3 ms·

This is something that without some pain inflicted on host and network operators, the needle will not move. The CA/B Forum could start asking that it's a requir

This is something that without some pain inflicted on host and network operators, the needle will not move. The CA/B Forum could start asking that it's a requirement for CA's to issue a certificate that the validation will try AAAA records first, and warn if they can't validate, then try A. Then later require validation through both AAAA and A records. This will prepare most of the hosts to make sure every page is accessible through both networks. Then require AAAA records only, and not bothering to check A records.

schoen 2y ago
Let's Encrypt does try AAAA records first and then A. That's what leads to the phenomenon that I described where many people end up deciding to delete their AAAA records. :-( I think Let's Encrypt's behavior is correct, and I don't think anyone inside Let's Encrypt or CA/B Forum would like to inflict "pain [...] on host and network operators" beyond the current practice. Let's Encrypt's current behavior could be described as cooperating with IPv6 adoption rather than compelling IPv6 adoption, which seems like a reasonable place for a certificate authority to be. There are cases where Let's Encrypt has made choices that potentially slightly reduce compatibility in order to encourage what it considers technically correct behavior. The first one that comes to mind is https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417 https://community.letsencrypt.org/t/adding-random-entries-to... but I know there are others. On the other hand, all of those decisions can be justified in terms of improving the correctness of PKI software (like not hard-coding things that should not be hard-coded). I can't think of any example that's like "we wish this other technical thing would happen outside of the PKI, so we'll try to force it along", and I don't foresee the broader community getting comfortable with that.
- braiamp 2y ago
  The power that Lets Encrypt has over domain operators is limited. If it becomes a requirement by the CA/B Forum, then every CA would have instructions on how to make sure you have AAAA valid records and it won't be a matter that "LE doesn't work because they fail on this scenario". I'm a behavioral scientist (aka economist), and if you want the public to change behavior you have to motivate such change and here "pain" is defined as what is necessary to effect that change, by increasing the cognitive load. There was a comment below that in the LE forums instead of asking people to fix their AAAA records, they ask them to remove it. That's exactly the behavior you don't want to reward, so you must cause pain.

schoen 2y ago

Let's Encrypt does try AAAA records first and then A. That's what leads to the phenomenon that I described where many people end up deciding to delete their AAAA records. :-( I think Let's Encrypt's behavior is correct, and I don't think anyone inside Let's Encrypt or CA/B Forum would like to inflict "pain [...] on host and network operators" beyond the current practice. Let's Encrypt's current behavior could be described as cooperating with IPv6 adoption rather than compelling IPv6 adoption, which seems like a reasonable place for a certificate authority to be. There are cases where Let's Encrypt has made choices that potentially slightly reduce compatibility in order to encourage what it considers technically correct behavior. The first one that comes to mind is https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417 https://community.letsencrypt.org/t/adding-random-entries-to... but I know there are others. On the other hand, all of those decisions can be justified in terms of improving the correctness of PKI software (like not hard-coding things that should not be hard-coded). I can't think of any example that's like "we wish this other technical thing would happen outside of the PKI, so we'll try to force it along", and I don't foresee the broader community getting comfortable with that.

braiamp 2y ago
The power that Lets Encrypt has over domain operators is limited. If it becomes a requirement by the CA/B Forum, then every CA would have instructions on how to make sure you have AAAA valid records and it won't be a matter that "LE doesn't work because they fail on this scenario". I'm a behavioral scientist (aka economist), and if you want the public to change behavior you have to motivate such change and here "pain" is defined as what is necessary to effect that change, by increasing the cognitive load. There was a comment below that in the LE forums instead of asking people to fix their AAAA records, they ask them to remove it. That's exactly the behavior you don't want to reward, so you must cause pain.