3 ms·

FWIW, if those websites used Caddy as their ACME client, then it would have detected the certificate being revoked as soon as possible via OCSP stapling and wou

FWIW, if those websites used Caddy as their ACME client, then it would have detected the certificate being revoked as soon as possible via OCSP stapling and would have had the certificate renewed. It's a shame that other ACME clients aren't as robust to problems like this. (Disclaimer: I work on Caddy as a volunteer)

agwa 3y ago
Note that the certificates were not revoked until 2023-06-19 at 18:00. In contrast, ARI was updated on 2023-06-15 at 22:43 to tell ARI-supporting clients (such as lego) to renew immediately. That means Caddy served broken certificates for almost 4 days longer than necessary. Are there plans for Caddy to support ARI?
- francislavoie 3y ago
  > Note that the certificates were not revoked until 2023-06-19 at 18:00. Ah okay, I missed that. > Are there plans for Caddy to support ARI? It's... complicated. Matt argues that ARI does not make sense for a variety of reasons. You can find the complex and deep discussions about it on the LE forums. Do a Ctrl+F for ARI in https://community.letsencrypt.org/c/client-dev/14 https://community.letsencrypt.org/c/client-dev/14 to find them, there's a lot.
- mholt 3y ago
  > That means Caddy served broken certificates for almost 4 days longer than necessary. This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. > Are there plans for Caddy to support ARI? If ARI can be made into an effective mechanism, then yes. ACMEz already supports the current draft. I know Francis linked to a forum category, here's some more specific links for background: - https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600 https://community.letsencrypt.org/t/can-ari-conforming-clien... - https://community.letsencrypt.org/t/thoughts-from-starting-to-play-with-ari/200276 https://community.letsencrypt.org/t/thoughts-from-starting-t...
  - agwa 3y ago
    >This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. That's news to you? I informed you last week that Caddy would serve broken certificates in this situation: https://news.ycombinator.com/item?id=36344549 https://news.ycombinator.com/item?id=36344549 I omitted "would" from my previous comment, but I think it's pretty clear from Francis' comment that we're discussing a hypothetical situation, and neither of us know if any of the 645 affected certificates were requested by Caddy or not. I skimmed the forum links (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI.
    - mholt 3y ago
      You said: > Caddy served broken certificates So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. > (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) I did this once and it was like talking into a black hole. All the responses I got to the issue I brought up were laced with complacency. > I skimmed the forum links and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. Because OCSP does what it's intended to do. ARI does not. > FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI. I am tracking that proposal and get daily notifications. It is only for short-lived certs. I would be thrilled if we could replace revocation -- and OCSP -- with short-lived certs.
      - agwa 3y ago
        > So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. This is not engaging in good faith. > I am tracking that proposal and get daily notifications. It is only for short-lived certs. It would make OCSP optional for all certificates. CRLs would be optional only for short-lived certs.

agwa 3y ago

Note that the certificates were not revoked until 2023-06-19 at 18:00. In contrast, ARI was updated on 2023-06-15 at 22:43 to tell ARI-supporting clients (such as lego) to renew immediately. That means Caddy served broken certificates for almost 4 days longer than necessary. Are there plans for Caddy to support ARI?

francislavoie 3y ago
> Note that the certificates were not revoked until 2023-06-19 at 18:00. Ah okay, I missed that. > Are there plans for Caddy to support ARI? It's... complicated. Matt argues that ARI does not make sense for a variety of reasons. You can find the complex and deep discussions about it on the LE forums. Do a Ctrl+F for ARI in https://community.letsencrypt.org/c/client-dev/14 https://community.letsencrypt.org/c/client-dev/14 to find them, there's a lot.
mholt 3y ago
> That means Caddy served broken certificates for almost 4 days longer than necessary. This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. > Are there plans for Caddy to support ARI? If ARI can be made into an effective mechanism, then yes. ACMEz already supports the current draft. I know Francis linked to a forum category, here's some more specific links for background: - https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600 https://community.letsencrypt.org/t/can-ari-conforming-clien... - https://community.letsencrypt.org/t/thoughts-from-starting-to-play-with-ari/200276 https://community.letsencrypt.org/t/thoughts-from-starting-t...
- agwa 3y ago
  >This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. That's news to you? I informed you last week that Caddy would serve broken certificates in this situation: https://news.ycombinator.com/item?id=36344549 https://news.ycombinator.com/item?id=36344549 I omitted "would" from my previous comment, but I think it's pretty clear from Francis' comment that we're discussing a hypothetical situation, and neither of us know if any of the 645 affected certificates were requested by Caddy or not. I skimmed the forum links (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI.
  - mholt 3y ago
    You said: > Caddy served broken certificates So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. > (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) I did this once and it was like talking into a black hole. All the responses I got to the issue I brought up were laced with complacency. > I skimmed the forum links and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. Because OCSP does what it's intended to do. ARI does not. > FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI. I am tracking that proposal and get daily notifications. It is only for short-lived certs. I would be thrilled if we could replace revocation -- and OCSP -- with short-lived certs.
    - agwa 3y ago
      > So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. This is not engaging in good faith. > I am tracking that proposal and get daily notifications. It is only for short-lived certs. It would make OCSP optional for all certificates. CRLs would be optional only for short-lived certs.