3 ms·

Because those ephemeral LE certificates are such a great idea...

by gethly 1y ago

jffry 1y ago
Certainly with yearlong or multi year certs nobody of note ever forgot to renew them, right? https://hn.algolia.com/?dateEnd=1416268800&dateRange=custom&dateStart=946684800&page=0&prefix=true&query=cert%20expire https://hn.algolia.com/?dateEnd=1416268800&dateRange=custom&...
shaky-carrousel 1y ago
It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate, and see their site vanish in mere weeks.
- KetoManx64 1y ago
  Great explanation and very apt for out time when we regularly hear of people being banned/debanked/jailed for their political views in western countries.
  - octoberfranklin 1y ago
    Yeah WebPKI is basically perfectly designed to facilitate deplatforming.
  - schoen 1y ago
    The web PKI is certainly a potential point of failure in online communications, but fortunately there is almost no history of certificate revocation over content disputes. The biggest targets have been domain name registrars and CDNs. Let's Encrypt has emphasized that it doesn't have the resources to investigate content disputes (currently, it's issuing nearly 10 million certificates per day, with no human intervention for any of them) and that having to adjudicate who's entitled to have a certificate by non-automated criteria would throw the model of free-of-charge certificates into doubt. Meanwhile, encrypting web traffic makes it harder for governments to know who is reading or saying what. (Not always impossible, just harder.) Without it, we could have phenomena like keyword searches over Internet traffic in order to instantly determine who's searching for or otherwise reading or writing specific terms! I'm very aware that it's still easy to observe who visits a particular site (based on SNI, as someone else mentioned in this thread). But there's a chicken-and-egg problem for protecting that information, and encrypting the actual site traffic is at least the chicken, while the egg may be coming with ECH. Overall, transit encryption is very good for free expression online, and people who want to undermine or limit online speech are much more likely to be trying to undermine encryption than to promote it. The biggest thing that Let's Encrypt in particular does to mitigate the risk of being unable to serve particular subscribers is to ensure that ACME is an open protocol that can be implemented by different CAs, and that it's very easy for subscribers to switch CAs at any time for any reason. The certificate system is more centralized than many people involved with it would prefer, but at least it's avoiding vendor lock-in.
- crazygringo 1y ago
  You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint. Employees leave, calendar reminders go missing, and yeah.
  - kxxt 1y ago
    It's because CRLs/OCSP sucks so now short expiration is rolling out.
    - ozim 1y ago
      CRL doesn’t suck it is just not easy problem on web scale. But seems like there is feasible solution: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
      - aaomidi 1y ago
        AKA they suck in this context
        ozim 1y ago
        Was CRL designed with this context in mind?
        aaomidi 1y ago
        Doesn’t matter. I think we’re fighting semantics. Certificates are cached trust, and all the cache busting problem applies here.
  - m-p-3 1y ago
    CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP. Short-lived certificates fixes these issues from an end-user standpoint.
- deleted 1y ago
  [deleted]
- tgsovlerkhgsel 1y ago
  Meanwhile, in the real world: - We went from the vast majority of traffic being unencrypted, allowing any passive attacker (from nation state to script kiddie sitting in the coffee shop) to snoop and any active attacker to trivially tamper with it, to all but a vanishing minority of connections being strongly encrypted. The scare tactics used to sell VPNs in YouTube ads used to all be true, and no longer are, due to this. - We went from TLS certificates being unaffordable to hobbyists to TLS certificates being not only free, but trivial to automatically obtain. - We went from a CA ecosystem where only commercial alternatives exist to one where the main CA is a nonprofit run by a foundation consisting mostly of strong proponents of Internet freedom. - Even if you count ZeroSSL and Let's Encrypt as US-controlled, there is at least one free non-US alternative using the same protocol, i.e. suitable as a drop-in replacement (https://www.actalis.com/subscription https://www.actalis.com/subscription). - Plenty of other paid but affordable alternatives exist from countless countries, and the ecosystem seems to be getting better, not worse. - While many other paths have been used to attempt to censor web sites, I haven't seen the certificate system used for this frequently (I'm sure there are individual court orders somewhere). - If the US wanted to put its full weight behind getting a site off the Internet, it would have other levers that would be equally or more effective. - Most Internet freedom advocates recognize that the migration to HTTPS was a really, really good thing.
  - justsomehnguy 1y ago
    Meanwhile, in the real world: - We now provide a completely free certs for a malicious web-sites - Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?) - Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings - SNI exists and even without it anything not on CDN is blocked very easily
    - prmoustache 1y ago
      What is stupid is not to provide free certs for malicious web sites, what was stupid is telling people for years that they would be safe and could trust a website only because there was a lock icon on the url bar.
    - 1y ago
- teekert 1y ago
  In caddy it takes more effort to NOT have https.
- Tepix 1y ago
  There should be an option to go without a recognized CA by publishing your website TLS certificate details via DNSSEC. I don‘t see any disadvantages over automatically issued certificates.
  - tptacek 1y ago
    (1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. (2) It's much slower than the TLS WebPKI. (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen. (4) It requires you to set up DNSSEC, which is so error prone that some of the largest engineering teams in the world have managed to take their sites (and also countries) offline. The thing about DNSSEC is that once you turn it on, it's a king-hell pain in the ass to turn it off without incurring an outage. DNS providers know this, and they know ops teams are terrified of DNSSEC, so they push it as a kind of account lock-in tool. There's a reason that the overwhelming majority of large site don't use it.
    - Tepix 1y ago
      > (1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. They need to be fixed but yes it is a real problem from what i've heard. > (2) It's much slower than the TLS WebPKI. Caching should make it fast enough. Do you have real-world numbers? > (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen. That is an excellent point. Do you have a solution? > (4) It requires you to set up DNSSEC, which is so error prone that some of the largest engineering teams in the world have managed to take their sites (and also countries) offline. I really don't like DNSSEC myself – i'd rather have seen DNSCurve https://dnscurve.org/ https://dnscurve.org/ succeed – but at a certain point, i think we just have to go with it.
      - tptacek 1y ago
01HNNWZ0MV43FF 1y ago
They are. Unbreakable crypto for free, your clients don't have to exchange keys with you in person, and the only cost is running a script on a server that has to run automated code all day anyway
hkt 1y ago
DANE would be better than LE, but weirdly the massive companies building browsers don't want to provide support. Spooky! https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
- aaomidi 1y ago
  You’re just moving your root of trust to DNS then? With certificates we’re doing multi perspective validation. DNS root of trust is silly. DNSSEC is not a proper root of trust
  - ocdtrekkie 1y ago
    DNS is already the root of trust, certificates are domain-validated. We currently just depend on both DNS and an unelected group of random companies Google has decided jump through their arbitrary hoops often enough. If your domain register or DNS provider is compromised in any way, all of the bullcrud the CA/B demands of certificates is entirely meaningless, the bad actor can legitimately request certificates.
    - aaomidi 1y ago
      This is what multi perspective helps with. It doesn’t mitigate every single attack. But think about what DANE is for a second. If a bad actor is MITMing your connection to some endpoint, they certainly can MITM your DNS queries too.
      - ocdtrekkie 1y ago
        Multi-perspective helps prevent MITM, it doesn't provide any better security than your domain and DNS provider's security. It's just another layer to patch over the bad idea of CAs in the first place.
        crote 1y ago
        It's a completely different attack scenario. DANE isn't going to be of any value when an attacker is sitting between the end user and their ISP - which was already the requirement for compromising the TLS connection in the first place - as they could just strip DNSSEC and fake the DANE records.
aaomidi 1y ago
Running basic automation to keep your certificates renewed is not difficult. I do this on my toy website and it’s been working without me touching it since before the pandemic.
stusmall 1y ago
This hot take is made better by the fact that the site in your profile has LE certs

Because those ephemeral LE certificates are such a great idea...

by gethly 1y ago

Because those ephemeral LE certificates are such a great idea...

Certainly with yearlong or multi year certs nobody of note ever forgot to renew them, right? https://hn.algolia.com/?dateEnd=1416268800&dateRange=custom&dateStart=946684800&page=0&prefix=true&query=cert%20expire https://hn.algolia.com/?dateEnd=1416268800&dateRange=custom&...

shaky-carrousel 1y ago

It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate, and see their site vanish in mere weeks.

KetoManx64 1y ago
Great explanation and very apt for out time when we regularly hear of people being banned/debanked/jailed for their political views in western countries.
- octoberfranklin 1y ago
  Yeah WebPKI is basically perfectly designed to facilitate deplatforming.
- schoen 1y ago
  The web PKI is certainly a potential point of failure in online communications, but fortunately there is almost no history of certificate revocation over content disputes. The biggest targets have been domain name registrars and CDNs. Let's Encrypt has emphasized that it doesn't have the resources to investigate content disputes (currently, it's issuing nearly 10 million certificates per day, with no human intervention for any of them) and that having to adjudicate who's entitled to have a certificate by non-automated criteria would throw the model of free-of-charge certificates into doubt. Meanwhile, encrypting web traffic makes it harder for governments to know who is reading or saying what. (Not always impossible, just harder.) Without it, we could have phenomena like keyword searches over Internet traffic in order to instantly determine who's searching for or otherwise reading or writing specific terms! I'm very aware that it's still easy to observe who visits a particular site (based on SNI, as someone else mentioned in this thread). But there's a chicken-and-egg problem for protecting that information, and encrypting the actual site traffic is at least the chicken, while the egg may be coming with ECH. Overall, transit encryption is very good for free expression online, and people who want to undermine or limit online speech are much more likely to be trying to undermine encryption than to promote it. The biggest thing that Let's Encrypt in particular does to mitigate the risk of being unable to serve particular subscribers is to ensure that ACME is an open protocol that can be implemented by different CAs, and that it's very easy for subscribers to switch CAs at any time for any reason. The certificate system is more centralized than many people involved with it would prefer, but at least it's avoiding vendor lock-in.
crazygringo 1y ago
You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint. Employees leave, calendar reminders go missing, and yeah.
- kxxt 1y ago
  It's because CRLs/OCSP sucks so now short expiration is rolling out.
  - ozim 1y ago
    CRL doesn’t suck it is just not easy problem on web scale. But seems like there is feasible solution: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
    - aaomidi 1y ago
      AKA they suck in this context
      - ozim 1y ago
        Was CRL designed with this context in mind?
        aaomidi 1y ago
        Doesn’t matter. I think we’re fighting semantics. Certificates are cached trust, and all the cache busting problem applies here.
- m-p-3 1y ago
  CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP. Short-lived certificates fixes these issues from an end-user standpoint.
deleted 1y ago
[deleted]
tgsovlerkhgsel 1y ago
Meanwhile, in the real world: - We went from the vast majority of traffic being unencrypted, allowing any passive attacker (from nation state to script kiddie sitting in the coffee shop) to snoop and any active attacker to trivially tamper with it, to all but a vanishing minority of connections being strongly encrypted. The scare tactics used to sell VPNs in YouTube ads used to all be true, and no longer are, due to this. - We went from TLS certificates being unaffordable to hobbyists to TLS certificates being not only free, but trivial to automatically obtain. - We went from a CA ecosystem where only commercial alternatives exist to one where the main CA is a nonprofit run by a foundation consisting mostly of strong proponents of Internet freedom. - Even if you count ZeroSSL and Let's Encrypt as US-controlled, there is at least one free non-US alternative using the same protocol, i.e. suitable as a drop-in replacement (https://www.actalis.com/subscription https://www.actalis.com/subscription). - Plenty of other paid but affordable alternatives exist from countless countries, and the ecosystem seems to be getting better, not worse. - While many other paths have been used to attempt to censor web sites, I haven't seen the certificate system used for this frequently (I'm sure there are individual court orders somewhere). - If the US wanted to put its full weight behind getting a site off the Internet, it would have other levers that would be equally or more effective. - Most Internet freedom advocates recognize that the migration to HTTPS was a really, really good thing.
- justsomehnguy 1y ago
  Meanwhile, in the real world: - We now provide a completely free certs for a malicious web-sites - Degraded encryption value so much it's not even indicated anymore (remember the green bar for EV?) - Pavlov-trained everyone to dumb-click through 'this page is not secure' warnings - SNI exists and even without it anything not on CDN is blocked very easily
  - prmoustache 1y ago
    What is stupid is not to provide free certs for malicious web sites, what was stupid is telling people for years that they would be safe and could trust a website only because there was a lock icon on the url bar.
  - 1y ago
teekert 1y ago
In caddy it takes more effort to NOT have https.
Tepix 1y ago
There should be an option to go without a recognized CA by publishing your website TLS certificate details via DNSSEC. I don‘t see any disadvantages over automatically issued certificates.
- tptacek 1y ago
  (1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. (2) It's much slower than the TLS WebPKI. (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen. (4) It requires you to set up DNSSEC, which is so error prone that some of the largest engineering teams in the world have managed to take their sites (and also countries) offline. The thing about DNSSEC is that once you turn it on, it's a king-hell pain in the ass to turn it off without incurring an outage. DNS providers know this, and they know ops teams are terrified of DNSSEC, so they push it as a kind of account lock-in tool. There's a reason that the overwhelming majority of large site don't use it.
  - Tepix 1y ago
    > (1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. They need to be fixed but yes it is a real problem from what i've heard. > (2) It's much slower than the TLS WebPKI. Caching should make it fast enough. Do you have real-world numbers? > (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen. That is an excellent point. Do you have a solution? > (4) It requires you to set up DNSSEC, which is so error prone that some of the largest engineering teams in the world have managed to take their sites (and also countries) offline. I really don't like DNSSEC myself – i'd rather have seen DNSCurve https://dnscurve.org/ https://dnscurve.org/ succeed – but at a certain point, i think we just have to go with it.
    - tptacek 1y ago

01HNNWZ0MV43FF 1y ago

They are. Unbreakable crypto for free, your clients don't have to exchange keys with you in person, and the only cost is running a script on a server that has to run automated code all day anyway

hkt 1y ago

DANE would be better than LE, but weirdly the massive companies building browsers don't want to provide support. Spooky! https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

aaomidi 1y ago
You’re just moving your root of trust to DNS then? With certificates we’re doing multi perspective validation. DNS root of trust is silly. DNSSEC is not a proper root of trust
- ocdtrekkie 1y ago
  DNS is already the root of trust, certificates are domain-validated. We currently just depend on both DNS and an unelected group of random companies Google has decided jump through their arbitrary hoops often enough. If your domain register or DNS provider is compromised in any way, all of the bullcrud the CA/B demands of certificates is entirely meaningless, the bad actor can legitimately request certificates.
  - aaomidi 1y ago
    This is what multi perspective helps with. It doesn’t mitigate every single attack. But think about what DANE is for a second. If a bad actor is MITMing your connection to some endpoint, they certainly can MITM your DNS queries too.
    - ocdtrekkie 1y ago
      Multi-perspective helps prevent MITM, it doesn't provide any better security than your domain and DNS provider's security. It's just another layer to patch over the bad idea of CAs in the first place.
      - crote 1y ago
        It's a completely different attack scenario. DANE isn't going to be of any value when an attacker is sitting between the end user and their ISP - which was already the requirement for compromising the TLS connection in the first place - as they could just strip DNSSEC and fake the DANE records.

aaomidi 1y ago

Running basic automation to keep your certificates renewed is not difficult. I do this on my toy website and it’s been working without me touching it since before the pandemic.

stusmall 1y ago

This hot take is made better by the fact that the site in your profile has LE certs