3 ms·
Some systems aren't internet connected 24/7 and thus not able to autorenew all the time. Not a problem if someone has to do it manually every year or two years
by t0mas88 7y ago
Some systems aren't internet connected 24/7 and thus not able to autorenew all the time.
Not a problem if someone has to do it manually every year or two years, but it becomes a bigger issue if you need to renew a cert every 30 days.
- throw0101a 7y agoAlso, some systems are internal only, so can't use http-01 validation. We have a bunch of these like this, so for our "foo.int.example.com" systems, in our public DNS we have a CNAME pointing to "foo.int.dnsauth.example.com", and have set up a new DNS infrastructure so that we can use dns-01 validation of TXT records there: * https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... I had no idea that this functionality existed until fairly recently.
- AstralStorm 7y agoAnd the DNSSEC is authenticated with how often renewed certificate? If there's no DNSSEC, this is entirely worthless. DNS is very easy to attack.
- tptacek 7y agoCAs are in general CT-logged now, and major sites all monitor the CT logs (hell, even small sites do at this point). If it's so easy to attack DNS to achieve misissuance, why isn't it happening all the time?