14 ms·
Let's Encrypt now fully supports IPv6
- matt4077 10y agoSo unfair! Comodo once, a while ago, also thought about using IPv6! But seriously: letsencrypt is doing excellent work. It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss.
- mtgx 10y ago> So unfair! Comodo once, a while ago, also thought about using IPv6! In case anyone doesn't get it: http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-tries-to-trademark-upstart-rivals-lets-encrypt-name/ http://arstechnica.com/tech-policy/2016/06/800-pound-comodo-...
- yuhong 10y agoThis also reminds me of SGC certificates where browsers only trusted a limited number of roots.
- DanielDent 10y agoSGC certificates were entirely a result of bizarre US export restrictions.
- icebraining 10y ago1It's a great case study in how inefficient a mostly-free market can be: SSL adoption doubled within a year. All that was previously deadweight loss. And also in how a market fixes itself :)
- nightpool 10y agoLet's Encrypt is a non-profit organization run as a public service by the Internet Security Research Group. Not exactly the same thing as a competing company. Market forces are not compelling these people to donate money, they're doing it because they believe in the goals of the organization.
- teekert 10y agoNicely enough, this is made possible by the freedoms in the current market (economic system.) One should not forget that the freedom to donate ones' work is also part of a free market. I like this interview with Linus Torvalds [0, 1] where he admits it was for his pleasure and thus for his personal gain that he made Linux. Rational self-interest does not require financial rewards to be satisfactory. It did make him a millionaire in the end though (because Red Hat gave him stock options). This also show how he can be a dick sometimes while still being of immeasurable value to the global economy. He does it because he likes it, not because he likes you or wants you to like him. [0] https://www.theobjectivestandard.com/2012/06/linux-creator-linus-torvalds-celebrates-rational-selfishness/ https://www.theobjectivestandard.com/2012/06/linux-creator-l... [1] http://www.bbc.com/news/technology-18419231 http://www.bbc.com/news/technology-18419231
- vertex-four 10y agoWhile true, the economic environment is also geared towards an assumption that you'll provide the vast majority of your work to a company that takes ownership of the results and directly pays you for it. In my country, the majority of the current generation will likely never own a house, let alone be financially comfortable enough to work on a social project full-time. The result is that the only way for someone who isn't wealthy to do charitable work is to get either Government or companies to pay you to do it. Companies will generally only pay you to do work if they're getting something out of it, and Government has its own interests at heart. Getting people to pay you to do something is very, very difficult - it's hard enough if you're selling them something directly and right now, significantly harder if you're still working on a project, and harder still if there might not be anything concretely benefiting the person donating at the end of it. Charities largely manage by not paying many of the people who perform work for them, along with begging money from Government and companies, and their volunteers primarily depend on Government welfare. It's not a perfect system in the slightest - it's incredibly hard work to be able to perform any sort of charitable work, at least as hard as running a business, and is heavily subsidized. A system which ensured that everyone's needs were met by default, rather than requiring you to prove that you deserve to have your needs met, would allow significantly more charitable work - specifically, it would allow for work that rewards the worker in ways other than monetary pay.
- zanny 10y agoThere is no such thing as a free market when certificates were only created and issued by those who had the political clout to get their authority in the Microsoft / Google / Mozilla trusted keyring or in the trust network of another trusted provider. A free market is one where you can compete independently. If anything, it is a demonstration of why faux-markets with monopoly control (or in this case, the collusion between established and trusted authorities to prevent competition) are dangerous.
- iancarroll 10y agoWhat? Anyone can become a certificate authority, so long as you'll take the time to document your procedures, store the private key securely, and be externally audited. You probably want an insurance policy as well. The only program that charges money to be included is/was Oracle, as far as I know. Everyone else is free.
- Chlorus 10y agoWhat's the premium look like for an insurance policy for a private key?
- cmdrfred 10y agoWhat does it cover, exactly? Every loss from misuse of the key? Sounds expensive.
- viraptor 10y agoEveryone else charges indirectly. Inclusion is free, you "only" need to go through someone like webtrust who will charge you $100k+ for an audit.
- superuser2 10y agoSo? Relying on commercial auditors to verify compliance with published industry standards is a pretty common free-market solution to problems of trust.
- lmm 10y agoWas it the same market though? Or is the shift largely driven by Google's ranking changes in that period?
- jimktrains2 10y agoWhat's this mean? If a site only has an AAAA record it can now get a cert?
- bracewel 10y agoYup.
- jo909 10y agoI think you could always get a cert via the ACME DNS challenge for an IPv6-only/AAAA-only domain. But you could not talk to the ACME/API endpoint from an IPv6-only system, so actually requesting and retrieving the cert would have to happen on another, IPv4, system. (Just as a sidenote: you _never_ need to request and retrieve the cert on the system that the domain name points to. That is just the easiest way and the workflow most clients suggest, since it also makes a lot of sense.)
- voltagex_ 10y agoWould it be possible to set up a somewhat isolated VM that has the sole purpose of requesting certs? I get stuck on needing either the webroot or standalone method of certbot-auto.
- majewsky 10y agoWhat's your specific problem with the webroot method? I'm using it on my systems, and contrary to popular belief, the certbot can easily run as a non-root user when using the webroot method. (My configuration is at https://github.com/majewsky/system-configuration/blob/master/hologram-letsencrypt.pkg.toml https://github.com/majewsky/system-configuration/blob/master... .)
- jo909 10y agoThis is in no way criticism against LE, where I work _nothing_ is IPv6 and we do not even have it on any agenda. But when an "we are going to change the future of the internet"-project makes IPv6 a Prio-2 feature (to be added later, not native from the start) it just shows that we are really not there yet.
- scrollaway 10y agoAWS still has no native IPv6 support. It's sad really. It's pointless for a project like LE to make IPv6 a first-priority feature when massive providers running the backbone of the internet don't support IPv6 without a ton of fiddling-around.
- mordocai 10y agoThis is 100% why my site is not ipv6
- chatmasta 10y agoIt's not in AWS business interest to support IPv6. As long as they only support IPv4, they need to own an address for every VM in their cloud. As they grow, they purchase more addresses, shrinking the pool of available IPv4 on the secondary market, increasing the price for their competitors. This makes it more expensive to compete with AWS on a large scale if you want to support IPv4.
- IgorPartola 10y agoSorry, but I don't see it. While they are busy buying up IPv4 addresses, I'll just be over here moving everything to IPv6 only and not have to care about any of that.
- api 10y agoUntil almost the entire Internet has IPv6 at the endpoint, you're making your stuff unreachable to most people. You will still need an IPv4 gateway. I have IPv6 at home now but still don't have it at our tech-oriented co-working space, and I've never seen an IPv6 address get handed out at a coffee shop, airport, restaurant, etc.
- sp332 10y agoAccording to conversation on https://github.com/letsencrypt/boulder/issues/593 https://github.com/letsencrypt/boulder/issues/593 they couldn't support it because one of their datacenters didn't support IPv6 traffic.
- IgorPartola 10y agoWhich sucks because a data center that doesn't support IPv6 is the 2016 version of a data center that only does Token Ring networking.
- azernik 10y agoThey are unfortunately and shockingly common.
- imglorp 10y ago(Cough) AWS? (cough) What's up with that anyway?
- TenOhms 10y agoAs someone who is responsible for protecting networks for large data centers the biggest issue I see with adopting IPv6 is the overhead required. I took a job with another company this last year and while I thought the asset tracking was bad my previous company, I found it can get much worse. I have clients whom we host servers for that I have no clear method of determining what their IP space is. System Admins routines make mistakes with complicated host names and trying to acquire an accurate inventory is an absolute nightmare. This ties into IPv6 because why would anyone take that disfunctional system, which barely works with 'easy' IPv4 addresses, and make it even more complex? We would have to support both IPv4 and IPv6 simultaneously and firewall rules would get much more complex initially and they are already a huge issue for me to get changes made. At my old job this was similar. Even though it was in the financial industry and that particular company was rolling in profits it couldn't keep enough network engineers around to save it's life. The turnover was high, documentation was horrible and projects to make things better languished on in the ether. No no no, forget the whole IPv6 thing, just run IPv4 for all things internal and gratuitously support IPv6 outside if you really have to. I jest of course, but that is the reality of my corporate life in the last 6 years in two fortune 500 companies.
- jdc0589 10y agosomeone play devils advocate and tell me reasons I might not want to use LetsEncrypt? (aside from potential issues from short-lived certs).
- antonplus 10y agoThe short-term certs is an issue, but LE does automatic renewals and send expiration notices. However, I also use letsmonitor.org for monitoring/expiration alerts.
- serge2k 10y agoShort term certs are only an issue if you have inadequate tooling.
- vizza 10y agoTrue, but if it fails and you don't know it, that could be a major problem. Monitoring with alert escalation helps me sleep at night.
- serge2k 10y agoThat's not a problem specific to lets encrypt, or anything else really. If you don't want to introduce complexity, then your problem is that you don't have tooling in place when you run into a situation where you have to rotate certs.
- superkuh 10y agoSure. And the tooling only exists pre-made for modern operating systems. If you run anything even a handful of years old there's no support and you have to do it by hand.
- serge2k 10y agoSo write your own tool. There are loads you can fork. Not buying this excuse.
- antonplus 10y agoSince LE certs have 90 day expiration, I use a monitoring/notification service called https://letsmonitor.org https://letsmonitor.org
- INTPenis 10y agoExpected but when is Tor support coming? I read a forum thread indicating it would be nigh on impossible due to .onion tld status.
- pfg 10y agoThat's not up to Let's Encrypt, Baseline Requirements created by the CA/B Forum only permit EV for *.onion.
- schoen 10y agoSince ISRG is a CA/B Forum member, we can also propose to change this in the future.
- kstrauser 10y agoI'm asking out of ignorance because it'd never occurred to me before just now: would you need HTTPS on a Tor site? I thought Tor itself would handle trusted encryption for you. Or is that as a layer of defense against malicious nodes?
- icebraining 10y agoIt does for hidden services, but HTTPS allows the browser to know the connection is secure, which lets it apply different rules, like mixed content blocking (if, say, you're browsing a .onion forum and someone links to an image hosted on a non-onion address).
- Nullabillity 10y agoThen perhaps browsers should whitelist .onion as "secure" regardless of protocol? I'd also like to see whitelists for the reserved-for-private-use IPv4 ranges and a .local or .home TLD, since those are circumstances where HTTPS doesn't give you much either, and where getting a certificate is unreasonably difficult.
- 10y ago
- Animats 10y agoYou mean it didn't?
- awqrre 10y agoDoes that mean that you are not using IPv6? I know I am not...
- yeukhon 10y agoFamous question - intranet. We can do dns-01 verification, on intranets (like valid domain). But the downside is our domain would be logged in the certificate transparency log. What is the downside of being on the log?
- spikengineer 10y agoWhether you like it or not, all certs in the near future from all providers will be logged anyway. Most sysadmin don't like their intranet adresses being in the log so as to not provide intel to intruders.
- yeukhon 10y agoAh. I didn't realize we will eventually. So if I get a cert for *.dev.example.com I am exposing just dev.example, but not foo.dev.example.com?
- eeZi 10y agoYes, the log is static. It only contains the subject name if the certificate. But there's little to fear from exposing internal domain names. DNS names are more or public knowledge - they are transmitted unencrypted, end up in plenty of caches etc. Attackers can probably brute force it or the PTR records anyway.
- drdaeman 10y agoIf you don't expose your intranet resources to the outside world, you can probably set up your CA. With proper measures (non-exportable key on a HSM, stored in a safe, requires a PIN that only senior security staff knows, etc etc), it may even improve security for some attack scenarios - if someone gains control of your DNS servers for a short while, they won't be able to issue anything.
- yeukhon 10y agoCan you elaborate where does the HSM come into play with the DNS verification? I am not following. thanks.
- AndyMcConachie 10y agoDoes anyone know if Let's Encrypt supports DNSSEC validation? I mean, do their data center recursive DNS servers do DNSSEC validation? I'm wondering how easy it would be to forge DNS responses to their servers checking that I control a domain name.
- bracewel 10y agoDNSSEC is enforced at the resolvers.
- AndyMcConachie 10y agoThanks. Since my zones are secured with DNSSEC that makes me feel a bit safer.
- icebraining 10y agoHow would you MITM their connection to the DNS servers, though?
- toast0 10y agoYou don't need to MITM, if you can predict the request and get your spoofed response in faster than the real server.
- icebraining 10y agoIf the server randomizes both the Query-ID and source port, the attacker has less than 1/100000000 chance of sending a valid reply: http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html#fix http://unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html#fi...
- toast0 10y agoAn attacker can send more than one packet, and likely make multiple attempts to 'verify' the domain under attack. If the attack window is 1 second, and an attacker can source 1 million (spoofed) packets per second, and the server is using the full space for source port and query ids, and there's a single resolver, the attacker can get a cert fraudulently issued about 1 out of 4000 times. DNSSEC makes that much harder, so it's nice that their resolvers are using it.
- serge2k 10y ago> We’re looking forward to the day when both TLS and IPv6 are ubiquitous. Kudos to Lets Encrypt for their great work on the former. A single sad tear for the state of the latter.
- JohnnyLee 10y agoFor any Go users out there, I'd recommend Russ Cox's package: https://godoc.org/rsc.io/letsencrypt https://godoc.org/rsc.io/letsencrypt. It automatically acquires certificates and keeps them up to date.
- deleted 10y ago[deleted]
- getraf 10y agoGreat news.
- haasn 10y agoAwesome! This was the second of only two steps to remain until I can fully turn on HTTPS. Now they just need support for IDNs (which they've also announced) and LetsEncrypt will be functionally complete from my point of view.