4 ms·

This seems solved if everyone just uses ACME

cpach 4y ago
Yep. Either ACME, or some other reliable method to automate cert issuing. Manual cert deployment is IMHO bad hygiene in this day and age. (Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule.) E.g. on AWS there’s Certificate Manager, which is similar. (But obviously only usable for people on AWS.)
- blueflow 4y ago
  Its not dependend on manual deployment, you can as well automate it wrongly.
  - cpach 4y ago
    Sure. But then you have the chance to fix your automation logic.
- lbriner 4y ago
  > Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule. Maybe in your world but plenty of us work in places that have 1000s of servers, many of them internal, they don't support LE or there are security concerns with opening external firewalls just to support certificate updates so it still has to be done manually. You might be lucky to work somewhere much smaller/newer that doesn't have the problem but please don't make disparaging statements about those of us who have to do this manually.
  - cpach 4y ago
    It’s still possible to automate cert minting. For example, you can have your own internal CA that’s not connected to the Internet.
blueflow 4y ago
If you don't know what you are doing, its easy to misconfigure your webserver to ship the letsencrypt-issued certificates incorrectly.
- francislavoie 4y ago
  Not if you use something like Caddy, where you never touch the cert files yourself.
  - at_a_remove 4y ago
    But then you have to use Caddy instead of a different webserver, and probably either give up features or re-learn how to do things you already had set up.
jackweirdy 4y ago
I don’t think ACME alone fixes it. I had this exact problem with letsencrypt when they did their recent cert switcharoo. Intermediate cert was referred to by name in the cert chain but not served by the server in full. Server was of course referencing the newly signed intermediate cert (called L3 I believe) but the client only had a stale copy/ version of L3 signed by an expired trusted cert. Issue was on an embedded device that couldn’t be fixed so the newly signed intermediate cert needed installation everywhere manually

Yep. Either ACME, or some other reliable method to automate cert issuing. Manual cert deployment is IMHO bad hygiene in this day and age. (Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule.) E.g. on AWS there’s Certificate Manager, which is similar. (But obviously only usable for people on AWS.)

blueflow 4y ago
Its not dependend on manual deployment, you can as well automate it wrongly.
- cpach 4y ago
  Sure. But then you have the chance to fix your automation logic.
lbriner 4y ago
> Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule. Maybe in your world but plenty of us work in places that have 1000s of servers, many of them internal, they don't support LE or there are security concerns with opening external firewalls just to support certificate updates so it still has to be done manually. You might be lucky to work somewhere much smaller/newer that doesn't have the problem but please don't make disparaging statements about those of us who have to do this manually.
- cpach 4y ago
  It’s still possible to automate cert minting. For example, you can have your own internal CA that’s not connected to the Internet.

blueflow 4y ago

If you don't know what you are doing, its easy to misconfigure your webserver to ship the letsencrypt-issued certificates incorrectly.

francislavoie 4y ago
Not if you use something like Caddy, where you never touch the cert files yourself.
- at_a_remove 4y ago
  But then you have to use Caddy instead of a different webserver, and probably either give up features or re-learn how to do things you already had set up.

jackweirdy 4y ago

I don’t think ACME alone fixes it. I had this exact problem with letsencrypt when they did their recent cert switcharoo. Intermediate cert was referred to by name in the cert chain but not served by the server in full. Server was of course referencing the newly signed intermediate cert (called L3 I believe) but the client only had a stale copy/ version of L3 signed by an expired trusted cert. Issue was on an embedded device that couldn’t be fixed so the newly signed intermediate cert needed installation everywhere manually