OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
1–10 of 17 posts
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#2On first sight, with only my knowledge in hand, I do think it is a good idea.
I'm also really interested in knowing if there are issues that could arise or people that annoyed by this kind of automatic conversion and why. What are your thoughts ?
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#3On first sight, with only my knowledge in hand, I do think it is a good idea. I'm also really interested in knowing if there are issues that could arise or people that annoyed by this kind of automatic conversion and why. What are your thoughts ?
There are potential security concerns. Suppose Let's Encrypt has a vulnerability other certs don't, or their chain is compromised somehow, this could put people at risk without them knowing it.
It could also complicate matters when renewing certs. If I forget to renew my SSL, it gets replaced with Let's Encrypt, and then I go to renew it and the system gets confused because it looks like I already have a cert from another provider.
In both cases, ample warning and notification will help, and opt-in rather than opt-out will totally alleviate the issues.
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#4On first sight, with only my knowledge in hand, I do think it is a good idea. I'm also really interested in knowing if there are issues that could arise or people that annoyed by this kind of automatic conversion and why. What are your thoughts ?
I like to think that this is the right approach, especially for shared hosting environments (which is what this announcement is about, presumably). These site owners already trust OVH to host their sites and to hold the private key for a certificate that is valid for their domains (or rather used to be, until it expired). You'll always find someone who's annoyed by a change or uses a setup that broke because of this (maybe they've pinned to a specific key and ignore expiration dates ...), but that doesn't seem like a common use-case or one that they should aspire to support.
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#5On first sight, with only my knowledge in hand, I do think it is a good idea. I'm also really interested in knowing if there are issues that could arise or people that annoyed by this kind of automatic conversion and why. What are your thoughts ?
There are potential security concerns. Suppose Let's Encrypt has a vulnerability other certs don't, or their chain is compromised somehow, this could put people at risk without them knowing it. It could also complicate matters when renewing certs. If I forget to renew my SSL, it gets replaced with Let's Encrypt, and then I go to renew it and the system gets confused because it looks like I already have a cert from an…
If Let's Encrypt's chain is compromised, everyone is screwed, not just your site. If _any_ trusted CA is compromised, everyone is screwed, even if they haven't issued a certificate for your site.
There is no way to induce a vulnerability by using an incompetent or malicious CA, provided you generate your own, strong private key. Even issuing an MD5 or SHA-1 certificate cannot actively harm your visitors unless a second preimage attack is developed against the algorithm (in which case, again, everyone is screwed, not just you).
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#6On first sight, with only my knowledge in hand, I do think it is a good idea. I'm also really interested in knowing if there are issues that could arise or people that annoyed by this kind of automatic conversion and why. What are your thoughts ?
There are potential security concerns. Suppose Let's Encrypt has a vulnerability other certs don't, or their chain is compromised somehow, this could put people at risk without them knowing it. It could also complicate matters when renewing certs. If I forget to renew my SSL, it gets replaced with Let's Encrypt, and then I go to renew it and the system gets confused because it looks like I already have a cert from an…
> There are potential security concerns. Suppose Let's Encrypt has a vulnerability other certs don't, or their chain is compromised somehow, this could put people at risk without them knowing it.
Could you describe what kind of concerns you're thinking about that would be Let's Encrypt-specific and that would only affect you if you actively use a Let's Encrypt-issued certificate? Generally speaking, a CA key being compromised would affect everyone (unless they use key pinning mechanisms like HPKP, which doesn't get a whole lot of real-world use at the moment, and probably close to zero usage from customers using a shared web hosting plan unless the provider takes care of it). You don't need to actively use a CA to be affected.
> It could also complicate matters when renewing certs. If I forget to renew my SSL, it gets replaced with Let's Encrypt, and then I go to renew it and the system gets confused because it looks like I already have a cert from another provider.
CAs typically don't care about whether you already have a certificate from a different provider (I mean, why would they?), or were you thinking about possible limitations in OVH's system? In that case, this only seems like an issue if they indeed have no way to replace the certificate once it's been enrolled with Let's Encrypt.
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#7...and what if you have a specific certificate pinned in your private clients for use of a private web service?
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#8...and what if you have a specific certificate pinned in your private clients for use of a private web service?
Then you should probably renew the expiring cert.
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#9...and what if you have a specific certificate pinned in your private clients for use of a private web service?
Doesn't matter, you'll need a new certificate either way.
Re: OVH automatically migrates expiring paid SSL to Let's Encrypt certificates
#10...and what if you have a specific certificate pinned in your private clients for use of a private web service?
If you pinned the leaf cert, you're fucked in any event. If you pinned the CA, it's problematic for something to automatically choose a new CA for you.