Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6-Day and IP Address Certificates Are Generally Available

letsencrypt.org

Post reply on HN
Print view View original

91–100 of 290 posts

Re: 6-Day and IP Address Certificates Are Generally Available

#91

Post by vbezhenar »

Sohcahtoa82 wrote: post #45
bigstrat2003 wrote: post #38

Earlier quoted context omitted.

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.

I'm not sure it is about security. For security, CRLs and OCSP were a thing from the beginning. Short-lived certificates allow to cancel CRLs or at least reduce their size, so CA can save some expenses (I guess it's quite a bit of traffic for every client to download CRLs for entire letsencrypt).

Re: 6-Day and IP Address Certificates Are Generally Available

#92

Post by dextercd »

razakel wrote: post #60

Has anyone actually given a good explanation as to why TLS Client Auth is being removed?

It's a requirement from the Chrome root program. This page is probably the best resource on why they want this: https://googlechrome.github.io/chromerootprogram/moving-forw...

Re: 6-Day and IP Address Certificates Are Generally Available

#93

Post by rsync »

IP address certificates are particularly interesting for iOS users who want to run their own DoH servers.

A properly configured DoH server (perhaps running unbound) with a properly constructed configuration profile which included a DoH FQDN with a proper certificate would not work in iOS.

The reason, it turns out, is that iOS insisted that both the FQDN and the IP have proper certificates.

This is why the configuration profiles from big organizations like dns4eu and nextdns would work properly when, for instance, installed on an iphone ... but your own personal DoH server (and profile) would not.

Re: 6-Day and IP Address Certificates Are Generally Available

#94

Post by cpach »

alibarber wrote: post #61
progbits wrote: post #56

Earlier quoted context omitted.

I mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.

Also I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert? There would be no way of determining that I can connecting to my-organisation 's 10.0.0.1 and not bad-org 's 10.0.0.1.

A public CA won’t give you a cert for 10.0.0.1

Re: 6-Day and IP Address Certificates Are Generally Available

#96

Post by toast0 »

cedws wrote: post #52

I guess IP certs won't really be used for anything important, but isn't there a bigger risk due to BGP hijacking?

No additional risk IMHO. If you can hijack my service IPs, you can establish control over the IPs or the domain names that point to them. (If you can hijack my DNS IPs, you can often do much more... even with DNSSEC, you can keep serving the records that lead to IPs you hijacked)

Re: 6-Day and IP Address Certificates Are Generally Available

#97

Post by cpach »

Sohcahtoa82 wrote: post #58
meling wrote: post #13

If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?

What's stopping you from creating a "localhost.mydomain.com" DNS record that initially resolves to a public IP so you can get a certificate, then copying the certificate locally, then changing the DNS to 127.0.0.1? Other than basically being a pain in the ass.

One can also use the DNS-01 challenge in that scenario.

Re: 6-Day and IP Address Certificates Are Generally Available

#98

Post by jofla_net »

wang_li wrote: post #70
Sohcahtoa82 wrote: post #45

Earlier quoted context omitted.

It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.

My browser on my work laptop has 219 root certificates trusted. Some of those may be installed from my employer, but I suspect most of them come from MS as it's Edge on Windows 11. I see in that list things like "Swedish Government Root Authority" "Thailand National Root Certification Authority" "Staat der Nederlanden Root CA" and things like "MULTICERT Root Certification Authority" "ACCVRAUZ1". I don't think there i…

>> TLS certs should be treated much more akin to SSH host keys in the known hosts file. Browsers should record the cert the first time they see it and then warn me if it changes before it's expiration date, or some time near the expiration date.

This is great, and actually constructive!

I use, a hack i put together http://www.jofla.net/php__/CertChecker/ to keep a list (in json) of a bunch of machines (both https and SSH) and the last fingerprints/date it sees. Every time it runs i can see if any server has changed, just is a heads-up for any funny business. Sure its got shortcommings, it doesnt mimmic headers and such but its a start.

It would be great if browsers could all, you know, have some type of distributed protocol, ie DHT where by at least some concensus about whether this cert has been seen by me or enough peers lately.

Having a ton of CAs and the ability to have any link in that chain sing for ANY site is crazy, and until you've seen examples of abuse you assume the foundations are sound.

Re: 6-Day and IP Address Certificates Are Generally Available

#99

Post by mxey »

alibarber wrote: post #42
qwertox wrote: post #37

I have now implemented a 2 week renewal interval to test the change to the 45 days, and now they come with a 6-day certificate? This is no criticism, I like what they do, but how am I supposed to do renewals? If something goes wrong, like the pipeline triggering certbot goes wrong, I won't have time to fix this. So I'd be at a two day renewal with a 4 day "debugging" window. I'm certain there are some who need this,…

If you are doing this in a commercial context and the 4 day debugging window, or any downtime, would cause you more costs than say, buying a 1 year certificate from a commercial supplier, then that might be your answer there...

There will be no certificates longer than 45 days by any CA in browsers in a few years.

Re: 6-Day and IP Address Certificates Are Generally Available

#100

Post by bflesch »

mholt wrote: post #82
bflesch wrote: post #76

Earlier quoted context omitted.

Makes sense. I assume each of them is in control and at the whims of US president?

They are not in control of the US president.

I'm pretty sure that the .org TLD can be shut off by the US at any point in time.
Post reply on HN