3 ms·

Sounds like they're working on a new http challenge plugin for nginx that should solve this webroot hack/workaround for the fact that the existing nginx plugin

by rconti 9y ago

Sounds like they're working on a new http challenge plugin for nginx that should solve this webroot hack/workaround for the fact that the existing nginx plugin for certbot only works over tls-sni-01 which has been disabled by the letsencrypt folks. I anxiously await it as it's easier to deal with the nginx plugin when you've already got nginx running for other reasons, rather than having to disable your existing webserver. Not thrilled about having to temporarily allow http, but c'est la vie. I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially.

schoen 9y ago
> I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially. This method was called HTTPS-01 and was initially discussed at the IETF ACME WG. My recollection is that it was rejected for a reason similar to why TLS-SNI-01 has just been disabled: many hosting providers' practices would designate one customer as the default HTTPS virtual host for all incoming HTTPS requests. Therefore, that customer would be in a position to get a certificate for any other customer on that infrastructure. This problem was easier to notice for HTTPS-01 than the corresponding problem with TLS-SNI-01 (which is that you can upload invalid certificates for names that aren't hosted on the infrastructure at all, and thereby get some shared hosting environments to believe that they're third-party certificates for your own sites that you've imported from elsewhere, while they're actually ACME challenge certificates for a different customer on the same infrastructure).
- rconti 9y ago
  Thanks, that makes sense.
JeanMarcS 9y ago
You mean I spent last weekend learning how to update my DNS with nsupdate to replace the nginx sni broken challenge for nothing :-D ? Well, not for nothing as I now know better.

by rconti 9y ago

schoen 9y ago

> I wonder why we can't just have an https-based known-file challenge that works exactly like the http one, but over https, and just accepts whatever cert you throw at it initially. This method was called HTTPS-01 and was initially discussed at the IETF ACME WG. My recollection is that it was rejected for a reason similar to why TLS-SNI-01 has just been disabled: many hosting providers' practices would designate one customer as the default HTTPS virtual host for all incoming HTTPS requests. Therefore, that customer would be in a position to get a certificate for any other customer on that infrastructure. This problem was easier to notice for HTTPS-01 than the corresponding problem with TLS-SNI-01 (which is that you can upload invalid certificates for names that aren't hosted on the infrastructure at all, and thereby get some shared hosting environments to believe that they're third-party certificates for your own sites that you've imported from elsewhere, while they're actually ACME challenge certificates for a different customer on the same infrastructure).

rconti 9y ago
Thanks, that makes sense.

JeanMarcS 9y ago

You mean I spent last weekend learning how to update my DNS with nsupdate to replace the nginx sni broken challenge for nothing :-D ? Well, not for nothing as I now know better.