4 ms·
The disadvantages are: it’s less secure — you’re trusting (many) third parties with your security and relying on the security of DNS it’s less flexible — you
by mmalone 8y ago
The disadvantages are:
it’s less secure — you’re trusting (many) third parties with your security and relying on the security of DNS
it’s less flexible — you can’t sign certificates with internal names (e.g., *.cluster.local) and certs must be for 90 days, etc
it’s kind of hacky — you have to work around rate limits and whatnot because Let’s Encrypt wasn’t designed for this use case
The advantage is it’s easier. But that’s arguable. What the article describes isn’t easy. Using something like cfssl (https://github.com/cloudflare/cfssl https://github.com/cloudflare/cfssl) or vault (https://github.com/hashicorp/vault https://github.com/hashicorp/vault) or step certificates (https://github.com/smallstep/certificates https://github.com/smallstep/certificates) (which I work on) is probably easier and definitely better for internal services.
- ec109685 8y agoWhy do you think trusting third parties is less secure than operating your own pki infrastructure?
- therein 8y agoBecause we are introducing a third party into a situation that didn't require a third party.
- mmalone 8y agoAnd if you just rely on the default trust stores you’re actually introducing over 100 third parties, some of which are known to be controlled by (or at least work with) the NSA, China, etc.
- ec109685 8y agoWith certificate pinning, that is not a high risk.
- mmalone 8y agoIf you’re talking about services that you’re accessing via a browser, true. If you actually do pinning (properly). For service-to-service stuff and APIs the number of TLS clients that respect pinning is approximately zero. Either way, the other problems remain, and running an internal PKI is really pretty easy.
- Thorrez 8y agoVery few sites use certificate pinning. Chrome dropped support for dynamic certificate pinning. Web based certificate pinning is often recommended against because it's very hard to do right. Also, using Let's Encrypt doesn't stop you from certificate pinning.
- tatersolid 8y agoCertificate pinning (HPKP) is browsers is effectively dead, and was never a good idea to begin with. There are far too many ways to self-DoS accidentally with HPKP. Also, an attacker who briefly gains control of your public DNS or web server can DoS a hostname semi-permanently.
- Ajedi32 8y agoWon't all the client machines already have hundreds of 3rd party CAs (including Let's Encrypt) loaded onto them anyway?
- mmalone 8y agoYea, by default anyways, but that doesn’t mean you need to use/trust them for a particular request. I’m talking mostly about service-to-service traffic fwiw, not browsers.
- bryanlarsen 8y agoInstalling certs on your own computer is easy. Installing certs on random testing phones? Not so easy. Let's encrypt just works.
- Thorrez 8y ago>it’s less secure — you’re trusting (many) third parties You're trusting those third parties regardless of if you use your own PKI, because browsers already trust all those root CAs anyways.