5 ms·

Certainly: Fastly’s Own TLS Certification Authority

mdaniel 4y ago
Good for them for using ACME, but this appears to be some kind of add-on to Fastly, and not "here's my money, one signed cert, please" like I would expect from a general purpose CA
- tptacek 4y ago
  It seems weird at this point to expect any new CA to ask for money.
  - mdaniel 4y ago
    Yeah, I did actually consider replying "but, why?" but that seemed in poor form on someone's announcement. So I thought the middle ground was to bring to attention that there wasn't a call-to-action and it doesn't appear in the Products drop-down as something one could get for themselves without already having a Fastly account I do actually have some sympathy for the monetary cost of the infrastructure surrounding the "pay to do math" model, but you're 100% correct that for a CDN company, that cost must surely be damn near invisible among the rest of their cost of doing business
LeonM 4y ago
I like this. We need to reduce our reliance on Let's Encrypt, so another CA which supports ACME is definitely welcome to me. The GoDaddy cross signature should make Certainly be accepted by just about any client. Also, I really like the name :)
- deleted 4y ago
  [deleted]
- metadaemon 4y ago
  What's the reasoning for reducing reliance on Let's Encrypt?
  - nixgeek 4y ago
    If we had more independent issuers offering free signing via ACME that would be good for the internet. Let’s Encrypt isn’t exactly a SPOF (single point of failure) but also it isn’t like there are 13 equivalents.
  - dijit 4y ago
    To make TLS signing a commodity instead of just a charity.
- Arnavion 4y ago
  There are already a few actually. https://acmeclients.com/certificate-authorities/ https://acmeclients.com/certificate-authorities/
- simcop2387 4y ago
  ZeroSSL is at least one other provider I know of that supports ACME for this: https://zerossl.com/features/acme/ https://zerossl.com/features/acme/
jefftk 4y ago
Accepted into the root stores for Mozilla, Apple, and Google, but what about Microsoft? (Or maybe Microsoft's doesn't matter anymore with Chrome using their own store since 105, Edge being a Chrome variant, and Firefox always having used their own?) Though the intermediate cert is cross-signed by GoDaddy, so this isn't a problem right now.
- basch 4y ago
  The GoDaddy part also makes this next part marketing speak that technically isn’t true. > are fully supported by Fastly without any dependence on another organization.
  - jesboat 4y ago
    I think their statement is accurate. If they've been accepted into root programs (and it sounds like they have), then the GoDaddy cross-sign is only relevant for older browsers, and even then requires no additional or ongoing actions from GD to keep working.
    - basch 4y ago
      Is it not dependent on GD keeping upstanding status? If, lets say, they were hacked, and had their status revoked, then the Certainly certs would stop working in some places. That sounds like dependency to me.
      - jesboat 4y ago
        In the normal course of events, no. If a CA demonstrates itself to be particularly untrustworthy, the actions most root programs might take (adding restrictions, or removing it from the root store entirely) still rely on those changes getting distributed to users, and if users pick up that update to the root store, they probably picked up the update which added Certainly too. There are conceivable scenarios where GD doing something (or not doing something) could result in Certainly search no longer validating on some subset of older browsers/clients, but they're quite obscure and unlikely. If you include those scenarios as Certainly having a dependency on GoDaddy, I feel like you would also have to say that Certainly depends on their domain name registrar to not give away their domain out from under them.
dilyevsky 4y ago
This is great! Any word on acme limits and quotas?
nickvanw 4y ago
This appears to throw a 404 for me.
nixgeek 4y ago
It looks like Fastly started working on Certainly sometime before March 2019, because that’s when they filed a trademark application. [1] Three years seems like a long time to be working on a CA! [1] https://uspto.report/TM/88345271 https://uspto.report/TM/88345271
- tialaramex 4y ago
  That sounds about right to be honest. The part of the process which is essential to be useful is to obtain trust from the Browser vendors/ OS vendors in their role representing the Relying Parties (ie in this case, ordinary users like you or me). And in practice although you need all of the big ones to be OK with it, the one that matters is Mozilla, via m.d.s.policy, a public group overseeing this well, policy for Mozilla both directly as the vendor of Firefox, and as de facto trust store for Free Unix systems. Now, m.d.s.policy wants to see a whole bunch of paperwork, including audits, beginning from when you began setting stuff up, your own policy documents etc. and it sometimes wants these fixed so you need to go around the loop again. During this you need a complete, working, system, with the only differences from your final public system being maybe scale and the fact you aren't actually directly trusted. But in practice you will have trust via a cross signature (in this case GoDaddy) so you are trusted, just indirectly - if you screw up that's for real and that's going to be a big deal. Example: m.d.s.policy wants to see what a working secured web site will be like, so you spin up a site which exists only to show that yup, we can issue a correct leaf cert for the site, with a valid expiry date, path leading back to GoDaddy, if testers tell their test system that it trusts $newCA, then it says it's valid from you not GoDaddy, check. Another example: m.d.s.policy wants to see that expiry works properly, so you spin up a site with a two month old certificate but only a month of validity. Except wait, if you're like Let's Encrypt/ ISRG you intentionally don't have manual issuance so you literally need to use your normal automated issuance process and then wait until the certificate expires to show that this works. Let's Encrypt really did this. Twice I think.
themgt 4y ago
[Off-topic] but they've got absolutely bizarre webserver/blog behavior. I noticed "page not found" flash briefly on my screen before the content loaded, and indeed you can confirm with curl or network inspector it's actually returning http 404 status code/"page not found" content and then some bunch-o-JS injects the blog post. The Aristocrats!
- Jamie9912 4y ago
  404 for me also. Australia
- jacooper 4y ago
  Yup 404 for me too
- yjftsjthsd-h 4y ago
  Curiously, it stays as a 404 for me. Edit: Tried opening in a private browsing window (read: more privacy options but no ublock origin) and it still fails.
  - Helmut10001 4y ago
    Failing for me too on both Chrome and Firefox.
- justinsaccount 4y ago
  I saw this on our site that used next.js once. Looks like they use Gatsby which I guess is similar. Cache headers weren't being set properly, new pages would or wouldn't load depending how you reached the page (direct link vs. javascript loading the content via an internal cache or via a fragment fetch)
alex-ant 4y ago
404
jacooper 4y ago
404, this seems to have been released by accident.
birdman3131 4y ago
Link is dead.
jossclimb 4y ago
404 not found
IncRnd 4y ago
This cached copy works for me: https://archive.is/20230221154358/https://www.fastly.com/blog/announcing-certainly-fastlys-own-tls-certification-authority https://archive.is/20230221154358/https://www.fastly.com/blo... The original page is a 404 for me.
- lucakiebel 4y ago
  For me it just says that there isn’t a german version yet, but doesn’t let me read the article in English…
  - IncRnd 4y ago
    That's odd. Archive.org also has a cached copy that might work better. https://web.archive.org/web/20230221151451/https://www.fastly.com/blog/announcing-certainly-fastlys-own-tls-certification-authority https://web.archive.org/web/20230221151451/https://www.fastl...
senthilnayagam 4y ago
certainly 404 don't downvote me maybe it was taken down, there is another post which made couple of minutes back "Protecting your web apps has never been easier: Introducing the Fastly Managed Security Service" https://www.fastly.com/blog/protecting-your-web-apps-has-never-been-easier-introducing-the-fastly https://www.fastly.com/blog/protecting-your-web-apps-has-nev...
haubry 4y ago
Hey! I'm on Fastly's DevX team. Sorry for the 404, we had to make some corrections so we took it down to republish it. But we're super thrilled to see the enthusiasm here and I'm passing along the feedback you shared too! Thanks everyone
- haubry 4y ago
  Blog is live again as of a few hours ago! :)

Good for them for using ACME, but this appears to be some kind of add-on to Fastly, and not "here's my money, one signed cert, please" like I would expect from a general purpose CA

tptacek 4y ago
It seems weird at this point to expect any new CA to ask for money.
- mdaniel 4y ago
  Yeah, I did actually consider replying "but, why?" but that seemed in poor form on someone's announcement. So I thought the middle ground was to bring to attention that there wasn't a call-to-action and it doesn't appear in the Products drop-down as something one could get for themselves without already having a Fastly account I do actually have some sympathy for the monetary cost of the infrastructure surrounding the "pay to do math" model, but you're 100% correct that for a CDN company, that cost must surely be damn near invisible among the rest of their cost of doing business

LeonM 4y ago

I like this. We need to reduce our reliance on Let's Encrypt, so another CA which supports ACME is definitely welcome to me. The GoDaddy cross signature should make Certainly be accepted by just about any client. Also, I really like the name :)

deleted 4y ago
[deleted]
metadaemon 4y ago
What's the reasoning for reducing reliance on Let's Encrypt?
- nixgeek 4y ago
  If we had more independent issuers offering free signing via ACME that would be good for the internet. Let’s Encrypt isn’t exactly a SPOF (single point of failure) but also it isn’t like there are 13 equivalents.
- dijit 4y ago
  To make TLS signing a commodity instead of just a charity.
Arnavion 4y ago
There are already a few actually. https://acmeclients.com/certificate-authorities/ https://acmeclients.com/certificate-authorities/
simcop2387 4y ago
ZeroSSL is at least one other provider I know of that supports ACME for this: https://zerossl.com/features/acme/ https://zerossl.com/features/acme/

jefftk 4y ago

Accepted into the root stores for Mozilla, Apple, and Google, but what about Microsoft? (Or maybe Microsoft's doesn't matter anymore with Chrome using their own store since 105, Edge being a Chrome variant, and Firefox always having used their own?) Though the intermediate cert is cross-signed by GoDaddy, so this isn't a problem right now.

basch 4y ago
The GoDaddy part also makes this next part marketing speak that technically isn’t true. > are fully supported by Fastly without any dependence on another organization.
- jesboat 4y ago
  I think their statement is accurate. If they've been accepted into root programs (and it sounds like they have), then the GoDaddy cross-sign is only relevant for older browsers, and even then requires no additional or ongoing actions from GD to keep working.
  - basch 4y ago
    Is it not dependent on GD keeping upstanding status? If, lets say, they were hacked, and had their status revoked, then the Certainly certs would stop working in some places. That sounds like dependency to me.
    - jesboat 4y ago
      In the normal course of events, no. If a CA demonstrates itself to be particularly untrustworthy, the actions most root programs might take (adding restrictions, or removing it from the root store entirely) still rely on those changes getting distributed to users, and if users pick up that update to the root store, they probably picked up the update which added Certainly too. There are conceivable scenarios where GD doing something (or not doing something) could result in Certainly search no longer validating on some subset of older browsers/clients, but they're quite obscure and unlikely. If you include those scenarios as Certainly having a dependency on GoDaddy, I feel like you would also have to say that Certainly depends on their domain name registrar to not give away their domain out from under them.

dilyevsky 4y ago

This is great! Any word on acme limits and quotas?

nickvanw 4y ago

This appears to throw a 404 for me.

nixgeek 4y ago

It looks like Fastly started working on Certainly sometime before March 2019, because that’s when they filed a trademark application. [1] Three years seems like a long time to be working on a CA! [1] https://uspto.report/TM/88345271 https://uspto.report/TM/88345271

tialaramex 4y ago
That sounds about right to be honest. The part of the process which is essential to be useful is to obtain trust from the Browser vendors/ OS vendors in their role representing the Relying Parties (ie in this case, ordinary users like you or me). And in practice although you need all of the big ones to be OK with it, the one that matters is Mozilla, via m.d.s.policy, a public group overseeing this well, policy for Mozilla both directly as the vendor of Firefox, and as de facto trust store for Free Unix systems. Now, m.d.s.policy wants to see a whole bunch of paperwork, including audits, beginning from when you began setting stuff up, your own policy documents etc. and it sometimes wants these fixed so you need to go around the loop again. During this you need a complete, working, system, with the only differences from your final public system being maybe scale and the fact you aren't actually directly trusted. But in practice you will have trust via a cross signature (in this case GoDaddy) so you are trusted, just indirectly - if you screw up that's for real and that's going to be a big deal. Example: m.d.s.policy wants to see what a working secured web site will be like, so you spin up a site which exists only to show that yup, we can issue a correct leaf cert for the site, with a valid expiry date, path leading back to GoDaddy, if testers tell their test system that it trusts $newCA, then it says it's valid from you not GoDaddy, check. Another example: m.d.s.policy wants to see that expiry works properly, so you spin up a site with a two month old certificate but only a month of validity. Except wait, if you're like Let's Encrypt/ ISRG you intentionally don't have manual issuance so you literally need to use your normal automated issuance process and then wait until the certificate expires to show that this works. Let's Encrypt really did this. Twice I think.

themgt 4y ago

[Off-topic] but they've got absolutely bizarre webserver/blog behavior. I noticed "page not found" flash briefly on my screen before the content loaded, and indeed you can confirm with curl or network inspector it's actually returning http 404 status code/"page not found" content and then some bunch-o-JS injects the blog post. The Aristocrats!

Jamie9912 4y ago
404 for me also. Australia
jacooper 4y ago
Yup 404 for me too
yjftsjthsd-h 4y ago
Curiously, it stays as a 404 for me. Edit: Tried opening in a private browsing window (read: more privacy options but no ublock origin) and it still fails.
- Helmut10001 4y ago
  Failing for me too on both Chrome and Firefox.
justinsaccount 4y ago
I saw this on our site that used next.js once. Looks like they use Gatsby which I guess is similar. Cache headers weren't being set properly, new pages would or wouldn't load depending how you reached the page (direct link vs. javascript loading the content via an internal cache or via a fragment fetch)

alex-ant 4y ago

404

jacooper 4y ago

404, this seems to have been released by accident.

birdman3131 4y ago

Link is dead.

jossclimb 4y ago

404 not found

IncRnd 4y ago

This cached copy works for me: https://archive.is/20230221154358/https://www.fastly.com/blog/announcing-certainly-fastlys-own-tls-certification-authority https://archive.is/20230221154358/https://www.fastly.com/blo... The original page is a 404 for me.

lucakiebel 4y ago
For me it just says that there isn’t a german version yet, but doesn’t let me read the article in English…
- IncRnd 4y ago
  That's odd. Archive.org also has a cached copy that might work better. https://web.archive.org/web/20230221151451/https://www.fastly.com/blog/announcing-certainly-fastlys-own-tls-certification-authority https://web.archive.org/web/20230221151451/https://www.fastl...

senthilnayagam 4y ago

certainly 404 don't downvote me maybe it was taken down, there is another post which made couple of minutes back "Protecting your web apps has never been easier: Introducing the Fastly Managed Security Service" https://www.fastly.com/blog/protecting-your-web-apps-has-never-been-easier-introducing-the-fastly https://www.fastly.com/blog/protecting-your-web-apps-has-nev...

haubry 4y ago

Hey! I'm on Fastly's DevX team. Sorry for the 404, we had to make some corrections so we took it down to republish it. But we're super thrilled to see the enthusiasm here and I'm passing along the feedback you shared too! Thanks everyone

haubry 4y ago
Blog is live again as of a few hours ago! :)