3 ms·

I don't see how people come to this conclusion. TLS certificates used to cost a lot of money, now they're free. Pretty much all relevant web frameworks and tec

by hannob 5y ago

I don't see how people come to this conclusion. TLS certificates used to cost a lot of money, now they're free. Pretty much all relevant web frameworks and technology stacks are published under FOSS licenses. Nothing stops you from running your own web server with either whatever is the current state of the art web tech or whatever you prefer to build yourself.

saurik 5y ago
Well, the web wasn't as encrypted before. And then when it was, the cost of the certificate wasn't a big deal in comparison to the maintenance effort of constantly rotating certificates, as you'd just buy a certificate that lasted for years and years, which isn't even allowed anymore. SSL with its massive set of "authorities" that are all granted way too broad and yet interchangeable powers with keys that both have to be rotated with pre-determined expiration dates and yet also must be shared with the client is just barely a solution to the original problem :(. But of course, the truth is that the web was never easy: it was just naive. Most (NOT ALL: some categorically only are protecting the interests of advertisers or rights holders) of these security bandaids and limitations are fixing actual problems with the web that were always there... developers just didn't know about them or didn't realize the ramifications. It would be better to have solved some of these things with solutions that are more elegant, and the lack of a definitive guide for "what all you should and should not do" sucks, but mostly the web is just banning stuff that never should have existed in the first place :(.
opk 5y ago
It's not always possible to get certificates from Let's Encrypt for local network only services. In a big corporate environment jumping through the hoops necessary to deploy keys or get things into a DMZ can be near impossible. Even if you don't have those issues it is still one more thing to learn and setup. All these things pile up. Try setting up a basic e-mail server on the modern Internet and compare that to 20 years ago.
- easton 5y ago
  If your company has network admins smart enough to deploy segmentation rules, they are also probably smart enough to setup a internal CA and deploy the certs to everyone’s root store. If not, that stinks. Smallstep makes a basic CA for free that is ACME compliant, meaning you just need to change the URL for Let’s Encrypt on your server and restart. Microsoft also has a CA included with Windows Server if you’re using that which works fine (although it uses a different API to get certs).
- hannob 5y ago
  > In a big corporate environment jumping through the hoops necessary to deploy keys or get things into a DMZ can be near impossible. TBH that sounds like you decided to make things painful and then complain that they are painful.
- throw0101a 5y ago
  > It's not always possible to get certificates from Let's Encrypt for local network only services. In a big corporate environment jumping through the hoops necessary to deploy keys or get things into a DMZ can be near impossible. You're not wrong, but if you can go through the paperwork to add a CNAME to external DNS, your team can use DNS validation to verify host record ownership for LE/ACME: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ Seems not many people know about using dns-01 for internal-only hosts.

by hannob 5y ago

saurik 5y ago

Well, the web wasn't as encrypted before. And then when it was, the cost of the certificate wasn't a big deal in comparison to the maintenance effort of constantly rotating certificates, as you'd just buy a certificate that lasted for years and years, which isn't even allowed anymore. SSL with its massive set of "authorities" that are all granted way too broad and yet interchangeable powers with keys that both have to be rotated with pre-determined expiration dates and yet also must be shared with the client is just barely a solution to the original problem :(. But of course, the truth is that the web was never easy: it was just naive. Most (NOT ALL: some categorically only are protecting the interests of advertisers or rights holders) of these security bandaids and limitations are fixing actual problems with the web that were always there... developers just didn't know about them or didn't realize the ramifications. It would be better to have solved some of these things with solutions that are more elegant, and the lack of a definitive guide for "what all you should and should not do" sucks, but mostly the web is just banning stuff that never should have existed in the first place :(.

opk 5y ago

It's not always possible to get certificates from Let's Encrypt for local network only services. In a big corporate environment jumping through the hoops necessary to deploy keys or get things into a DMZ can be near impossible. Even if you don't have those issues it is still one more thing to learn and setup. All these things pile up. Try setting up a basic e-mail server on the modern Internet and compare that to 20 years ago.

easton 5y ago
If your company has network admins smart enough to deploy segmentation rules, they are also probably smart enough to setup a internal CA and deploy the certs to everyone’s root store. If not, that stinks. Smallstep makes a basic CA for free that is ACME compliant, meaning you just need to change the URL for Let’s Encrypt on your server and restart. Microsoft also has a CA included with Windows Server if you’re using that which works fine (although it uses a different API to get certs).
hannob 5y ago
> In a big corporate environment jumping through the hoops necessary to deploy keys or get things into a DMZ can be near impossible. TBH that sounds like you decided to make things painful and then complain that they are painful.
throw0101a 5y ago
> It's not always possible to get certificates from Let's Encrypt for local network only services. In a big corporate environment jumping through the hoops necessary to deploy keys or get things into a DMZ can be near impossible. You're not wrong, but if you can go through the paperwork to add a CNAME to external DNS, your team can use DNS validation to verify host record ownership for LE/ACME: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ Seems not many people know about using dns-01 for internal-only hosts.