7 ms·
Why this project: https://letsencrypt.org/ https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, a
by bigdubs 11y ago
Why this project: https://letsencrypt.org/ https://letsencrypt.org/ is so important.
From the site: Let’s Encrypt is a new Certificate Authority:
It’s free, automated, and open.
Arriving Mid-2015
- nothrabannosir 11y agoThat's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an automated process available that allows IP-only certs. And whatever their price, if companies start following Mozilla's lead too soon, I'll have to pay up. The wording in the article is perhaps not so damning yet, but it's still making me uneasy that they put out this press release while there are currently ZERO viable solutions for this.
- undefined0 11y agoLetsEncrypt works with IPv4. I assume it will work with IPv6. LetsEncrypt is a Mozilla project, it's safe to assume they will launch LetsEncrypt before deprecating non-secure websites.
- schoen 11y agoRight now the subject identifier in a Let's Encrypt cert must be a DNS name, not an IP address. From the ACME protocol specification draft: "Note that while ACME is defined with enough flexibility to handle different types of identifiers in principle, the primary use case addressed by this document is the case where domain names are used as identifiers. For example, all of the identifier validation challenges described in Section {identifier-validation-challenges} below address validation of domain names. The use of ACME for other protocols will require further specification, in order to describe how these identifiers are encoded in the protocol, and what types of validation challenges the server might require."
- pfg 11y agoThis is in line with other CAs - no certificates should be issued for IP addresses or internal server names with expiry dates after November 2015. See for example: https://www.digicert.com/internal-names.htm https://www.digicert.com/internal-names.htm
- schoen 11y agoTechnically I think the requirement Digicert is referring to only forbids issuance for "reserved" IP addresses. https://cabforum.org/internal-names/ https://cabforum.org/internal-names/ The PDF document defines "Reserved IP Address" as "An IPv4 or IPv6 address that the IANA has marked as reserved".
- pfg 11y agoMissed that, thanks!
- vitno 11y agoLet's Encrypt does exist. I watched a demo where they went from a vanilla apache install to an A scoring HTTPS site in sub 5 minutes at Libreplanet. It's a good idea to publicize the upcoming LARGE change.
- schoen 11y agoI'm the person who gave that demo and I appreciate the compliment, but I'll readily admit that we can't yet issue publicly-trusted certificates to the public. So we aren't up and running in a way that a site could take advantage of. On the other hand, our infrastructure, partnerships, and technology are very real. I hope they'll make the process just as easy as what you saw for many people soon.
- bigiain 11y agoStartSSL exists right now - and has been providing free certs for personal use for years now. I'm curious about your requirement for IP only certs? Sure you don't "own" a domain name, but it's even less true that you "own" a specific IP address. (Well, at least for me, perhaps if your project is in the datacenter/isp/network-infrastructure space you might actually have some cintractual "ownership" of an IP address?)
- joosters 11y agoStartSSL is far from simple to use.
- bigiain 11y agoIt's hardly rocket surgery though. Anyone incapable of following the steps required there is probably not who you'd want implementing your web server security…
- deleted 11y ago[deleted]
- rhizome31 11y agoLast time I tried, their site had JavaScript bugs and their email validation procedure didn't pass greylisting. I didn't want to place my web server security in the hands of a company with such low quality standards.
- deleted 11y ago[deleted]
- thwarted 11y agoFor example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). This doesn't make any sense. You're not waiting for DNS to propagate to clients; if anything you're waiting for recursive DNS servers at shitty ISPs to time out their caches when they are configured to not honor the RR's TTL sent by the authoritative server in a misguided attempt to make the internet "faster". But this is completely avoidable without having to use IPs or certificates with CN/SAN that are IPs: get a wildcard cert and rotate the subdomain name. It's a new hostname, so it busts intermediate DNS caches by being new queries; since it's a new query, there's no "propagation to clients" to wait for when you change IPs, all queries for the new name hit authoritative servers. Additionally, it looks infinitely more legit than a website that is accessible only via IP address. And doubly additionally, if you're going through so many IPs, presumably you'll be rotating some out and those may be assigned to other people who can then get their own cert for that IP and impersonate you.
- nailer 11y agoHow often are DNS caches configured to ignore TTLs? That sounds awful. I assumed the grandparent simply didn't understand the need to lower his TTLs.
- aroch 11y agoGoogle DNS seems to ignore TTL but it does the opposite of what the GP is saying; gDNS drops it cache before the TTL is expired.
- thwarted 11y agoUnless you have a reference for Google saying they purposely do this, it is more likely that the cache is dropping LRU entries as it fills up. Also, I doubt there is a trivial number of actual resolvers behind the google public DNS endpoints, so you may be seeing the result of multiple individual servers without shared cache initially populating their caches. Some quick tests with dig seem to indicate that, at least for the region I'm in, my queries to google's public DNS is rotating between 4 or 5 servers, as evidenced by the TTLs being returned.
- deftnerd 11y agoYou can also get a certificate with as many as 100 domains in the SAN for free from https://buy.wosign.com/free/FreeSSL.html https://buy.wosign.com/free/FreeSSL.html
- mahouse 11y agoAnd what if I don't trust any of the "MAJOR SPONSORS".
- letstryagain 11y agoYou don't trust the EFF?
- mondoshawan22 11y agoNo, not in the slightest. The EFF is a non-profit organization that exists to lobby for policy change. No such organization is worthy of much in the way of trust -- especially for such a sensitive instrument.
- PhasmaFelis 11y agoWhat organization would you consider more trustworthy?
- mondoshawan22 11y agoA non-profit, apolitical organization dedicated to identity verification and management of a PKI trust, whose charter includes yearly audits of its systems.
- Frondo 11y agoTo look at the history and charter of the EFF and say you don't trust them "in the slightest" is a bit ridiculous. It's hard to take that kind of remark seriously. Look at who's involved and what they've done, and dismiss that under the broad strokes of "no such organization is worthy of trust"? Nonsense.
- mondoshawan22 11y agoI don't care who's involved, honestly. The problem is that they're a lobby and they actively push for policy changes. That's a full time job in and of itself -- identity verification is also a full time job, and a requirement of a properly functioning PKI. What I want involved is an identity verification organization whose mission is clearly defined to be identity verification and management of a PKI trust.
- mkozlows 11y agoHow well does that work on a corporate intranet? How well does it work with Windows? If the friction for testing, say, an enterprise LOB app on an internal-only QA IIS server is any higher than "basically zero" with Firefox, and the same friction doesn't apply to Chrome or IE, well.
- pfg 11y ago1. On a corporate internet, you're probably in a position to deploy your own CA certificates. This is quite common. 2. Let's Encrypt will use an open protocol, so it should be OS-agnostic. 3. "Privileged Contexts" is being developed as a W3C working draft [1]. It's quite likely this won't be just a Mozilla-thing. Google has been fairly aggressive when it comes to pushing for more (and better) SSL as well (see SHA1 cert deprecation). [1]: http://www.w3.org/TR/powerful-features/ http://www.w3.org/TR/powerful-features/
- recursive 11y agoI'm a person who actually deploys .net apps to internal IIS QA servers. If I want them to use HTTPS, I have to configure it. I don't know anything about my own CA certificates. I'm not saying it couldn't happen, but it's certainly easier to suggest just not using firefox if something isn't working.
- hobarrera 11y agoSo you handle deployment of apps inside a corporate network, and have no idea on how to manage you own CA? How does you corporation handle actually important corporate sites that nobody must access? It sound to my like your corp has some issues on this side.
- hackmiester 11y ago...Why would a company need to run their own CA to do this?
- tomjen3 11y agoIt is waperware. Plus it requires you to run special software on your servers (not possible in a shared hosting environment).
- throwaway41597 11y ago> it requires you to run special software on your servers It doesn't, they ship a tool only for convenience. An open source tool running on your machine would be reverse-engineerable anyway. Plus, it is expected that shared hosting providers will run the tool for you.
- vtlynch 11y agoAny citation for this claim: "it is expected that shared hosting providers will run the tool for you"? Currently SSL is a revenue stream for many shared hosting providers. Are there are on-record comments from major providers who are planning on supporting Let's Encrypt?
- throwaway41597 11y agoThat's not a claim, it's speculation. Since there is not marginal cost, it's going to happen eventually. You only need one provider to do it and some customers to request it for the others to follow. Many shared hosting providers already have removed traffic limits despite the additional revenue it used to bring. They can upsell customers with extended validation anyway. The only problem is lack of browser support for server name indication so one IP can be shared by many customers, but it's getting less of an issue by end-users renewing their hardware or updating their browser.
- _ak 11y agoWake me again when this is more than vaporware.
- lurkinggrue 11y agoThe next problem is IP addresses. How is SNI these days? I've been meaning to experiment with it but the lack of extra personal certs have prevented me.