3 ms·

So good luck configuring your firewall or NAS that don't have a valid certificate.

acdha 5y ago
Seems like a great opportunity to secure your server rather than training humans to ignore security warnings, doesn't it?
- Majromax 5y ago
  Secure how? Obtaining a public certificate from a well-known registrar requires Internet connectivity for the ACME protocol, and that's at odds with the other best-security-practice of isolating internal systems like NAS devices well away from general Internet connectivity. The problem is even worse for home routers. They need Internet connectivity to have a chance of obtaining a certificate, but since they provide that connectivity to a network they can't obtain the certificate until they're set up. But setup generally happens via a web browser and captive portal, so we're right in the middle of a bootstrapping problem. https/TLS everywhere on the public Internet is a great thing, but it's not a reasonable expectation for private networks with private devices.
  - AstralStorm 5y ago
    Solved if DNSSEC is deployed and root certificates are available as they should be pinned. What, you're using old unsigned DNS and complaining about security? Or software so old that pinned certificates are outdated?
    - tptacek 5y ago
      Virtually none of the DNS hierarchy signed with DNSSEC, and it's unlikely it ever will be. It's a strange best practice to appeal to, since it's been categorically rejected by almost every security team in the industry.
- handrous 5y ago
  There are lots of perfectly good (well, suited to their purpose, anyway) appliances (as in: pieces of hardware that cost money) out there that have web interfaces that don't speak 100% valid https. In part, this is because achieving fully-valid https on a machine on a local network, without a static domain name, with a machine & network config that you (the vendor) don't fully control, potentially without an Internet connection, and without installing root certs on client devices is, to put it mildly, inconvenient, and used to be even worse. Getting rid of http or insecure-https support completely would render either them, or your browser, useless, and require that one or the other be replaced.

Seems like a great opportunity to secure your server rather than training humans to ignore security warnings, doesn't it?

Majromax 5y ago
Secure how? Obtaining a public certificate from a well-known registrar requires Internet connectivity for the ACME protocol, and that's at odds with the other best-security-practice of isolating internal systems like NAS devices well away from general Internet connectivity. The problem is even worse for home routers. They need Internet connectivity to have a chance of obtaining a certificate, but since they provide that connectivity to a network they can't obtain the certificate until they're set up. But setup generally happens via a web browser and captive portal, so we're right in the middle of a bootstrapping problem. https/TLS everywhere on the public Internet is a great thing, but it's not a reasonable expectation for private networks with private devices.
- AstralStorm 5y ago
  Solved if DNSSEC is deployed and root certificates are available as they should be pinned. What, you're using old unsigned DNS and complaining about security? Or software so old that pinned certificates are outdated?
  - tptacek 5y ago
    Virtually none of the DNS hierarchy signed with DNSSEC, and it's unlikely it ever will be. It's a strange best practice to appeal to, since it's been categorically rejected by almost every security team in the industry.
handrous 5y ago
There are lots of perfectly good (well, suited to their purpose, anyway) appliances (as in: pieces of hardware that cost money) out there that have web interfaces that don't speak 100% valid https. In part, this is because achieving fully-valid https on a machine on a local network, without a static domain name, with a machine & network config that you (the vendor) don't fully control, potentially without an Internet connection, and without installing root certs on client devices is, to put it mildly, inconvenient, and used to be even worse. Getting rid of http or insecure-https support completely would render either them, or your browser, useless, and require that one or the other be replaced.