cert longevity gets reduced, eg https://news.ycombinator.com/item?id=43693900

If you're using Prometheus or Prom-friendly systems - https://github.com/ribbybibby/ssl_exporter

Re: LetsEncrypt Outage

#97

Post by tptacek »

ocdtrekkie wrote: post #70
phillipseamore wrote: post #52

Earlier quoted context omitted.

My biggest problem is how centralized issuance is. Half the year I live on an island that is reliant on submarine cables and has historically had weeks and months long outages and with a changing world I suspect that might become reality once again. Locally this wasn't much of an issue, the ccTLD continues to function, most services (but now about 35%) are locally hosted. Then HTTPS comes along. Zero certificates cou…

Realistically there's no reason except Google retaining centralized control of the Internet for there to be a specific group of trusted CAs that meet Google's arcane specifications which can issue certificates the entire world trusts. Your registrar should be able to validate your ownership of the domain, ergo your registrar should be your CA. Instead of a bunch of arbitrary and capricious rules to be trusted, a CA s…

If your concern is breaking Google's stranglehold on the web, why would Google ever implement DANE? (They probably won't, for other reasons they've already stated, but I'm trying to understand your logic).

Re: LetsEncrypt Outage

#98

Post by ocdtrekkie »

tptacek wrote: post #97
ocdtrekkie wrote: post #70

Earlier quoted context omitted.

Realistically there's no reason except Google retaining centralized control of the Internet for there to be a specific group of trusted CAs that meet Google's arcane specifications which can issue certificates the entire world trusts. Your registrar should be able to validate your ownership of the domain, ergo your registrar should be your CA. Instead of a bunch of arbitrary and capricious rules to be trusted, a CA s…

If your concern is breaking Google's stranglehold on the web, why would Google ever implement DANE? (They probably won't, for other reasons they've already stated, but I'm trying to understand your logic).

They wouldn't and that is part of the problem. We are stuck with a fragile and insecure certificate strategy because the existing strategy allows Google significant control of the ecosystem.

The "I support shorter lifetimes so this all comes crashing down" comment I made earlier is arguably a bit facetious, but I do think the PKI wonks in the CAB are pretty much accountable to noone until they break things badly enough that their bosses have to pay attention to the problem.

Antitrust enforcement remains the fix here.

Re: LetsEncrypt Outage

#99

Post by tptacek »

ocdtrekkie wrote: post #98
tptacek wrote: post #97

Earlier quoted context omitted.

If your concern is breaking Google's stranglehold on the web, why would Google ever implement DANE? (They probably won't, for other reasons they've already stated, but I'm trying to understand your logic).

They wouldn't and that is part of the problem. We are stuck with a fragile and insecure certificate strategy because the existing strategy allows Google significant control of the ecosystem. The "I support shorter lifetimes so this all comes crashing down" comment I made earlier is arguably a bit facetious, but I do think the PKI wonks in the CAB are pretty much accountable to noone until they break things badly enou…

What other mainstream browser are you counting on to ever support DANE?

Re: LetsEncrypt Outage

#100

Post by ocdtrekkie »

tptacek wrote: post #99
ocdtrekkie wrote: post #98

Earlier quoted context omitted.

They wouldn't and that is part of the problem. We are stuck with a fragile and insecure certificate strategy because the existing strategy allows Google significant control of the ecosystem. The "I support shorter lifetimes so this all comes crashing down" comment I made earlier is arguably a bit facetious, but I do think the PKI wonks in the CAB are pretty much accountable to noone until they break things badly enou…

What other mainstream browser are you counting on to ever support DANE?

I feel like this comment ignores the fact that right now all of them are effectively tied to Google, and that supporting DANE if Google doesn't is currently pointless, so obviously no one would until the status quo changes.

Ultimately the problem is that currently "security best practice" as it's commonly discussed, says what we're doing now is a good idea. It's not, and until we change the understanding on that, nobody's going to feel motivated to do better.

Password rotation used to be considered a gold standard strategy for security, until people realized not only did it make everything harder, it also encouraged people to choose less secure passwords and was largely self-defeating.

If I told you we could improve a 90-day password rotation policy by making it change every week, you'd rightly call me crazy, but for some inconceivable reason (monopoly, perverse incentives, appeal to an authority run by idiots, name your choice), people act like decreasing certificate lifetime is somehow going to make the web safer.

Post reply on HN