6 ms·

I think Let’s Encrypt is great, but it is worth noting that other ACME providers do exist, for example, ZeroSSL. Worth noting since it seems like LE is quickly

by jchw 5y ago

I think Let’s Encrypt is great, but it is worth noting that other ACME providers do exist, for example, ZeroSSL. Worth noting since it seems like LE is quickly becoming a gigantic SPOF for the internet!

zoobab 5y ago
Recipe for disasters. Who designed this SPOF?
- stingraycharles 5y ago
  Nobody “designed” it and as the parent said, there are alternatives. It’s just that SSL certificates need to be generated by an authority, and LE is the authority chosen by most people that use LE’s technology.
- throwaway290232 5y ago
  A couple people. Working groups that decide internet standards. Industries and private companies that control how the internet works. Web browsers that determine how the world wide web works. Organizations made up of people from each of these categories. And of course, every single user, developer, vendor, etc that hungrily adopts and subsequently becomes dependent on everything they put out. There is no God, but there are working groups of angels discussing Existence Standards.
Shorel 5y ago
Or a single point of entry for a powerful enough government.
- sneak 5y ago
  Every root CA (your browser and OS have dozens built in, including those explicitly issued by governments, including ones hostile to you) is a point of entry for a government to compromise TLS. There's no "single" one, hence all of the varied efforts (DANE, CT, et c) to reduce this attack surface.
  - Scaevolus 5y ago
    Pinning and certificate transparency help a lot. Chrome errors out on TLS certificates that aren't in the certificate transparency log, so an attacker merely having a trusted CA is insufficient to silently MITM traffic.
    - xg15 5y ago
      Yes, it will show up in the CT logs, but so what? This assumes everyone is watching the CT logs and is able to distinguish expected from unexpected entries. And until the entry is discovered, they can still MITM traffic. But with CT logs, why do we need CAs at all? After all, an ACME-capable CA cannot verify anything else than that I control the site's DNS record at that particular point in time (from the PoV of wherever the CA's servers are located) But that kind of validation could just as well be performed by the CT log directly. It seems to me, the real SPOF are DNS registrars. The authoritarian government (or some disgruntled employee of the registrar) could just force the registrar to hand over control of my DNS record to them, point it to their own server and ask LE to hand them a brand new certificate.
      - sneak 5y ago
        DNS is totally unauthenticated. It's the NSPs/ISPs you have to worry about, and they are already in bed with the covert spying apparatus of the state. See also: QUANTUMINSERT
        xg15 5y ago
        No, HTTPS with ACME certs protects well against that particular threat model: The CA runs the challenge from their own servers and contacts the registrar directly. That exchange completely bypasses my ISP. A bad ISP still can intercept my DNS queries and point my browser to an MITM server - but it cannot intercept the CA's query and therefore cannot complete the challenge. So they can't obtain the certificate their MITM proxy would need. DoH goes one step further (in theory) : When enabled, my own DNS queries are proxied to Cloudflare, so my ISP cant even intercept those anymore. The downside of ACME is just that if someone manages to manipulate the record that is actually stored at the registrar, they get the ability to stamp themselves valid HTTPS certificates for that domain for free. Doesn't even matter which CA the site owner uses, they can alway get a Let's Encrypt cert that will be accepted by all browsers.
sneak 5y ago
Certificates issued are good for multiple weeks, and all of the automated tooling renews when there is over 7d of certificate validity left, so they'd have to have a very long outage for this to actually take properly configured sites down. They're not in the request path, and aren't accurately considered a point of failure. This is how the PKI works, by design.
- Ajedi32 5y ago
  In this case it looks like their OCSP servers are down as well though. I think the validity period for OCSP responses is a bit shorter than 7 days. Even ignoring that, 7 days is a rather short period of time for such a large portion of the web to migrate to another CA if that were to become necessary for whatever reason. IMO having another free, independently operated ACME CA would be ideal, particularly if it could support having built-in fail-over added to ACME clients as a default setting.
  - coder543 5y ago
    > IMO having another free, independently operated ACME CA would be ideal Did you see this comment? https://news.ycombinator.com/item?id=27885851 https://news.ycombinator.com/item?id=27885851
    - Ajedi32 5y ago
      Obviously yes; it's in the comment chain I'm replying to. ZeroSSL is good, but AFAIK its free tier[1] doesn't support everything Let's Encrypt does (like wildcard certs) which makes it difficult to use as a drop-in replacement for many people. [1]: https://zerossl.com/pricing/ https://zerossl.com/pricing/
      - gsich 5y ago
        True, but my guess is that most certificates are not wildcards.
      - terom 5y ago
mholt 5y ago
Currently, Caddy will automatically fail over to ZeroSSL if it can't get a cert from Let's Encrypt. (You can even configure other sources in addition to, or instead of, LE and ZeroSSL. For example, you could have it fall back to a self-signed cert as a last resort.) There's really no good reason for a site to go down due to PKI. Caddy has proven this.
- Arnavion 5y ago
  Does it handle updating the domain's CAA record? Or do you have to not use CAA records when using this feature?
  - coder543 5y ago
    You can have multiple CAA records for a domain. Given how slow DNS propagation is, rapidfire rewriting of CAA records as you failover to a different CA seems like a recipe for causing errors... which is the last thing you want as you're failing over. I did a quick google search, and nothing indicated that Caddy will manage CAA records for you, which sounds very sensible to me.
    - Arnavion 5y ago
      Having multiple CAA records seems to me to kind of defeat the purpose of having a CAA record in the first place. But I guess if you limit it to two or three it'd still be fine.
      - majewsky 5y ago
        The purpose of CAA records is mostly to exclude CAs you don't trust. It's less of a "I trust Let's Encrypt" and more of a "I don't trust Honest Achmed". (Context for "Honest Achmed": https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959)
  - mholt 5y ago
    This can be automated with DNS provider modules, if someone would like to implement it: https://github.com/caddy-dns https://github.com/caddy-dns
Hamuko 5y ago
ZeroSSL is limited to three certs per account if you don't pay for ZeroSSL.
- coder543 5y ago
  The pricing page is admittedly confusing, but look carefully at the bottom of the free tier... it says "∞ [infinite] 90-day ACME Certs". It appears to only be limited to 3 if you issue them through the web UI. Based on documentation elsewhere on the site, it seems to clearly include all kinds of ACME certs, even wildcard, but I've never actually used ZeroSSL myself, as far as I can remember.

by jchw 5y ago

zoobab 5y ago

Recipe for disasters. Who designed this SPOF?

stingraycharles 5y ago
Nobody “designed” it and as the parent said, there are alternatives. It’s just that SSL certificates need to be generated by an authority, and LE is the authority chosen by most people that use LE’s technology.
throwaway290232 5y ago
A couple people. Working groups that decide internet standards. Industries and private companies that control how the internet works. Web browsers that determine how the world wide web works. Organizations made up of people from each of these categories. And of course, every single user, developer, vendor, etc that hungrily adopts and subsequently becomes dependent on everything they put out. There is no God, but there are working groups of angels discussing Existence Standards.

Shorel 5y ago

Or a single point of entry for a powerful enough government.

sneak 5y ago
Every root CA (your browser and OS have dozens built in, including those explicitly issued by governments, including ones hostile to you) is a point of entry for a government to compromise TLS. There's no "single" one, hence all of the varied efforts (DANE, CT, et c) to reduce this attack surface.
- Scaevolus 5y ago
  Pinning and certificate transparency help a lot. Chrome errors out on TLS certificates that aren't in the certificate transparency log, so an attacker merely having a trusted CA is insufficient to silently MITM traffic.
  - xg15 5y ago
    Yes, it will show up in the CT logs, but so what? This assumes everyone is watching the CT logs and is able to distinguish expected from unexpected entries. And until the entry is discovered, they can still MITM traffic. But with CT logs, why do we need CAs at all? After all, an ACME-capable CA cannot verify anything else than that I control the site's DNS record at that particular point in time (from the PoV of wherever the CA's servers are located) But that kind of validation could just as well be performed by the CT log directly. It seems to me, the real SPOF are DNS registrars. The authoritarian government (or some disgruntled employee of the registrar) could just force the registrar to hand over control of my DNS record to them, point it to their own server and ask LE to hand them a brand new certificate.
    - sneak 5y ago
      DNS is totally unauthenticated. It's the NSPs/ISPs you have to worry about, and they are already in bed with the covert spying apparatus of the state. See also: QUANTUMINSERT
      - xg15 5y ago
        No, HTTPS with ACME certs protects well against that particular threat model: The CA runs the challenge from their own servers and contacts the registrar directly. That exchange completely bypasses my ISP. A bad ISP still can intercept my DNS queries and point my browser to an MITM server - but it cannot intercept the CA's query and therefore cannot complete the challenge. So they can't obtain the certificate their MITM proxy would need. DoH goes one step further (in theory) : When enabled, my own DNS queries are proxied to Cloudflare, so my ISP cant even intercept those anymore. The downside of ACME is just that if someone manages to manipulate the record that is actually stored at the registrar, they get the ability to stamp themselves valid HTTPS certificates for that domain for free. Doesn't even matter which CA the site owner uses, they can alway get a Let's Encrypt cert that will be accepted by all browsers.

sneak 5y ago

Certificates issued are good for multiple weeks, and all of the automated tooling renews when there is over 7d of certificate validity left, so they'd have to have a very long outage for this to actually take properly configured sites down. They're not in the request path, and aren't accurately considered a point of failure. This is how the PKI works, by design.

Ajedi32 5y ago
In this case it looks like their OCSP servers are down as well though. I think the validity period for OCSP responses is a bit shorter than 7 days. Even ignoring that, 7 days is a rather short period of time for such a large portion of the web to migrate to another CA if that were to become necessary for whatever reason. IMO having another free, independently operated ACME CA would be ideal, particularly if it could support having built-in fail-over added to ACME clients as a default setting.
- coder543 5y ago
  > IMO having another free, independently operated ACME CA would be ideal Did you see this comment? https://news.ycombinator.com/item?id=27885851 https://news.ycombinator.com/item?id=27885851
  - Ajedi32 5y ago
    Obviously yes; it's in the comment chain I'm replying to. ZeroSSL is good, but AFAIK its free tier[1] doesn't support everything Let's Encrypt does (like wildcard certs) which makes it difficult to use as a drop-in replacement for many people. [1]: https://zerossl.com/pricing/ https://zerossl.com/pricing/
    - gsich 5y ago
      True, but my guess is that most certificates are not wildcards.
    - terom 5y ago

mholt 5y ago

Currently, Caddy will automatically fail over to ZeroSSL if it can't get a cert from Let's Encrypt. (You can even configure other sources in addition to, or instead of, LE and ZeroSSL. For example, you could have it fall back to a self-signed cert as a last resort.) There's really no good reason for a site to go down due to PKI. Caddy has proven this.

Arnavion 5y ago
Does it handle updating the domain's CAA record? Or do you have to not use CAA records when using this feature?
- coder543 5y ago
  You can have multiple CAA records for a domain. Given how slow DNS propagation is, rapidfire rewriting of CAA records as you failover to a different CA seems like a recipe for causing errors... which is the last thing you want as you're failing over. I did a quick google search, and nothing indicated that Caddy will manage CAA records for you, which sounds very sensible to me.
  - Arnavion 5y ago
    Having multiple CAA records seems to me to kind of defeat the purpose of having a CAA record in the first place. But I guess if you limit it to two or three it'd still be fine.
    - majewsky 5y ago
      The purpose of CAA records is mostly to exclude CAs you don't trust. It's less of a "I trust Let's Encrypt" and more of a "I don't trust Honest Achmed". (Context for "Honest Achmed": https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959)
- mholt 5y ago
  This can be automated with DNS provider modules, if someone would like to implement it: https://github.com/caddy-dns https://github.com/caddy-dns

Hamuko 5y ago

ZeroSSL is limited to three certs per account if you don't pay for ZeroSSL.

coder543 5y ago
The pricing page is admittedly confusing, but look carefully at the bottom of the free tier... it says "∞ [infinite] 90-day ACME Certs". It appears to only be limited to 3 if you issue them through the web UI. Based on documentation elsewhere on the site, it seems to clearly include all kinds of ACME certs, even wildcard, but I've never actually used ZeroSSL myself, as far as I can remember.