17 ms·

Another free CA as an alternative to Let's Encrypt

652 points by mattowen_uk 5y ago

d33 5y ago
Just curious... has anyone so far decided to extend the 3-month certificate expiration deadline? I understand that for the intended use case it makes sense, but in some cases it's an overkill and having a CA support such use case could be useful. There's nothing in the technology itself that prevents us from having certs that expire in, say, a year, right?
- ttty2 5y ago
  I really hope this will happen. Sometimes my infra doesn't play well with let's encrypt. I don't think I'm alone. I just want 1 single docker instance, but because of let's encrypt I need to use docker compose, which is annoying. Each 3 months is a lot of work to do it manually. 12 months acceptable.
- gsich 5y ago
  I think Buypass has (or had) 6 months.
  - Koenvh 5y ago
    Correct, Buypass Go has a validity of six months. Unfortunately the free version does not support wildcards yet.
- w3ll_w3ll_w3ll 5y ago
  Let's encrypt decided for 3 month to force users to automate and avoid the burden of too much user support. They are a no-profit after all. I believe commercial CA are offering free certificates milted to 3 months for the same reasons, and for the up-selling opportunities. I think also cloud providers offer free 1 year TLS certificates, but of course you are also using their other services.
  - hexa22 5y ago
    3 months was an excellent choice because it means you _have_ to automate so it will never expire. While the 1 and 2 year certs always end up expiring on production because someone forgot about them.
    - flemhans 5y ago
      Now you just have to upgrade certbot every 1-2 years instead, it feels like.
      - martin-adams 5y ago
        Did that this morning. Was a complete pain but got there in the end.
      - danuker 5y ago
        I have a Debian server, and it has been running unattended pretty much since I installed it. I warmly recommend it. https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades
        flemhans 5y ago
        Me too, also on Debian. But there have been different installation methods over the time, certbot via deb package, installation script by piping in a URL, certbot-auto, something in /opt, lost track :D
        hexa22 5y ago
        I had to look at mine once in 5 years because acme v1 shut down.
    - wbond 5y ago
      It also means you have to automate things that are tied to your certificate lifetime. Apple Pay on the web requires you authenticate your server, and it uses your certificate serial num as proof you still own the server. This means every three months you need to re-authenticate with Apple Pay. But there is no Acme client for authenticating with Apple Pay. So instead, I was having to re-authenticate something manually every 3 months. It involved logging into an Apple Developer account, downloading a PEM file, uploading to my server and then clicking a button in the Developer Account to check the file. After doing that dance, I happily paid for 2 year certificates from RapidSSL. Now you can only buy one year certificates. I really hope the CAB isn’t successful in making those non-conforming and requiring shorter certs. There are plenty of other environments where certificate automation is not possible. And honestly, I haven’t seen arguments as to how on-machine automation is more secure than requiring someone be involved in the process. While I’m dreaming about improvements to the CA ecosystem, having some way to actually prove your are the company you claim would be amazing. Instead we are actively removing support for anything that tried to provide that…
- deleted 5y ago
  [deleted]
- matthewmacleod 5y ago
  Certificates used to be issued with validity up to 10 years way back. There's no technical bound on the validity period AFAIK, but all major browsers will now refuse to trust certificates with validity periods > 1 year so this can be considered the practical limit. I'm not aware of a dedicated service that offers free 1-year certs in the style of LetsEncrypt, but they'll often be available from e.g. hosting providers as part of a package. Hard to imagine a use-case where 90-day renewals aren't a better option, anyway.
  - norenh 5y ago
    The bound is basically set by the CA/Browser Forum [1] where the current baseline requirements [2] are stipulating: "6.3.2 Certificate operational periods and key pair usage periods Subscriber Certificates issued on or after 1 September 2020 SHOULD NOT have a Validity Period greater than 397 days and MUST NOT have a Validity Period greater than 398 days. Subscriber Certificates issued after 1 March 2018, but prior to 1 September 2020, MUST NOT have a Validity Period greater than 825 days. Subscriber Certificates issued after 1 July 2016 but prior to 1 March 2018 MUST NOT have a Validity Period greater than 39 months. For the purpose of calculations, a day is measured as 86,400 seconds. Any amount of time greater than this, including fractional seconds and/or leap seconds, shall represent an additional day. For this reason, Subscriber Certificates SHOULD NOT be issued for the maximum permissible time by default, in order to account for such adjustments." - CA-Browser-Forum BR 1.7.9, p67 [1] https://cabforum.org/ https://cabforum.org/ [2] https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/
  - ttty2 5y ago
    One simple use case... For example I have 1 simple docker app to deploy. Now I need to use docker compose with a more complicated workflow.
- maltalex 5y ago
  It’s a tradeoff between comfort and security since the fact that you control a domain now doesn’t guarantee you’ll be controlling it in 5 minutes, not to mention 3 months. This is why Let’s Encrypt gives you tools to automate the renewal process. I also recall them talking about gradually lowering the certificate lifetime so you’d have no choice but to use automatic renewal. Relevant link: https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html
- mtron_ 5y ago
  Sectigo provides SSL certificates with 1y validity via their certbot compatible Acme endpoint.
- folmar 5y ago
  Buypass will get you 6 months.
- sigio 5y ago
  buypass (also does acme), and uses 180 days expiration on their certs. I've been using it for a while, but they do limit certs to 5 alternate names, instead of the 99 on LE
tommica 5y ago
Nice, thanks for the creator for making this!
boramalper 5y ago
Caddy[0] also uses ZeroSSL[1] alongside Let’s Encrypt. [0] https://caddyserver.com/docs/automatic-https#overview https://caddyserver.com/docs/automatic-https#overview [1] https://zerossl.com/ https://zerossl.com/
- sam_goody 5y ago
  Caddy and ZeroSSL are the same company, "Stack Holdings GmbH". It used to be prominent on the respective pages, but is now stated in the footer.
  - joshxyz 5y ago
    thats a big TIL caddy is actually great! auto ssl
    - boramalper 5y ago
      Same here! I think it was ZeroSSL that bought Caddy now that I remember.
      - francislavoie 5y ago
        The announcement is here: https://caddy.community/t/caddy-and-certmagic-have-new-ownership-no-changes-to-licensing-or-development/9754 https://caddy.community/t/caddy-and-certmagic-have-new-owner...
  - tnolet 5y ago
    We use Caddy for serving our free dashboards and status pages on your own domain at https://checklyhq.com https://checklyhq.com It was not super easy to set up. I think the whole config is 20 lines or so, but the docs, naming and functionality of how Caddy actually interfaces with LE was tricky to find out. Basically had to scrape together answers from various GitHub issues etc. I should write a blog post… Edit: now it runs fine btw
    - 5y ago
Tobu 5y ago
More interesting to me will be when one of the ACME CAs will implement RFC 8657, ACME-specific CAA parameters. Currently privilege separation on a server or a TLS terminator doesn't do much for ACME privileges because an exploit anywhere on the request path can use an arbitrary account to obtain new certs. Binding to a single ACME account in DNS (accounturi=…) would significantly reduce the attack surface, as would requiring non-http validation methods.
- Tobu 5y ago
  (See here for a status update, kind of) https://community.letsencrypt.org/t/rfc-8657-caa-extension-in-production/154552 https://community.letsencrypt.org/t/rfc-8657-caa-extension-i...
PinguTS 5y ago
The author said, he randomizes between the 4 free-of-charge SSL provides because of availability and reliability. What me would interest, if it would be possible cross-sign the certificates by all of those 4 and automate this?
- F30 5y ago
  You could do that I suppose, but at the end of the day it means you'll end up with 4 different certificate chains. In TLS, typically only one chain gets delivered. Anything else would be bloat and probably not well-supported by clients.
  - tialaramex 5y ago
    And not only are the chains different but the leaf is different each time. TLS 1.3 permits you to write any series of certificates you want that might help your peer to decide this leaf is trustworthy (not just "a chain"), but you can't provide more than one leaf.
    - cmeacham98 5y ago
      Why would the leaf be different? Are CAs supposed to refuse to sign certificates that have been signed by a different CA?
      - tialaramex 5y ago
        In fact it's much more than that, the CA is not supposed to sign any certificate it didn't choose - and it isn't meaningful in X.509 to have more than one signature. You will often see people describing the sequence of events something like "I send them this CSR and then the CA signs it" but that's not really what happens at all. The CA is obliged to construct a to-be-signed-Certificate (tbsCertificate) of their own choosing, incorporating only information they're actually happy to stand behind, and with a largely random serial number at the start. The serial number is because X.509 doesn't have a nonce component, serial numbers are very near the start of the document so it would likely be impossible (using known techniques) to collide a certificate hash (even a known broken one like MD5) so long as this number is very random and chosen by the CA not the subscriber. The constraint on information in the certificate (e.g. Subject information) is because the CA is signing the entire document. Relying Parties have no reason to assume that a certificate for "Johnny Poopy Pants" was actually not issued based on the CA believing this is really "Johnny Poopy Pants" but instead just because it also mentions the DNS name some.cheap-server.example and the subscriber does control some.cheap-server.example. So, any claims of information about the Subject that aren't being warranted by the CA are not included in the certificate. You can send Let's Encrypt a CSR saying your company name, email address, mailing address of the head office, a logo, whatever, it just gets ignored and Let's Encrypt only care about the DNS names you asked for, those are all that will be in the certificate.
jijji 5y ago
I like the use of the shuf command to randomize the list, very nice!
- Scott_Helme_ 5y ago
  Thanks! Sometimes the simple tricks are the best ones :)
throw0101a 5y ago
> I'm using the acme.sh client but the process will be similar no matter which client you choose to use. Always nice to see some variety in clients along side the official Let's Encrypt one. While we do use the official Python-based client at works at times, whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. I'm a bit partial to dehydrated, which is a shell script (works under Bash and Zsh): I find it a lot easier to understand. It's handy to put on Linux/POSIX-based appliances like F5s, where the only prerequisites are Bash, cURL, and OpenSSL (and standard Unix tools like sed, grep, etc): * https://devcentral.f5.com/s/articles/lets-encrypt-on-a-big-ip https://devcentral.f5.com/s/articles/lets-encrypt-on-a-big-i... * https://github.com/EquateTechnologies/dehydrated-bigip-ansible https://github.com/EquateTechnologies/dehydrated-bigip-ansib...
- WesolyKubeczek 5y ago
  > whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. This always makes me chuckle. HN always advise developers to always use existing libraries and to never reinvent the wheel, but feel „disconcerted” as soon as they have to deal with the direct result of such advice.
  - ipaddr 5y ago
    Take advice with a grain of salt is my advice to you. Advice for the average person is not necessarily advice for everyone. The official client stopped supporting older os like centos 6. Using a third party libruary might be important for some. People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. Advice in general is just advice in general..
    - marcosdumay 5y ago
      > People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. I'm going completely off-topic on a tangent, but no modern language even supports the goto from the "Goto Considered Harmful" paper. All you can use nowadays (unless you write assembly) is a much weaker version that has none of the problems you'll find there.
patrakov 5y ago
Do I understand correctly that this event also means that ssl.com is the first CA to offer free ECC certificates to the general public?
- tialaramex 5y ago
  Let's Encrypt will issue you with "ECC certificates" depending on what your idea of an "ECC certificate" is. For a generic Let's Encrypt site if you have Elliptic curve keys, the existing R3 issuing intermediate will cheerfully sign you a certificate. The certificate will be for your EC public key, but signed by the R3 intermediate using RSA. If your reason for wanting EC is that it's less work on your server, this achieves the goal, no RSA signatures from your servers (unless you also need to serve customers that can only do RSA and need a separate setup for that). If you want, you can enroll in a trial programme for Let's Encrypt EC issuing intermediates where E1 will sign your EC keys (if you enroll R3 still signs any RSA keys you ask for). This chains through ISRG Root X2 and then ISRG Root X1 because ISRG Root X2 is not trusted by most (any?) large trust stores today. If you can't have RSA anywhere in the chain then yeah, Let's Encrypt can't do that for you in practice today, although it'd be nice if you explain why you'd want that.
- Scott_Helme_ 5y ago
  Let's Encrypt can issue from an ECC chain, I've tweeted[1] the details on how to enable your account for that. [1] https://twitter.com/Scott_Helme/status/1392101598852222976 https://twitter.com/Scott_Helme/status/1392101598852222976
  - nextgens 5y ago
    What's the shortest chain-size that those free CAs can offer (assuming android>=5.0 devices)? It would be great to have a tool somewhere that matches client handshakes & supported CAs vs server config & choice of CA chains
    - Scott_Helme_ 5y ago
      They're all 3 certificates long (leaf/intermediate/root) apart from Let's Encrypt which, due to their cross-signature, are 4 certificates long for ECC.
lmeyerov 5y ago
Do any free TLS LE alternatives handle AWS/GCP/Azure domains? It's been a frustrating usability blocker on tools like Caddy to have a few of the most popular domains singled out, so been curious..
edwinyzh 5y ago
It' great to have alternatives although I need nothing more than what Let's Encrypt offers. PS, do you think there is a chance for a similar service to be available in the future, but for EXE file signing ;)
TekMol 5y ago
Can this one provide wildcard certificates without having to update DNS entries every three months? That is the one pain point I have with Let's Encrypt. PS: Yes, you can automate the DNS updates. That is the paintpoint I am talking about. It is one more moving part. One more dependency on a third party. One more thing to set up. One more thing that can break. One more thing that will rot (APIs always change at some point in time). Many people seem to solve the "automate DNS" by putting their DNS credentials on the server which serves their website. This is the worst thing from a security perspective. Now someone who breaks into your application can take over your DNS, point your domain to wherever they like and get any certificate for it they like. This probably enables them to also overtake your email and then escalate further from there.
- ratorx 5y ago
  How could you validate wildcards without changing DNS? And the different value every three months thing is definitely a feature not a bug, because otherwise stale values could lead to mis-issuance.
  - TekMol 5y ago
    How could you validate wildcards without changing DNS? The same way you validate ownership of a subdomain: By putting stuff into the well-known path. Only that you do it for the root domain. I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert.
    - nrmitchi 5y ago
      > I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert. Companies very very often point their root domain at a hosting company for their marketing site; let's use Netlify as an example. This does NOT mean that I would expect Netlify to be able to issue wildcard certs for my domain. Basic "www-izer" (redirection) services are another example where the root domain is pointed somewhere that should not be able to issue wildcard certs.
Tepix 5y ago
I'd like to see a free CA for S/MIME certificates once again. Since more than a year or two, all the free S/MIME certificates that you can get these days have issues: - some of them a valid less than one year which is a huge hassle for S/MIME as opposed to HTTPS because you need to keep all your old certificates around - some of them will not let you use your own private key (I wish i was kidding)
- Znafon 5y ago
  I don't know S/MIME, why do you need to keep your old certificates?
  - gloriousternary 5y ago
    From my understanding S/MIME is pretty much enterprise PGP, so if you don't have your old certificates you can't access old emails that were encrypted using them
    - flatiron 5y ago
      i've always reencrypted when getting a new cert. not sure if thats an antipattern though. i just didn't want to be bothered by which cert encrypted what data
    - vbezhenar 5y ago
      Encryption is performed with private key, not with certificate. If you can issue new certificate for the same private key, it should be able to decrypt old stuff. Rotating keys might be a good security practice, though. But not necessary.
15155 5y ago
Comments like these are always amusing after the latest HN "why you don't need Kubernetes" post - setting up cert-manager is a 5 minute affair.
johnnyApplePRNG 5y ago
Looking forward to more competition in the space!
- o_m 5y ago
  Wouldn't the same thing happen if you ignored the bills?
- dariusj18 5y ago
  But credit cards expire too, so no matter what there's no "set it and forget it" process.
- flatiron 5y ago
  paid certificates also expire. every now and then ill hit up my old companies gitlab or jenkins and be amazed they are still running! its been over 3 months and either my automated cert process is working or someone at my old job put on their big person pants and logged into a server and fixed something for once
- q-rews 5y ago
  That’s ironic. You’re complaining that LE couldn’t work after “a few years” yet your solution is to pay for something that definitely requires your intervention yearly. Mind you, the latter still requires you to provide a valid address that you have to check. The internet isn’t set and forget.
- detaro 5y ago
  How does a paid certificate get automatically replaced on your server if you don't read emails or otherwise deal with it?
  - Scott_Helme_ 5y ago
    There is no reason to differentiate between free certificates and paid certificates. The process works in exactly the same way for either.
    - 5y ago
jedisct1 5y ago
Is there any free CA supporting intermediate/sub certificates? This is what I would really be looking for in an alternative to Let's Encrypt.
- vbezhenar 5y ago
  Is there any non-free CA supporting this use-case for reasonable price?
- tialaramex 5y ago
  In practice today a CA would want to actually have physical control over the infrastructure signing for your intermediate, meaning the actual hardware would live in their data centre and they would administrate it, but presumably you'd be paying for it (rackspace in a high availability secure data centre) so that's not going to be free and doesn't offer you any capability you wouldn't have via something like ACME. To give you physical control over the intermediate basically means they're staking their entire reputation on you doing what you promised and never screwing up. You could imagine this working with a constrained intermediate, except I can more or less guarantee that the day after you commit to such a thing you discover a client you care about can't handle the constraint, and so you ask for it to be relaxed, whereupon you are back in the exact same situation. Mozilla requires CAs to tell them about every unconstrained intermediate, so there's actually a complete list you can go look at. It is not large.
  - vbezhenar 5y ago
    What is unconstrained intermediate and what about constrained intermediate (which could only issue certificates for subdomains)? My main use-case in mind is service which provides HTTPS to its clients, but clients should serve content from their own endpoints. Think about home devices. Proper way to do so is to generate private key on device, send public key to somewhere and receive proper certificate for device-0123.example.com. This could be automated with letsencrypt and DNS verification, but there's limit of 50 certificates per week which would require to register plenty of domains and rotate them. Using intermediate certificate would solve that issue.
als0 5y ago
Great to have more choice in the free certificate market
hrez 5y ago
ssl.com "First, register for a free account. Next, you need to get your API credentials" yeah, pass
foresto 5y ago
The screen shot recommends short passwords with one each of upper/lower/numeric/special characters. This policy has never been good. I find it discouraging from a company offering security-related services. https://scotthelme.co.uk/content/images/2021/08/image-3.png https://scotthelme.co.uk/content/images/2021/08/image-3.png
- GuB-42 5y ago
  I see that way too often. At least there isn't a maximum size here. The proper way to do it is to check with a compromised password database, and maybe with common rules like "your user name and password must be different". But I've almost never seen it used, I have used passwords that I know are compromised or even common, it always passed as long as it had the right characters. It shouldn't be that hard. Storage is cheap now, save a few GB for the entire haveibeenpwned database and you know you have a good password. There are even online services that do it securely and, I think, for free. The only real problem, I think, is a UX problem. Having to enter a password and being told repeatedly "haha, nope, try again" with no explicit way to correct it may be more annoying than clear rules but it doesn't strike me as an unsolvable problem.
  - plibither8 5y ago
    > At least there isn't a maximum size here. My bank does this, setting an maximum of 15 characters. It is an incredibly frustrating experience when I have to change my password (which I have to do every 6 months, per their "security" policy): I'm reminded of this ludicrous requirement of < 16 chars because most certainly they store these passwords in plain text. For context: this is the largest private bank in my country serving 50 million+ of customers.
user32556 5y ago
Is there any free CA that supports signing on an IP address? e.g. https://1.1.1.1/ https://1.1.1.1/
- zinekeller 5y ago
  This was discussed deeply at the Mozilla forum for CAs, and the answer is "even if someone wished it, nope", mainly because of dynamic IP address, and even if we removed this type of issuance, the next level is modifying your contact details on the IP block, which is hard because there's isn't a single standard (on modifying, the data format is more-or-less standardised at this point). Google actually wants to do this for their Cloud Platform, and owns the whole chain (i.e. has its own CA, https://pki.goog https://pki.goog) but it's currently hard in the current state of CA/B baseline requirements.
- larrybud 5y ago
  I realize it’s not exactly what you asked, but you could use a service like https://nip.io https://nip.io to map up addresses to hostnames.

652 points by mattowen_uk 5y ago

d33 5y ago

Just curious... has anyone so far decided to extend the 3-month certificate expiration deadline? I understand that for the intended use case it makes sense, but in some cases it's an overkill and having a CA support such use case could be useful. There's nothing in the technology itself that prevents us from having certs that expire in, say, a year, right?

ttty2 5y ago
I really hope this will happen. Sometimes my infra doesn't play well with let's encrypt. I don't think I'm alone. I just want 1 single docker instance, but because of let's encrypt I need to use docker compose, which is annoying. Each 3 months is a lot of work to do it manually. 12 months acceptable.
gsich 5y ago
I think Buypass has (or had) 6 months.
- Koenvh 5y ago
  Correct, Buypass Go has a validity of six months. Unfortunately the free version does not support wildcards yet.
w3ll_w3ll_w3ll 5y ago
Let's encrypt decided for 3 month to force users to automate and avoid the burden of too much user support. They are a no-profit after all. I believe commercial CA are offering free certificates milted to 3 months for the same reasons, and for the up-selling opportunities. I think also cloud providers offer free 1 year TLS certificates, but of course you are also using their other services.
- hexa22 5y ago
  3 months was an excellent choice because it means you _have_ to automate so it will never expire. While the 1 and 2 year certs always end up expiring on production because someone forgot about them.
  - flemhans 5y ago
    Now you just have to upgrade certbot every 1-2 years instead, it feels like.
    - martin-adams 5y ago
      Did that this morning. Was a complete pain but got there in the end.
    - danuker 5y ago
      I have a Debian server, and it has been running unattended pretty much since I installed it. I warmly recommend it. https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades
      - flemhans 5y ago
        Me too, also on Debian. But there have been different installation methods over the time, certbot via deb package, installation script by piping in a URL, certbot-auto, something in /opt, lost track :D
      - hexa22 5y ago
        I had to look at mine once in 5 years because acme v1 shut down.
  - wbond 5y ago
    It also means you have to automate things that are tied to your certificate lifetime. Apple Pay on the web requires you authenticate your server, and it uses your certificate serial num as proof you still own the server. This means every three months you need to re-authenticate with Apple Pay. But there is no Acme client for authenticating with Apple Pay. So instead, I was having to re-authenticate something manually every 3 months. It involved logging into an Apple Developer account, downloading a PEM file, uploading to my server and then clicking a button in the Developer Account to check the file. After doing that dance, I happily paid for 2 year certificates from RapidSSL. Now you can only buy one year certificates. I really hope the CAB isn’t successful in making those non-conforming and requiring shorter certs. There are plenty of other environments where certificate automation is not possible. And honestly, I haven’t seen arguments as to how on-machine automation is more secure than requiring someone be involved in the process. While I’m dreaming about improvements to the CA ecosystem, having some way to actually prove your are the company you claim would be amazing. Instead we are actively removing support for anything that tried to provide that…
deleted 5y ago
[deleted]
matthewmacleod 5y ago
Certificates used to be issued with validity up to 10 years way back. There's no technical bound on the validity period AFAIK, but all major browsers will now refuse to trust certificates with validity periods > 1 year so this can be considered the practical limit. I'm not aware of a dedicated service that offers free 1-year certs in the style of LetsEncrypt, but they'll often be available from e.g. hosting providers as part of a package. Hard to imagine a use-case where 90-day renewals aren't a better option, anyway.
- norenh 5y ago
  The bound is basically set by the CA/Browser Forum [1] where the current baseline requirements [2] are stipulating: "6.3.2 Certificate operational periods and key pair usage periods Subscriber Certificates issued on or after 1 September 2020 SHOULD NOT have a Validity Period greater than 397 days and MUST NOT have a Validity Period greater than 398 days. Subscriber Certificates issued after 1 March 2018, but prior to 1 September 2020, MUST NOT have a Validity Period greater than 825 days. Subscriber Certificates issued after 1 July 2016 but prior to 1 March 2018 MUST NOT have a Validity Period greater than 39 months. For the purpose of calculations, a day is measured as 86,400 seconds. Any amount of time greater than this, including fractional seconds and/or leap seconds, shall represent an additional day. For this reason, Subscriber Certificates SHOULD NOT be issued for the maximum permissible time by default, in order to account for such adjustments." - CA-Browser-Forum BR 1.7.9, p67 [1] https://cabforum.org/ https://cabforum.org/ [2] https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/
- ttty2 5y ago
  One simple use case... For example I have 1 simple docker app to deploy. Now I need to use docker compose with a more complicated workflow.
maltalex 5y ago
It’s a tradeoff between comfort and security since the fact that you control a domain now doesn’t guarantee you’ll be controlling it in 5 minutes, not to mention 3 months. This is why Let’s Encrypt gives you tools to automate the renewal process. I also recall them talking about gradually lowering the certificate lifetime so you’d have no choice but to use automatic renewal. Relevant link: https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html
mtron_ 5y ago
Sectigo provides SSL certificates with 1y validity via their certbot compatible Acme endpoint.
folmar 5y ago
Buypass will get you 6 months.
sigio 5y ago
buypass (also does acme), and uses 180 days expiration on their certs. I've been using it for a while, but they do limit certs to 5 alternate names, instead of the 99 on LE

tommica 5y ago

Nice, thanks for the creator for making this!

boramalper 5y ago

Caddy[0] also uses ZeroSSL[1] alongside Let’s Encrypt. [0] https://caddyserver.com/docs/automatic-https#overview https://caddyserver.com/docs/automatic-https#overview [1] https://zerossl.com/ https://zerossl.com/

sam_goody 5y ago
Caddy and ZeroSSL are the same company, "Stack Holdings GmbH". It used to be prominent on the respective pages, but is now stated in the footer.
- joshxyz 5y ago
  thats a big TIL caddy is actually great! auto ssl
  - boramalper 5y ago
    Same here! I think it was ZeroSSL that bought Caddy now that I remember.
    - francislavoie 5y ago
      The announcement is here: https://caddy.community/t/caddy-and-certmagic-have-new-ownership-no-changes-to-licensing-or-development/9754 https://caddy.community/t/caddy-and-certmagic-have-new-owner...
- tnolet 5y ago
  We use Caddy for serving our free dashboards and status pages on your own domain at https://checklyhq.com https://checklyhq.com It was not super easy to set up. I think the whole config is 20 lines or so, but the docs, naming and functionality of how Caddy actually interfaces with LE was tricky to find out. Basically had to scrape together answers from various GitHub issues etc. I should write a blog post… Edit: now it runs fine btw
  - 5y ago

Tobu 5y ago

More interesting to me will be when one of the ACME CAs will implement RFC 8657, ACME-specific CAA parameters. Currently privilege separation on a server or a TLS terminator doesn't do much for ACME privileges because an exploit anywhere on the request path can use an arbitrary account to obtain new certs. Binding to a single ACME account in DNS (accounturi=…) would significantly reduce the attack surface, as would requiring non-http validation methods.

Tobu 5y ago
(See here for a status update, kind of) https://community.letsencrypt.org/t/rfc-8657-caa-extension-in-production/154552 https://community.letsencrypt.org/t/rfc-8657-caa-extension-i...

PinguTS 5y ago

The author said, he randomizes between the 4 free-of-charge SSL provides because of availability and reliability. What me would interest, if it would be possible cross-sign the certificates by all of those 4 and automate this?

F30 5y ago
You could do that I suppose, but at the end of the day it means you'll end up with 4 different certificate chains. In TLS, typically only one chain gets delivered. Anything else would be bloat and probably not well-supported by clients.
- tialaramex 5y ago
  And not only are the chains different but the leaf is different each time. TLS 1.3 permits you to write any series of certificates you want that might help your peer to decide this leaf is trustworthy (not just "a chain"), but you can't provide more than one leaf.
  - cmeacham98 5y ago
    Why would the leaf be different? Are CAs supposed to refuse to sign certificates that have been signed by a different CA?
    - tialaramex 5y ago
      In fact it's much more than that, the CA is not supposed to sign any certificate it didn't choose - and it isn't meaningful in X.509 to have more than one signature. You will often see people describing the sequence of events something like "I send them this CSR and then the CA signs it" but that's not really what happens at all. The CA is obliged to construct a to-be-signed-Certificate (tbsCertificate) of their own choosing, incorporating only information they're actually happy to stand behind, and with a largely random serial number at the start. The serial number is because X.509 doesn't have a nonce component, serial numbers are very near the start of the document so it would likely be impossible (using known techniques) to collide a certificate hash (even a known broken one like MD5) so long as this number is very random and chosen by the CA not the subscriber. The constraint on information in the certificate (e.g. Subject information) is because the CA is signing the entire document. Relying Parties have no reason to assume that a certificate for "Johnny Poopy Pants" was actually not issued based on the CA believing this is really "Johnny Poopy Pants" but instead just because it also mentions the DNS name some.cheap-server.example and the subscriber does control some.cheap-server.example. So, any claims of information about the Subject that aren't being warranted by the CA are not included in the certificate. You can send Let's Encrypt a CSR saying your company name, email address, mailing address of the head office, a logo, whatever, it just gets ignored and Let's Encrypt only care about the DNS names you asked for, those are all that will be in the certificate.

jijji 5y ago

I like the use of the shuf command to randomize the list, very nice!

Scott_Helme_ 5y ago
Thanks! Sometimes the simple tricks are the best ones :)

throw0101a 5y ago

> I'm using the acme.sh client but the process will be similar no matter which client you choose to use. Always nice to see some variety in clients along side the official Let's Encrypt one. While we do use the official Python-based client at works at times, whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. I'm a bit partial to dehydrated, which is a shell script (works under Bash and Zsh): I find it a lot easier to understand. It's handy to put on Linux/POSIX-based appliances like F5s, where the only prerequisites are Bash, cURL, and OpenSSL (and standard Unix tools like sed, grep, etc): * https://devcentral.f5.com/s/articles/lets-encrypt-on-a-big-ip https://devcentral.f5.com/s/articles/lets-encrypt-on-a-big-i... * https://github.com/EquateTechnologies/dehydrated-bigip-ansible https://github.com/EquateTechnologies/dehydrated-bigip-ansib...

WesolyKubeczek 5y ago
> whenever I install it via apt, and it pulls in a whole bunch of dependencies, it's a bit disconcerting to me. This always makes me chuckle. HN always advise developers to always use existing libraries and to never reinvent the wheel, but feel „disconcerted” as soon as they have to deal with the direct result of such advice.
- ipaddr 5y ago
  Take advice with a grain of salt is my advice to you. Advice for the average person is not necessarily advice for everyone. The official client stopped supporting older os like centos 6. Using a third party libruary might be important for some. People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. Advice in general is just advice in general..
  - marcosdumay 5y ago
    > People heard using 'goto' is forbidden so many will get upset if one is found in a code base. You can use gotos and in some situations it becomes a better tradeoff. I'm going completely off-topic on a tangent, but no modern language even supports the goto from the "Goto Considered Harmful" paper. All you can use nowadays (unless you write assembly) is a much weaker version that has none of the problems you'll find there.

patrakov 5y ago

Do I understand correctly that this event also means that ssl.com is the first CA to offer free ECC certificates to the general public?

tialaramex 5y ago
Let's Encrypt will issue you with "ECC certificates" depending on what your idea of an "ECC certificate" is. For a generic Let's Encrypt site if you have Elliptic curve keys, the existing R3 issuing intermediate will cheerfully sign you a certificate. The certificate will be for your EC public key, but signed by the R3 intermediate using RSA. If your reason for wanting EC is that it's less work on your server, this achieves the goal, no RSA signatures from your servers (unless you also need to serve customers that can only do RSA and need a separate setup for that). If you want, you can enroll in a trial programme for Let's Encrypt EC issuing intermediates where E1 will sign your EC keys (if you enroll R3 still signs any RSA keys you ask for). This chains through ISRG Root X2 and then ISRG Root X1 because ISRG Root X2 is not trusted by most (any?) large trust stores today. If you can't have RSA anywhere in the chain then yeah, Let's Encrypt can't do that for you in practice today, although it'd be nice if you explain why you'd want that.
Scott_Helme_ 5y ago
Let's Encrypt can issue from an ECC chain, I've tweeted[1] the details on how to enable your account for that. [1] https://twitter.com/Scott_Helme/status/1392101598852222976 https://twitter.com/Scott_Helme/status/1392101598852222976
- nextgens 5y ago
  What's the shortest chain-size that those free CAs can offer (assuming android>=5.0 devices)? It would be great to have a tool somewhere that matches client handshakes & supported CAs vs server config & choice of CA chains
  - Scott_Helme_ 5y ago
    They're all 3 certificates long (leaf/intermediate/root) apart from Let's Encrypt which, due to their cross-signature, are 4 certificates long for ECC.

lmeyerov 5y ago

Do any free TLS LE alternatives handle AWS/GCP/Azure domains? It's been a frustrating usability blocker on tools like Caddy to have a few of the most popular domains singled out, so been curious..

edwinyzh 5y ago

It' great to have alternatives although I need nothing more than what Let's Encrypt offers. PS, do you think there is a chance for a similar service to be available in the future, but for EXE file signing ;)

TekMol 5y ago

Can this one provide wildcard certificates without having to update DNS entries every three months? That is the one pain point I have with Let's Encrypt. PS: Yes, you can automate the DNS updates. That is the paintpoint I am talking about. It is one more moving part. One more dependency on a third party. One more thing to set up. One more thing that can break. One more thing that will rot (APIs always change at some point in time). Many people seem to solve the "automate DNS" by putting their DNS credentials on the server which serves their website. This is the worst thing from a security perspective. Now someone who breaks into your application can take over your DNS, point your domain to wherever they like and get any certificate for it they like. This probably enables them to also overtake your email and then escalate further from there.

ratorx 5y ago
How could you validate wildcards without changing DNS? And the different value every three months thing is definitely a feature not a bug, because otherwise stale values could lead to mis-issuance.
- TekMol 5y ago
  How could you validate wildcards without changing DNS? The same way you validate ownership of a subdomain: By putting stuff into the well-known path. Only that you do it for the root domain. I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert.
  - nrmitchi 5y ago
    > I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert. Companies very very often point their root domain at a hosting company for their marketing site; let's use Netlify as an example. This does NOT mean that I would expect Netlify to be able to issue wildcard certs for my domain. Basic "www-izer" (redirection) services are another example where the root domain is pointed somewhere that should not be able to issue wildcard certs.

Tepix 5y ago

I'd like to see a free CA for S/MIME certificates once again. Since more than a year or two, all the free S/MIME certificates that you can get these days have issues: - some of them a valid less than one year which is a huge hassle for S/MIME as opposed to HTTPS because you need to keep all your old certificates around - some of them will not let you use your own private key (I wish i was kidding)

Znafon 5y ago
I don't know S/MIME, why do you need to keep your old certificates?
- gloriousternary 5y ago
  From my understanding S/MIME is pretty much enterprise PGP, so if you don't have your old certificates you can't access old emails that were encrypted using them
  - flatiron 5y ago
    i've always reencrypted when getting a new cert. not sure if thats an antipattern though. i just didn't want to be bothered by which cert encrypted what data
  - vbezhenar 5y ago
    Encryption is performed with private key, not with certificate. If you can issue new certificate for the same private key, it should be able to decrypt old stuff. Rotating keys might be a good security practice, though. But not necessary.

15155 5y ago

Comments like these are always amusing after the latest HN "why you don't need Kubernetes" post - setting up cert-manager is a 5 minute affair.

johnnyApplePRNG 5y ago

Looking forward to more competition in the space!

o_m 5y ago
Wouldn't the same thing happen if you ignored the bills?
dariusj18 5y ago
But credit cards expire too, so no matter what there's no "set it and forget it" process.
flatiron 5y ago
paid certificates also expire. every now and then ill hit up my old companies gitlab or jenkins and be amazed they are still running! its been over 3 months and either my automated cert process is working or someone at my old job put on their big person pants and logged into a server and fixed something for once
q-rews 5y ago
That’s ironic. You’re complaining that LE couldn’t work after “a few years” yet your solution is to pay for something that definitely requires your intervention yearly. Mind you, the latter still requires you to provide a valid address that you have to check. The internet isn’t set and forget.
detaro 5y ago
How does a paid certificate get automatically replaced on your server if you don't read emails or otherwise deal with it?
- Scott_Helme_ 5y ago
  There is no reason to differentiate between free certificates and paid certificates. The process works in exactly the same way for either.
  - 5y ago

jedisct1 5y ago

Is there any free CA supporting intermediate/sub certificates? This is what I would really be looking for in an alternative to Let's Encrypt.

vbezhenar 5y ago
Is there any non-free CA supporting this use-case for reasonable price?
tialaramex 5y ago
In practice today a CA would want to actually have physical control over the infrastructure signing for your intermediate, meaning the actual hardware would live in their data centre and they would administrate it, but presumably you'd be paying for it (rackspace in a high availability secure data centre) so that's not going to be free and doesn't offer you any capability you wouldn't have via something like ACME. To give you physical control over the intermediate basically means they're staking their entire reputation on you doing what you promised and never screwing up. You could imagine this working with a constrained intermediate, except I can more or less guarantee that the day after you commit to such a thing you discover a client you care about can't handle the constraint, and so you ask for it to be relaxed, whereupon you are back in the exact same situation. Mozilla requires CAs to tell them about every unconstrained intermediate, so there's actually a complete list you can go look at. It is not large.
- vbezhenar 5y ago
  What is unconstrained intermediate and what about constrained intermediate (which could only issue certificates for subdomains)? My main use-case in mind is service which provides HTTPS to its clients, but clients should serve content from their own endpoints. Think about home devices. Proper way to do so is to generate private key on device, send public key to somewhere and receive proper certificate for device-0123.example.com. This could be automated with letsencrypt and DNS verification, but there's limit of 50 certificates per week which would require to register plenty of domains and rotate them. Using intermediate certificate would solve that issue.

als0 5y ago

Great to have more choice in the free certificate market

hrez 5y ago

ssl.com "First, register for a free account. Next, you need to get your API credentials" yeah, pass

foresto 5y ago

The screen shot recommends short passwords with one each of upper/lower/numeric/special characters. This policy has never been good. I find it discouraging from a company offering security-related services. https://scotthelme.co.uk/content/images/2021/08/image-3.png https://scotthelme.co.uk/content/images/2021/08/image-3.png

GuB-42 5y ago
I see that way too often. At least there isn't a maximum size here. The proper way to do it is to check with a compromised password database, and maybe with common rules like "your user name and password must be different". But I've almost never seen it used, I have used passwords that I know are compromised or even common, it always passed as long as it had the right characters. It shouldn't be that hard. Storage is cheap now, save a few GB for the entire haveibeenpwned database and you know you have a good password. There are even online services that do it securely and, I think, for free. The only real problem, I think, is a UX problem. Having to enter a password and being told repeatedly "haha, nope, try again" with no explicit way to correct it may be more annoying than clear rules but it doesn't strike me as an unsolvable problem.
- plibither8 5y ago
  > At least there isn't a maximum size here. My bank does this, setting an maximum of 15 characters. It is an incredibly frustrating experience when I have to change my password (which I have to do every 6 months, per their "security" policy): I'm reminded of this ludicrous requirement of < 16 chars because most certainly they store these passwords in plain text. For context: this is the largest private bank in my country serving 50 million+ of customers.

user32556 5y ago

Is there any free CA that supports signing on an IP address? e.g. https://1.1.1.1/ https://1.1.1.1/

zinekeller 5y ago
This was discussed deeply at the Mozilla forum for CAs, and the answer is "even if someone wished it, nope", mainly because of dynamic IP address, and even if we removed this type of issuance, the next level is modifying your contact details on the IP block, which is hard because there's isn't a single standard (on modifying, the data format is more-or-less standardised at this point). Google actually wants to do this for their Cloud Platform, and owns the whole chain (i.e. has its own CA, https://pki.goog https://pki.goog) but it's currently hard in the current state of CA/B baseline requirements.
larrybud 5y ago
I realize it’s not exactly what you asked, but you could use a service like https://nip.io https://nip.io to map up addresses to hostnames.