4 ms·
This sounds like a very good thing, like a lot of stuff coming from letsencrypt. But what risks are attached with such a short refresh? Is there someone at th
by bflesch 9mo ago
This sounds like a very good thing, like a lot of stuff coming from letsencrypt.
But what risks are attached with such a short refresh?
Is there someone at the top of the certificate chain who can refuse to give out further certificates within the blink of an eye?
If yes, would this mean that within 6 days all affected certificates would expire, like a very big Denial of Service attack?
And after 6 days everybody goes back to using HTTP?
Maybe someone with more knowledge about certificate chains can explain it to me.
- iso1631 9mo agoWith a 6 day lifetime you'd typically renew after 3 days. If Lets Encrypt is down or refuses to issue then you'd have to choose a different provider. Your browser trusts many different "top of the chain" providers. With a 30 day cert with renewal 10-15 days in advance that gives you breathing room Personally I think 3 days is far too short unless you have your automation pulling from two different suppliers.
- bflesch 9mo agoThank you, I missed the part with several "top of the chain" providers. So all of them would need to go down at the same time for things to really stop working. How many "top of chain" providers is letsencrypt using? Are they a single point of failure in that regard? I'd imagine that other "top of chain" providers want money for their certificates and that they might have a manual process which is slower than letsencrypt?
- cpach 9mo ago“Are they a single point of failure in that regard?” It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.
- bflesch 9mo agoMakes sense. I assume each of them is in control and at the whims of US president?
- mholt 9mo agoThey are not in control of the US president.
- bflesch 9mo agoI'm pretty sure that the .org TLD can be shut off by the US at any point in time.
- cpach 9mo agoThat’s not relevant though. These CAs will gladly give you a .se/.dk/.in/whatever cert as long as validation passes.
- bflesch 9mo agoI hope so, but can we really be sure that .se or .de would still work in such a scenario? Is the TLD root management really split up vertically or is the (presumably US-based) TLD parent organization also the final authority for every country TLD? It would be nice to at least have a very high level contingency plan because in worst case I won't be able to google it.
- cpach 9mo agoNot sure what the exact concern is here. So far, virtually all countries on Earth are still represented in DNS. Venezuela, Iran, Somalia, etc etc. You can also read a lot of anti-Trump articles and comments on countless web-sites, some under .com and some under other top-domains. As lunatic as Trump is, he hasn’t shut that down. “Is the TLD root management really split up vertically” AFAIK, yes, it is. But if the global DNS would somehow break down I guess you either have to find an alternative set of root servers. Or communicate outside of the regular Internet. Such an event surely would shock the global economy.
- mholt 9mo agoLE has 2 primary production data centers: https://letsencrypt.status.io/ https://letsencrypt.status.io/ But in general, one of the points of ACME is to eliminate dependence on a single provider, and prevent vendor lock-in. ACME clients should ideally support multiple ACME CAs. For example, Caddy defaults to both LE and ZeroSSL. Users can additionally configure other CAs like Google Trust Services. This document discusses several failure modes to consider: https://github.com/https-dev/docs/blob/master/acme-ops.md#if-an-active-certificate-cannot-be-renewed-in-time-act-according-to-your-sites-threat-model https://github.com/https-dev/docs/blob/master/acme-ops.md#if...