What is the use case or benefit for the server admin?
as a server admin I wouldn't want to keep renewing my cert.
can anyone help to explain?
this post was submitted on 16 Dec 2024
359 points (97.9% liked)
Technology
60059 readers
3148 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
Lets Encrypt certs tend to be renewed by a cronjob, anyway. The advantage is that if someone gets your cert without your knowledge, they have, at most, six days to make use of it.
If they get it without your knowledge, what are the odds they can get the new one too?
If they got it with your knowledge, can't you just revoke the old one?
If they got it with your knowledge, can’t you just revoke the old one?
Yeah, but unfortunately cert revocation isn't that great in practice. Lots of devices and services don't even check the revocation lists on every connection.
I've been using the Swiss Cheese Model for my sandwiches and they've been a disaster.
You have to scramble the slices, otherwise the holes all line up and your mayonnaise falls out.
6 days to do what you want to do to the page and its visitors. I guess that's good?
load more comments
(1 replies)
load more comments
(10 replies)
It's kind of in line with their plan to get rid of OCSP: short certificate lifetimes keep CRLs short, so I get where they're coming from (I think).
90 days of validity, which was once a short lifetime. Currently, Google is planning to enforce this as the maximum validity duration in their browser, and I'm sure Mozilla will follow, but it wouldn't matter if they didn't because no provider can afford to not support chromium based browsers.
I was expecting that they reduce the maximum situation to e.g. 30 days, but I guess they want to make the stricter rules optional first to make sure there are no issues.
Interesting. I use LetsEncrypt largely for internal services, of which I expose a handful externally, and I've been thinking of only opening the external port mapping for cert renewals. With this at 90 days, I was planning on doing this once/month or so, but maybe I'll just go script it and try doing it every 2-3 days (and only leave the external ports open for the duration of the challenge/response).
I'm guessing my use-case is pretty abnormal, but it would be super cool if they had support for this use-case. I basically just want my router to handle static routes and have everything be E2EE even on my LAN. Shortening to 6 days is cool from a security standpoint, but a bit annoying for this use-case.
You can use DNS challenge to renew your certificates without opening ports! Have a look at acme.sh for automation.
Oh, awesome! I thought that was a manual process, so I've been using the regular method.
Looks like I have a new project for this weekend. My DNS is currently hosted at Cloudflare, so this should be pretty straightforward.
Caddy with the cloudflare module makes TLS with DNS verification insanely simple
load more comments
(1 replies)
load more comments
(1 replies)
Digicert, Sectigo, Globalsign: hold my beer, 1 day certificate, even better: on the fly certificate per client 😂
Don’t certs just create an ephemeral key pair that disappears after the session anyhow? What does cert validity period have to do with “This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.”
I mean, it’s LE so I’m sure they know what their talking about. But…?
compromising a keypair is a huge win. lets you impersonate the domain. shorter validation periods = smaller windows of compromised situations.
basically the smaller you make the window the less manual intervention and the less complicated infrastructure gets. currently TLS systems need a way to invalidate certificates. get them down to a day and suddenly that need just disappears. vastly simplifying the code and the system. 6 days is a huge improvement over 90 days.
load more comments
(3 replies)
I'm far from an expert on PKI, but isn't the keypair used for the cert used for key exchange? Then in theory, if that key was compromised, it could allow an adversary to be able to capture and decrypt full sessions.
Im also not an expert but i believe since there Is still an ephemeral DH key exchange happening an attacker needs to actively MITM while having the certificate private key to decrypt the session. Passive capturing wont work
No. Perfect Forward Secrecy (ephemeral keys) prevents this type of replay.
load more comments
(2 replies)
load more comments
(1 replies)
Since I set up a https website (lemmy) and had to deal with the hassle of certificates, I do wonder why you need another entity to churn out what's basically a RSA key pair?
Is it this you must trust the government again or is there some better reasons for it?
It's to make sure you're actually reaching your intended endpoint. If I'm visiting a site for the first time, how do I know I actually have THEIR certificate? If it's self generated, anybody could sign a certificate claiming to be anybody else. The current system is to use authority figures who validate certificates are owned by the site you're trying to visit. This means you have a secure connection AND know you're interacting with the correct site.
load more comments
(28 replies)
view more: next ›