5 ms·

Yeah, currently the keys are held securely within AWS and it's only available for use within specific AWS services - Elastic Load Balancer & CloudFront at the m

Yeah, currently the keys are held securely within AWS and it's only available for use within specific AWS services - Elastic Load Balancer & CloudFront at the moment.

alanh 11y ago
So, no.
- deleted 11y ago
  [deleted]
- HorizonXP 11y ago
  I mean, since they're offering for free what many others charge ~$100 USD for, I'm not surprised. That said, SSL certs and domain renewals are the least interesting but high importance items of running an online business. As I'm already heavily deployed on AWS, I have no problem having them handle all of this for me, for what is free to me. (yes yes, not technically free)
  - deleted 11y ago
    [deleted]
sporkmonger 11y ago
So basically don't use this if you care enough about security to pin your certificates.
- deleted 11y ago
  [deleted]
- lpsz 11y ago
  It's always possible to get the public key, e.g. see the accepted answer here: http://security.stackexchange.com/questions/16085/how-to-get-public-key-of-a-secure-webpage http://security.stackexchange.com/questions/16085/how-to-get...
- detaro 11y ago
  Why does this stop you from pinning your certificate?
  - kuschku 11y ago
    You only care about pinning when you fear that a third actor somewhere between your server and the end client might MitM the connection with a valid certificate. If a third party controls your keys, certificate pinning is useless to prevent against attacks from that third party or governmental agencies.
    - pfg 11y ago
      Most HPKP deployments pin to root or intermediate certificates of CAs (usually 2 separate CA entities, in case something happens to the primary CA) - meaning in a typical scenario, the attack surface is approximately the same. Not sure if this approach is common in native applications that pin to keys as well.
    - detaro 11y ago
      Obviously. That doesn't mean pinning is impossible or useless against other threats though, so I don't think the argument makes sense in that general way. I bet there are tons of apps running/with backends running on AWS that should have certificate pinning.

Yeah, currently the keys are held securely within AWS and it's only available for use within specific AWS services - Elastic Load Balancer & CloudFront at the moment.

alanh 11y ago

So, no.

deleted 11y ago
[deleted]
HorizonXP 11y ago
I mean, since they're offering for free what many others charge ~$100 USD for, I'm not surprised. That said, SSL certs and domain renewals are the least interesting but high importance items of running an online business. As I'm already heavily deployed on AWS, I have no problem having them handle all of this for me, for what is free to me. (yes yes, not technically free)
- deleted 11y ago
  [deleted]

sporkmonger 11y ago

So basically don't use this if you care enough about security to pin your certificates.

deleted 11y ago
[deleted]
lpsz 11y ago
It's always possible to get the public key, e.g. see the accepted answer here: http://security.stackexchange.com/questions/16085/how-to-get-public-key-of-a-secure-webpage http://security.stackexchange.com/questions/16085/how-to-get...
detaro 11y ago
Why does this stop you from pinning your certificate?
- kuschku 11y ago
  You only care about pinning when you fear that a third actor somewhere between your server and the end client might MitM the connection with a valid certificate. If a third party controls your keys, certificate pinning is useless to prevent against attacks from that third party or governmental agencies.
  - pfg 11y ago
    Most HPKP deployments pin to root or intermediate certificates of CAs (usually 2 separate CA entities, in case something happens to the primary CA) - meaning in a typical scenario, the attack surface is approximately the same. Not sure if this approach is common in native applications that pin to keys as well.
  - detaro 11y ago
    Obviously. That doesn't mean pinning is impossible or useless against other threats though, so I don't think the argument makes sense in that general way. I bet there are tons of apps running/with backends running on AWS that should have certificate pinning.