5 ms·

SSL certs are such a pain to manage in orgs.

deathanatos 5y ago
And because I violent agree with this: even w/ Let's Encrypt this is still a pain. (Though, it is at least a better engineered pain, and theoretically tractable.) DNS providers that have bugs¹, services that want to host on port 80 & won't let me proxy them through nginx, auditors that want block port 80 (guess what ACME uses), services that generate malformed X.509 certs (golang's standard library…), programs that want certs in weird formats (PKCS#12 & Java, I'm looking at you), bad OpenSSL defaults, the rate limits (sorry LE, they're still too low) and just there are probably about 2 dozen people who really understand X.509 & web PKI and the rest of my company it is wizardry (it really isn't). ¹a certain large provider for the longest time failed to handle having two TXT records, which ACME requires in some circumstances.
- est31 5y ago
  > services that generate malformed X.509 certs (golang's standard library…) In which way are those certificates malformed? Is it because they don't have the extensions needed to pass certlint?
  - deathanatos 5y ago
    Malformed subject, IIRC. It's not every cert, mind you (I didn't intend to imply that) it's just the ones that happen to not specify some element. Unfortunately, it's the default of a utility that we use, that's written in Go. It generates a very long-lived cert on start, and by default, it'll be malformed. We have another utility (that crawls certs looking for ones near expiry. That cert trips it up. (And it now has a configurable ignore-list specifically so that we can ignore that cert.) But more and more I appreciate libraries who (produce well-formed output) xor (error). Go also has a "simpler" interface to X.509 in its standard library that will easily produce the wrong (but well-formed; i.e., wrong semantically, not syntactically / not what any user is gong to want) output under very easy-to-accomplish circumstances.
    - anitil 5y ago
      This describes so much of my work. "We have a thing that does X. Except sometimes it doesn't, so we have another thing Y that checks X. Except sometimes it doesn't, so we .... "
    - est31 5y ago
      Thanks for this explanation! I'm always curious about such user stories because I maintain a library to generate certificates.
      - deathanatos 5y ago
        I found the bug: https://github.com/bitnami-labs/sealed-secrets/issues/398 https://github.com/bitnami-labs/sealed-secrets/issues/398 — it's actually an empty Issuer DN. Seems like it was recently fixed too, which is nice. Now I'll have to find a way to upgrade…

And because I violent agree with this: even w/ Let's Encrypt this is still a pain. (Though, it is at least a better engineered pain, and theoretically tractable.) DNS providers that have bugs¹, services that want to host on port 80 & won't let me proxy them through nginx, auditors that want block port 80 (guess what ACME uses), services that generate malformed X.509 certs (golang's standard library…), programs that want certs in weird formats (PKCS#12 & Java, I'm looking at you), bad OpenSSL defaults, the rate limits (sorry LE, they're still too low) and just there are probably about 2 dozen people who really understand X.509 & web PKI and the rest of my company it is wizardry (it really isn't). ¹a certain large provider for the longest time failed to handle having two TXT records, which ACME requires in some circumstances.

est31 5y ago
> services that generate malformed X.509 certs (golang's standard library…) In which way are those certificates malformed? Is it because they don't have the extensions needed to pass certlint?
- deathanatos 5y ago
  Malformed subject, IIRC. It's not every cert, mind you (I didn't intend to imply that) it's just the ones that happen to not specify some element. Unfortunately, it's the default of a utility that we use, that's written in Go. It generates a very long-lived cert on start, and by default, it'll be malformed. We have another utility (that crawls certs looking for ones near expiry. That cert trips it up. (And it now has a configurable ignore-list specifically so that we can ignore that cert.) But more and more I appreciate libraries who (produce well-formed output) xor (error). Go also has a "simpler" interface to X.509 in its standard library that will easily produce the wrong (but well-formed; i.e., wrong semantically, not syntactically / not what any user is gong to want) output under very easy-to-accomplish circumstances.
  - anitil 5y ago
    This describes so much of my work. "We have a thing that does X. Except sometimes it doesn't, so we have another thing Y that checks X. Except sometimes it doesn't, so we .... "
  - est31 5y ago
    Thanks for this explanation! I'm always curious about such user stories because I maintain a library to generate certificates.
    - deathanatos 5y ago
      I found the bug: https://github.com/bitnami-labs/sealed-secrets/issues/398 https://github.com/bitnami-labs/sealed-secrets/issues/398 — it's actually an empty Issuer DN. Seems like it was recently fixed too, which is nice. Now I'll have to find a way to upgrade…