5 ms·
Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is l
by throw2016 9y ago
Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated.
We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identity can be verified by out of band methods. Surely it's worth exploring.
What we have now effectively disempowers individuals and centralizes essential services which cannot be good in the long run.
- jhasse 9y agoYou shouldn't renew the 90 day cert on day 89 anyway. As long as Let's Encrypt isn't down for more than a day I don't see the problem.
- mastax 9y agoI don't disagree about CAs, but LE suggests to renew certs every 60 days. So unless this outage lasts a month or some acme tool is poorly made it shouldn't affect anything except new registrations.
- atonse 9y agoThe only exception is OCSP data. If you're stapling, I think that lasts a week, but I'm not 100% sure. Anyway, in either case, your site should absolutely be able to weather CA downtime like this.
- tscs37 9y agoYou can run your own ACME provider, the code is open source. Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question. The automation of LE is not the problem either. Properly automated systems would extend/renew the cert well before they are invalid, almost every LE guide I know mentions this on grounds of "what if LE is down". The only libraries and services affected are those who do not properly code for an external service provider being temporarily offline. The problem with OOB verification of certs is that it's slow and inefficient for almost all methods this can be done with. And it doesn't scale either. Imagine if everyone wanted to OOB verify the Google certs on the same day.
- mort96 9y ago> Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question. You know that's BS. All of your users would get certificate errors, that's what's preventing you from running your own CA.
- tscs37 9y agoRead carefully. "if people wo trust that CA is another question" Of course you won't get trusted but that's not the issue.
- nailer 9y agoOK done: we move to self signed certs. - Someone connects to wifi. - The wifi gives a DNS server. - The DNS server says some IP is foo.com. - foo.com isn't actually the foo.com you expect [1], but it's got a self signed DV cert so you connect to it, and give some bad person your data. That's why we don't more to self signed certs. [1] Of course, if you want to assert foo.com is actually the 'Foo, Inc' you were expecting that's a job for EV. Disclosure: I made https://certsimple.com https://certsimple.com that focuses on simplifying the identity verification process for EV certs.
- foepys 9y agoTLSA DNS records coupled with DNSSEC could eliminate the need for CAs but we still have a long way to go until we can rely on it.
- hsivonen 9y agoDNSSEC has a 1024-bit RSA root after Web PKI ( at least Mozilla-flavored) no longer did. Are the TLDs audited like CAs? Having to change the domain name to evade the TLDs bad security practices is more disruptive than switching CAs.
- mastax 9y agoThen you just move all the WoT issues of the CA system into DNS, no?
- Spivak 9y agoLong lived certs aren't necessarily insecure but revocation is a real issue that doesn't have a good solution outside of short cert lifetimes. People don't actually revoke their certs because it takes effort and costs money, browsers don't reliably check revocation lists if they do at all, and checking for revocations is bad for performance and privacy.
- benchaney 9y agoThe CA system isn't perfect, but we haven't moved off of it because there are no viable alternatives. Self signed certs are completely useless.