5 ms·

Any time someone asks about certificate validation errors on StackOverflow, half of the answers show how to disable validation rather than fix the issue. The AP

Any time someone asks about certificate validation errors on StackOverflow, half of the answers show how to disable validation rather than fix the issue. The API calls should be explicit, e.g., youWillBeFiredForFacilitatingManInTheMiddleAttacks().

lucb1e 2y ago
Or it should be easier to supply an expected certificate Nearly all the time, the tool doesn't accept the certificate format or it wants a chain instead of just the root because the other side doesn't supply a chain or the CA bundle doesn't match the CA you used or it doesn't use the CA system at all or the fingerprint format is the wrong hash or it wants a file instead of just a command-line fingerprint or there isn't an "at least do TOFU" flag so for testing you resort to "okay then just accept everything"... it's very rarely smooth sailing from the point of "okay I'm ssh'd into the server, now what do I run here to give this tool something it can use to verify the connection" Makes me think of how hard PGP is considered to be. Perhaps key distribution in any asynchronous cryptographic system is simply hard
- shermantanktop 2y ago
  Key distribution and revocation is pretty much the hard problem, at least in pragmatic terms. The details of cryptographic operations in code get a lot of scrutiny, and even then there are issues. But key management combines crypto complexity with distributed system complexity, and mixes that with human propensity for operational error.
- chx 2y ago
  > Makes me think of how hard PGP is considered to be https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- IshKebab 2y ago
  Yeah the fact that on Linux the certificate bundle can be in literally 10 different locations depending on the distro is pretty embarrassing too.
  - lyu07282 2y ago
    10? Ridiculous! We need to develop one universal standard that cover's everyone's usecases.
    - TheSpiceIsLife 2y ago
      Obligatory XKCD link
      - fragmede 2y ago
        927. 9 is 3^2, 27 is 3^3
bluedino 2y ago
A large company I worked at a few years ago had an internal Python channel in Teams for coding support. So many questions were about SSL issues, people would just ask how to disable errors/warnings from not having the correct certificate chain installed. It was insane how many "helpful" people would assist in turning them off instead of simply fixing the problem. I started showing people the correct way to fix the issue and also created documentation to install the internal certificate server on our Ubuntu servers (I think they had it working on some of the RHEL machines). I was a contractor so I received an $80 bonus for my efforts.
- gertop 2y ago
  > instead of simply fixing the problem. Your view is probably skewed because you were the expert but I can assure you that fixing certificate issues is not a simple process for the vast majority of us, especially 15 years ago. See the sibling comment by lucb1e for a description of what the typical experience is like when trying to solve such issue.
- ethbr1 2y ago
  > Python channel in Teams for coding support. So many questions were about SSL issues I learned the other day that Python doesn't support AIA chasing natively. https://bugs.python.org/issue18617 https://bugs.python.org/issue18617 (Certs configured that way are technically incomplete, but because other browsers etc. handle it, it's now a "python breaks for certificates that work for other pieces of software" situation)
  - anttihaapala 2y ago
    The issue was migrated to github so more up-to-date discussion is in https://github.com/python/cpython/issues/62817 https://github.com/python/cpython/issues/62817
    - consp 2y ago
      This discussion is just "do it because some browsers do it" without any reasoning why (or why not) you should do it. Firefox approach is i guess the best compromise between user annoyance and developer annoyance but it's still a compromise against proper TLS.
deleted 2y ago
[deleted]
ahoka 2y ago
The amount of times I have to make this comment on code reviews or undo the madness and just add the certificate to the script/container and enable validation is insane.
yard2010 2y ago
That doesn't always help[0] [0] https://github.com/reactjs/react.dev/issues/3896 https://github.com/reactjs/react.dev/issues/3896
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
concerndc1tizen 2y ago
Just add `--kubelet-insecure-tls` that solves the problem! https://github.com/kubernetes-sigs/metrics-server/issues/196 https://github.com/kubernetes-sigs/metrics-server/issues/196 The number of comments and blogs/guides that recommend this is astonishing. And the lack of a proper solution is frustrating.

lucb1e 2y ago

Or it should be easier to supply an expected certificate Nearly all the time, the tool doesn't accept the certificate format or it wants a chain instead of just the root because the other side doesn't supply a chain or the CA bundle doesn't match the CA you used or it doesn't use the CA system at all or the fingerprint format is the wrong hash or it wants a file instead of just a command-line fingerprint or there isn't an "at least do TOFU" flag so for testing you resort to "okay then just accept everything"... it's very rarely smooth sailing from the point of "okay I'm ssh'd into the server, now what do I run here to give this tool something it can use to verify the connection" Makes me think of how hard PGP is considered to be. Perhaps key distribution in any asynchronous cryptographic system is simply hard

shermantanktop 2y ago
Key distribution and revocation is pretty much the hard problem, at least in pragmatic terms. The details of cryptographic operations in code get a lot of scrutiny, and even then there are issues. But key management combines crypto complexity with distributed system complexity, and mixes that with human propensity for operational error.
chx 2y ago
> Makes me think of how hard PGP is considered to be https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
IshKebab 2y ago
Yeah the fact that on Linux the certificate bundle can be in literally 10 different locations depending on the distro is pretty embarrassing too.
- lyu07282 2y ago
  10? Ridiculous! We need to develop one universal standard that cover's everyone's usecases.
  - TheSpiceIsLife 2y ago
    Obligatory XKCD link
    - fragmede 2y ago
      927. 9 is 3^2, 27 is 3^3

bluedino 2y ago

A large company I worked at a few years ago had an internal Python channel in Teams for coding support. So many questions were about SSL issues, people would just ask how to disable errors/warnings from not having the correct certificate chain installed. It was insane how many "helpful" people would assist in turning them off instead of simply fixing the problem. I started showing people the correct way to fix the issue and also created documentation to install the internal certificate server on our Ubuntu servers (I think they had it working on some of the RHEL machines). I was a contractor so I received an $80 bonus for my efforts.

gertop 2y ago
> instead of simply fixing the problem. Your view is probably skewed because you were the expert but I can assure you that fixing certificate issues is not a simple process for the vast majority of us, especially 15 years ago. See the sibling comment by lucb1e for a description of what the typical experience is like when trying to solve such issue.
ethbr1 2y ago
> Python channel in Teams for coding support. So many questions were about SSL issues I learned the other day that Python doesn't support AIA chasing natively. https://bugs.python.org/issue18617 https://bugs.python.org/issue18617 (Certs configured that way are technically incomplete, but because other browsers etc. handle it, it's now a "python breaks for certificates that work for other pieces of software" situation)
- anttihaapala 2y ago
  The issue was migrated to github so more up-to-date discussion is in https://github.com/python/cpython/issues/62817 https://github.com/python/cpython/issues/62817
  - consp 2y ago
    This discussion is just "do it because some browsers do it" without any reasoning why (or why not) you should do it. Firefox approach is i guess the best compromise between user annoyance and developer annoyance but it's still a compromise against proper TLS.

deleted 2y ago

[deleted]

ahoka 2y ago

The amount of times I have to make this comment on code reviews or undo the madness and just add the certificate to the script/container and enable validation is insane.

yard2010 2y ago

That doesn't always help[0] [0] https://github.com/reactjs/react.dev/issues/3896 https://github.com/reactjs/react.dev/issues/3896

deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

concerndc1tizen 2y ago

Just add `--kubelet-insecure-tls` that solves the problem! https://github.com/kubernetes-sigs/metrics-server/issues/196 https://github.com/kubernetes-sigs/metrics-server/issues/196 The number of comments and blogs/guides that recommend this is astonishing. And the lack of a proper solution is frustrating.