2 ms·

I love how complex this has become. Debian now needs to build a custom API, or use DDNS secured just right for LE verification records (which would give mirrors

I love how complex this has become. Debian now needs to build a custom API, or use DDNS secured just right for LE verification records (which would give mirrors full access to obtain any debian.org cert, as the DNS-01 challenge doesn't contain enough info to filter on. You either control DNS, or you don't - DNS-01 doesn't have a middle ground of owning a single record AFAIK, and it certainly doesn't have the concept of shared ownership of a single record without race conditions..). Now multiply that by the 1000 or more projects that each mirror syncs content from, all with something different because nothing standard exists. LetsEncrypt is great, I love it, I have 10's of certs for personal stuff from them. I think they've completely changed the CA landscape, hopefully forever. However I'll say it again, LetsEncrypt does not solve this problem. That's OK. LetsEncrypt doesn't have to solve every problem with TLS!

zaarn 8y ago
>DNS-01 doesn't have a middle ground of owning a single record AFAIK, With DNS-01 you only own up to the domain you verified. If you verify ftp.de.debian.org then you can't issue certs for de.debian.org or debian.org but you can issue for www.ftp.de.debian.org. I don't see the issue with that.
- kiallmacinnes 8y ago
  I see an issue with that - but it's possible I'm too paranoid when it comes to many third parties being able to issue certificates for my domain on names I wasn't expecting.. Each to their own! Either way - assuming restricting issuance to exactly 1 name is a solved problem.. This: What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. is still a far cry from reality thanks to all the other issues. If anything, it's: What? No. Certs are just the tip of the iceberg, even if LetsEncrypt solved that problem neatly (and they don't), you have ignored the massive complexity of the issue, both the technical and organisational issues.
  - zaarn 8y ago
    It will have to be solved considering an major vulnerability was released today that allows any attacker to get root-level RCE by manipulating the HTTP Response. HTTPS as default would have severely reduced the attack surface for this bug.

zaarn 8y ago

>DNS-01 doesn't have a middle ground of owning a single record AFAIK, With DNS-01 you only own up to the domain you verified. If you verify ftp.de.debian.org then you can't issue certs for de.debian.org or debian.org but you can issue for www.ftp.de.debian.org. I don't see the issue with that.

kiallmacinnes 8y ago
I see an issue with that - but it's possible I'm too paranoid when it comes to many third parties being able to issue certificates for my domain on names I wasn't expecting.. Each to their own! Either way - assuming restricting issuance to exactly 1 name is a solved problem.. This: What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. is still a far cry from reality thanks to all the other issues. If anything, it's: What? No. Certs are just the tip of the iceberg, even if LetsEncrypt solved that problem neatly (and they don't), you have ignored the massive complexity of the issue, both the technical and organisational issues.
- zaarn 8y ago
  It will have to be solved considering an major vulnerability was released today that allows any attacker to get root-level RCE by manipulating the HTTP Response. HTTPS as default would have severely reduced the attack surface for this bug.