7 ms·
There's still enough people out there who don't know better, manually (or auto-renew) purchasing new a certificate every year from their hosting provider like i
by dachris 2y ago
There's still enough people out there who don't know better, manually (or auto-renew) purchasing new a certificate every year from their hosting provider like it's 2013.
- yread 2y agoUnfortunately, the code signing certificates work pretty much the same way
- mrtksn 2y agoAFAIK there's things like Extended Validation Certificate Verification that used to make the browser address bar look more trustworthy by making it green but I don't know if its still a thing. At least in Safari, I don't see a green padlock anywhere.
- sureIy 2y agoYeah that also stopped being a thing. I'm really happy how Chrome and then other browsers gradually shifted the blame to insecure websites rather than highlighting "secure" ones. You'll still find people online clamoring EV certificates are worth anything more than $0 but you can ignore them just as well.
- Systemmanic 2y agoChrome and Firefox removed the extra UI stuff for EV certs in 2019: https://groups.google.com/a/chromium.org/g/security-dev/c/h1bTcoTpfeI https://groups.google.com/a/chromium.org/g/security-dev/c/h1... https://groups.google.com/g/firefox-dev/c/6wAg_PpnlY4 https://groups.google.com/g/firefox-dev/c/6wAg_PpnlY4
- mrweasel 2y agoI remember our boss really wanted that green bar, so we got an extend validation certificate. What we had failed to realise is that they would only be issued to the actual legal name of your company, but not any other names you may be operating under. We had a B2C webshop, where we wanted the ev-cert, but because the B2C side of the business wasn't it's own legal entity, the cert we go issued was for our B2B name, which none of our customer customers knew and it looked like a scam. The only good thing dealing with certificate resellers at the time was that they where really flexible in a lot of ways. We got our EV cert refunded, or "store credit" and used the money to buy normal certificates.
- bux93 2y agoChrome 77 removed the prominent green EV badge. "A series of academic research in the 2000s studied the EV UI in lab and survey settings, and found that the EV UI was not protecting against phishing attacks as intended. The Chrome Security UX team recently published a study that updated these findings with a large-scale field experiment, as well as a series of survey experiments." [1] Extended Validation can still play a role in a corporate's IT control framework; the extended validation is essentially a check-of-paperwork that then doesn't need to be performed by your own auditor. Some EV certificates also come with some (probably completely useless) liability insurance. [1] https://chromium.googlesource.com/chromium/src/%2B/HEAD/docs/security/ev-to-page-info.md https://chromium.googlesource.com/chromium/src/%2B/HEAD/docs...
- duskwuff 2y ago> Some EV certificates also come with some (probably completely useless) liability insurance. Warranties / insurance on SSL certificates typically only pay out if a certificate is issued improperly, often in conjunction with other conditions like a financial loss directly resulting from the misissuance. Realistically, any screwup serious enough to result in that warranty paying out would also result in the CA being abruptly removed from browser root certificate programs.
- deleted 2y ago[deleted]
- uid65534 2y agoAh yes, I too remember when COMODO was ripped out of browsers in 2011 when it came to light they gave sign-anything rights to a bunch of resellers, one of whom was hacked. And then again in 2016. And another fun one unrelated to signing was when they tried to trademark "Let's Encrypt" in 2015. But yes, it is not a common issue and effort would be better focused on improving site security in other ways. (unlike the rest of my comment, this line isn't sarcasm.)
- Propelloni 2y agoThey are still there, but most browsers don't do anything with it anymore since 2019, when Firefox and Chrome stopped caring. There are some scenarios where you still have to employ EV certificates, e.g. code signing.
- _betty_ 2y agothey were also pretty bad for performance due to the extra lookup (and reduction in caching)
- account42 2y agoWhat extra lookup. AFAIU they are just like normal certificates but with a "customer paid extra" flag.
- _betty_ 2y agothey normally require a revocation lookup on the spot, and iirc there was differences in if they could or how stapling worked.
- account42 2y agoInteresting. Sounds like a cost that is entirely reasonable for use cases like online banking though.
- _betty_ 2y agohttps://simonhearne.com/2020/drop-ev-certs/ https://simonhearne.com/2020/drop-ev-certs/
- tannhaeuser 2y agoHuh? EV certificates are actually certifying you're the (juristical) person you're claiming to be based on ID and trade register checks, unlike Let's Encrypt certificates which only certify you're in possession of a domain. Isn't using EV certificates legally required for e-commerce web sites at least in parts of the world, and also obligatory for rolling out as MasterCard/Visa merchant by their anti-fraud requirements along with vulnerability checks and CI/site update processes being in place?
- khuey 2y ago> Isn't using EV certificates legally required for e-commerce web sites at least in parts of the world Not in any jurisdiction I'm aware of, though it's a big world so it wouldn't shock me if some small corner of it has bad laws. > and also obligatory for rolling out as MasterCard/Visa merchant by their anti-fraud requirements PCI DSS does not require EV certificates.
- irjustin 2y agoRelated point - we interface with Singapore gov services (MYINFO). They don't recognize LE nor AWS's certs. Only the big paid ones. Such an annoying process too - to pay, to obtain and update the certs.
- tialaramex 2y agoI guess the good thing there is that it's absolutely transparent that this is just a way to make you pay somebody else. Like the Jones Act (Merchant Marine Act, but everybody just calls it the Jones Act). The US government doesn't get a slice if you want to buy ships to move stuff from one part of the US to another, but it does require that you buy the ships from an American shipyard, and so those yards needn't be internationally competitive because the US government has their back. Nobody is like "Oh, the Jones Act ensures high quality ships" because it doesn't, the Jones Act just ensures that you're going to use those US shipyards, no matter what.
- vmit 2y agoMyinfo did away with certificate requirement altogether! Yay! (hello from Singapore)
- ta1243 2y agoOur company bans the use of letsencrypt because of the legal terms. Nobody at the CxO level will sign off on it, so we end up paying whatever to globalsign.
- seszett 2y agoWhat legal terms do they find objectionable? What about ZeroSSL, which is basically interchangeable with Let's Encrypt?
- technion 2y agoI deal with multiple enterprise applications where idea of scripting a renewal involves playing with scripting headless Chrome. I'm really not a fan of it but I'm happier paying for a one year cert than doing that
- yurishimo 2y agoSorry if this is a dumb question, but why? If I'm not mistaken, Let's Encrypt supports validation via DNS now so you don't even need to have a working webserver to issue a certificate. Automating a script to perform a renewal should be much simpler than headless Chrome! If your DNS provider doesn't have an API, that seems like a separate issue but one that is well worth your organization's time if you're working in the enterprise!
- patrakov 2y agoI guess it is not about renewal but about certificate deployment.
- blipvert 2y agoYou can set up the _acme-challenge (or whatever it is)as a CNAME to point to a domain which does support an API for automating the renewal (looking in to setting this up for a bunch of domains at work)
- technion 2y agoObtaining a certificate via dns doesn't help you install it via a Web interface that takes 20+ clicks and a 15 minute reboot to apply .
- pastage 2y agoAnd open a ticket on a suppliers website, click through four pages with free text input, then send certificate via email. Lets not talk about key delivery. We will get back the admin cost and of all that in a year if we tunnel them through one of our LBs.
- karel-3d 2y agoI have dealt with banking environment when they required SSL with at least 1-year validity on the callback API URL. Which excluded Let's Encrypt. We were looking for a SSL provider that had > 1 year old certs AND supported ACME... for some reason we ended up with SSL.com that did support ACME for longer lasting certs; however, there was some minor incompatibilities in how kubernetes cert-manager implemented ACME and how SSL.com implemented ACME; we ended up debugging SSL.com ACME protocol implementation. Fun. We should have just clicked once per 3 years, better than debugging third parties APIs. No, I don't remember the details and they are all lost in my old work emails. (Nowadays I think zerossl.com also supports ACME for >1 year certs? but they did not back then. edit: no they still don't, it's just SSL.com I think)
- JoshTriplett 2y ago> I have dealt with banking environment when they required SSL with at least 1-year validity on the callback API URL. Which excluded Let's Encrypt. I wonder if this would be an opportunity for revenue for Let's Encrypt? "We do 90-day automated-renewal certificates for free for everyone. If you're in an unusual environment where you need certificates with longer validity, we offer paid services you can use."
- account42 2y agoProbably better to keep LE / ISRG completely non-profit. Adding a profit motive has too big of a chance to end with actually security-relevant features being gated behind payment eventually.
- JoshTriplett 2y agoIt's less about the profit motive, and more about removing the remaining incentives to stay outside the ACME ecosystem. The funding would be to provide additional infrastructure (e.g. revocation servers for longer-lasting certificates), and to fund new such efforts.
- 2y ago
- wink 2y agoDoesn't necessarily have anything to do with knowing, some environments are just not worth automating or support it so badly that even paying twice or more would still be nothing compared to the annoyance. It's been getting better over the years though.