3 ms·

Yep, you're probably missing the 3 month validity period.

by MatthewWilkes 11y ago

StavrosK 11y ago
For which?
- detaro 11y ago
  Let's encrypt certificates are valid for only 90 days, and I guess the argument is that you want automatic tooling to take care of renewal if it happens so often.
  - lucb1e 11y ago
    That might actually be a good thing, though. Currently I have to do it for a couple of domains every year. By forcing me to automate it, it takes me more time once, but afterwards I don't have to look at it anymore at all.
  - StavrosK 11y ago
    Ugh, really? I was planning on only using the tools to write out the initial certificate file, as I don't want too much running on my servers. This has certainly put a damper on my excitement about Let's Encrypt.
    - detaro 11y ago
      From a quick look at the protocol, it shouldn't be an issue to run the ACME client on one host and scp CSRs from your servers to it, hand them to lets encrypt, and move the results back. So yes, you have to touch or run it every 2-3 months, but it doesn't have to run on all your servers.
      - StavrosK 11y ago
        I'm more wondering if I can cron it (without sudo), and not have it run as a daemon. Then, once every two weeks or so, it can just refresh the cert using the csr I generated before. It should be pretty easy to do, I'm just not familiar with the clients at this point.
RawInfoSec 11y ago
Plus lack of identity validation. While the author of the article minimizes this, we shouldn't remove it from the equation just because users can't tell the difference. The right thing would be to fix the users understanding rather than weaken the product. LetsEncrypt will be good for all those sites we deploy with self-signed certs, but won't be replacing major sites any time soon.
- creshal 11y ago
  Is identity validation under any circumstances more than snake oil? Neither users nor browsers could tell whether a site is supposed to run a domain- or identification validated certificate. (Fun fact, HN uses a domain validated cert.) All you get is higher costs for some X.509 fields nobody ever looks at, and nobody would miss if an MITMing attacker replaced your ID validated cert with an domain validated one.
  - detaro 11y ago
    You can use HPKP to pin EV-only root CAs, so you can still replace your cert, but it can only be replaced against another EV one. Doesn't protect against a hacked/rogue CA, but against someone getting access to your DNS/mail/web server and getting a useable certificate from a only-domain-validating CA.
    - nailer 11y ago
      Couldn't you also use HPKP to pin the EV-only root?
      - detaro 11y ago
        That's actually what I meant. Edited.
    - creshal 11y ago
      Yes, but EV is not the same as identity validation. That's another variant of certificates that was only introduced because identity validation alone is so bloody useless.

Yep, you're probably missing the 3 month validity period.

StavrosK 11y ago

For which?

detaro 11y ago
Let's encrypt certificates are valid for only 90 days, and I guess the argument is that you want automatic tooling to take care of renewal if it happens so often.
- lucb1e 11y ago
  That might actually be a good thing, though. Currently I have to do it for a couple of domains every year. By forcing me to automate it, it takes me more time once, but afterwards I don't have to look at it anymore at all.
- StavrosK 11y ago
  Ugh, really? I was planning on only using the tools to write out the initial certificate file, as I don't want too much running on my servers. This has certainly put a damper on my excitement about Let's Encrypt.
  - detaro 11y ago
    From a quick look at the protocol, it shouldn't be an issue to run the ACME client on one host and scp CSRs from your servers to it, hand them to lets encrypt, and move the results back. So yes, you have to touch or run it every 2-3 months, but it doesn't have to run on all your servers.
    - StavrosK 11y ago
      I'm more wondering if I can cron it (without sudo), and not have it run as a daemon. Then, once every two weeks or so, it can just refresh the cert using the csr I generated before. It should be pretty easy to do, I'm just not familiar with the clients at this point.

RawInfoSec 11y ago

Plus lack of identity validation. While the author of the article minimizes this, we shouldn't remove it from the equation just because users can't tell the difference. The right thing would be to fix the users understanding rather than weaken the product. LetsEncrypt will be good for all those sites we deploy with self-signed certs, but won't be replacing major sites any time soon.

creshal 11y ago
Is identity validation under any circumstances more than snake oil? Neither users nor browsers could tell whether a site is supposed to run a domain- or identification validated certificate. (Fun fact, HN uses a domain validated cert.) All you get is higher costs for some X.509 fields nobody ever looks at, and nobody would miss if an MITMing attacker replaced your ID validated cert with an domain validated one.
- detaro 11y ago
  You can use HPKP to pin EV-only root CAs, so you can still replace your cert, but it can only be replaced against another EV one. Doesn't protect against a hacked/rogue CA, but against someone getting access to your DNS/mail/web server and getting a useable certificate from a only-domain-validating CA.
  - nailer 11y ago
    Couldn't you also use HPKP to pin the EV-only root?
    - detaro 11y ago
      That's actually what I meant. Edited.
  - creshal 11y ago
    Yes, but EV is not the same as identity validation. That's another variant of certificates that was only introduced because identity validation alone is so bloody useless.