4 ms·

Note that the certificates were not revoked until 2023-06-19 at 18:00. In contrast, ARI was updated on 2023-06-15 at 22:43 to tell ARI-supporting clients (such

by agwa 3y ago

Note that the certificates were not revoked until 2023-06-19 at 18:00. In contrast, ARI was updated on 2023-06-15 at 22:43 to tell ARI-supporting clients (such as lego) to renew immediately. That means Caddy served broken certificates for almost 4 days longer than necessary. Are there plans for Caddy to support ARI?

francislavoie 3y ago
> Note that the certificates were not revoked until 2023-06-19 at 18:00. Ah okay, I missed that. > Are there plans for Caddy to support ARI? It's... complicated. Matt argues that ARI does not make sense for a variety of reasons. You can find the complex and deep discussions about it on the LE forums. Do a Ctrl+F for ARI in https://community.letsencrypt.org/c/client-dev/14 https://community.letsencrypt.org/c/client-dev/14 to find them, there's a lot.
mholt 3y ago
> That means Caddy served broken certificates for almost 4 days longer than necessary. This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. > Are there plans for Caddy to support ARI? If ARI can be made into an effective mechanism, then yes. ACMEz already supports the current draft. I know Francis linked to a forum category, here's some more specific links for background: - https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600 https://community.letsencrypt.org/t/can-ari-conforming-clien... - https://community.letsencrypt.org/t/thoughts-from-starting-to-play-with-ari/200276 https://community.letsencrypt.org/t/thoughts-from-starting-t...
- agwa 3y ago
  >This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. That's news to you? I informed you last week that Caddy would serve broken certificates in this situation: https://news.ycombinator.com/item?id=36344549 https://news.ycombinator.com/item?id=36344549 I omitted "would" from my previous comment, but I think it's pretty clear from Francis' comment that we're discussing a hypothetical situation, and neither of us know if any of the 645 affected certificates were requested by Caddy or not. I skimmed the forum links (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI.
  - mholt 3y ago
    You said: > Caddy served broken certificates So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. > (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) I did this once and it was like talking into a black hole. All the responses I got to the issue I brought up were laced with complacency. > I skimmed the forum links and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. Because OCSP does what it's intended to do. ARI does not. > FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI. I am tracking that proposal and get daily notifications. It is only for short-lived certs. I would be thrilled if we could replace revocation -- and OCSP -- with short-lived certs.
    - agwa 3y ago
      > So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. This is not engaging in good faith. > I am tracking that proposal and get daily notifications. It is only for short-lived certs. It would make OCSP optional for all certificates. CRLs would be optional only for short-lived certs.
      - mholt 3y ago
        > This is not engaging in good faith. Sorry, come again? Why so combative?
        TheDong 3y ago
        Your response there comes off poorly to me too. When I read the thread in context, it's clear that the response is within the hypothetical raised in the very first comment "if those websites used Caddy", that hypothetical. The response has the understood "No, even in that hypothetical, this is the case", and doesn't explicitly say it's in the hypothetical, but in context it clearly is. Your first response to that, missing the context and asking for "more info", well, miscommunications happen, that's fine. What seems obviously not in good faith is that the parent commenter clearly then explains themselves with "we're discussing a hypothetical situation", and you ignored that, and responded as if they hadn't explained it.

by agwa 3y ago

francislavoie 3y ago

> Note that the certificates were not revoked until 2023-06-19 at 18:00. Ah okay, I missed that. > Are there plans for Caddy to support ARI? It's... complicated. Matt argues that ARI does not make sense for a variety of reasons. You can find the complex and deep discussions about it on the LE forums. Do a Ctrl+F for ARI in https://community.letsencrypt.org/c/client-dev/14 https://community.letsencrypt.org/c/client-dev/14 to find them, there's a lot.

mholt 3y ago

> That means Caddy served broken certificates for almost 4 days longer than necessary. This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. > Are there plans for Caddy to support ARI? If ARI can be made into an effective mechanism, then yes. ACMEz already supports the current draft. I know Francis linked to a forum category, here's some more specific links for background: - https://community.letsencrypt.org/t/can-ari-conforming-clients-be-granted-exemptions-to-relevant-rate-limits/195600 https://community.letsencrypt.org/t/can-ari-conforming-clien... - https://community.letsencrypt.org/t/thoughts-from-starting-to-play-with-ari/200276 https://community.letsencrypt.org/t/thoughts-from-starting-t...

agwa 3y ago
>This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. That's news to you? I informed you last week that Caddy would serve broken certificates in this situation: https://news.ycombinator.com/item?id=36344549 https://news.ycombinator.com/item?id=36344549 I omitted "would" from my previous comment, but I think it's pretty clear from Francis' comment that we're discussing a hypothetical situation, and neither of us know if any of the 645 affected certificates were requested by Caddy or not. I skimmed the forum links (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI.
- mholt 3y ago
  You said: > Caddy served broken certificates So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. > (it would be productive if you could send a email summarizing your thoughts to the IETF ACME WG) I did this once and it was like talking into a black hole. All the responses I got to the issue I brought up were laced with complacency. > I skimmed the forum links and it seems like your complaints could also be said of OCSP so it's hard to figure out why OCSP is OK for Caddy but ARI isn't. Because OCSP does what it's intended to do. ARI does not. > FWIW, there's currently a ballot in the CABF which would make OCSP optional for CAs, so OCSP may be on the way out in the WebPKI. I am tracking that proposal and get daily notifications. It is only for short-lived certs. I would be thrilled if we could replace revocation -- and OCSP -- with short-lived certs.
  - agwa 3y ago
    > So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my energy. This is not engaging in good faith. > I am tracking that proposal and get daily notifications. It is only for short-lived certs. It would make OCSP optional for all certificates. CRLs would be optional only for short-lived certs.
    - mholt 3y ago
      > This is not engaging in good faith. Sorry, come again? Why so combative?
      - TheDong 3y ago
        Your response there comes off poorly to me too. When I read the thread in context, it's clear that the response is within the hypothetical raised in the very first comment "if those websites used Caddy", that hypothetical. The response has the understood "No, even in that hypothetical, this is the case", and doesn't explicitly say it's in the hypothetical, but in context it clearly is. Your first response to that, missing the context and asking for "more info", well, miscommunications happen, that's fine. What seems obviously not in good faith is that the parent commenter clearly then explains themselves with "we're discussing a hypothetical situation", and you ignored that, and responded as if they hadn't explained it.