dextercd

6 ms·

1.
by dextercd 3mo ago
This comment on the 7th of May from someone at Let's Encrypt says that implementation may be delayed until Q3 due to open issues in the specification. That might be what happened. https://community.letsencrypt.org/t&#x2
2.
by dextercd 4mo ago
Apparently VeriSign plans to discontinue .name: https://itp.cdn.icann.org/en/files/consensus-policies/rsep-2...
3.
by dextercd 7mo ago
Your comment is 100% correct, but I just want to point out that this doesn't negate the risks of bob's approach here. LE wouldn't see this as a legitimate reason to raise rate limits, and such a request takes weeks to handle
4.
by dextercd 7mo ago
An account needs to be created before you can request a certificate. Some ACME clients might create the account for you implicitly when you request the first certificate, but in the background it still needs to start by registering an accou
5.
by dextercd 7mo ago
This adds a new validation method that people can use if they want. The existing validation methods ( https://letsencrypt.org/docs/challenge-types/ ) aren't going away, so your current setup will keep working.
6.
by dextercd 8mo ago
The server that wants to authenticate clients via mTLS doesn't need the clientAuth EKU on its certificate, only the clients do. Most of the time you set up mTLS by creating your own self-signed certificate and verifying that the client
7.
by dextercd 8mo ago
Thanks for chiming in! I remember now that you also said this on the LE community forum. Right, that explains it. So the use would be for things other than websites or for websites that don't need to support Chrome (and also need clien
8.
by dextercd 8mo ago
All major root store programs (Chrome, Apple, Microsoft, Mozilla) have this power. They set the requirements that CAs must follow to be included in their root store, and for most CAs their certs would be useless if they aren't included
9.
by dextercd 8mo ago
It's a requirement from the Chrome root program. This page is probably the best resource on why they want this: https://googlechrome.github.io/chromerootprogram/moving-forw...
10.
by dextercd 9mo ago
Interesting! On the Google search results page at the bottom there's a city name + "From your IP address" link. Clicking it shows a map with a circled region. It seems to match with what Google maps opens by default. It'
11.
by dextercd 9mo ago
2.33 km off for me. Pretty cool
12.
by dextercd 9mo ago
You need external monitoring of certificate validity. Your ACME client might not be sending failure notifications properly (like happened to Bazel here). The client could also think everything is OK because it acquired a new cert, meanwhile
13.
by dextercd 1y ago
Here's the Python version I've been using: https://gist.github.com/dextercd/3bd65c1e32635b9e7bebf287b52... Another issue I just ran into is that a colon separated value for ExecSearchPath doesn't work in
14.
by dextercd 1y ago
You can use systemd-run with --shell (or a subset of options enabled by --shell) and -p to specify service properties to run commands interactively in a similar environment as your service. This can help troubleshoot issues and makes experi
15.
by dextercd 1y ago
A code signing certificate does not cost $500 a year. The OP links to an offering by Certum which is just $25 a year plus the cost for a reusable smart card. Personally, I recently acquired a certificate from HARICA which costs $55 a year i
16.
by dextercd 1y ago
CT definitely helps, but not everyone monitors it. This is an area where I still need to improve. But even if you detect a misissued cert, it can not reliably be revoked with OCSP/CRL. -- The maximum cert lifetime will gradually go dow
17.
by dextercd 1y ago
Sure, but it's even better if everyone else does too, including attackers that mislead CAs into misissuing a cert. CAs used to be able to use WHOIS for DCV. The fact that this option was taken away from everyone is good. It's the
18.
by dextercd 1y ago
Apple introduced this proposal. Why would they care about a CA's legal exposure? Lower the lifetime of certs does mean that orgs will be better prepared to replace bad certs when they occur. That's a good thing. More organisations
19.
by dextercd 1y ago
Stealing a private key or getting a CA to misissue a certificate is hard. Then actually making use of this in a MITM attack is also difficult. Still, oppressive states or hacked ISPs can perform these attacks on small scales (e.g. individua
20.
by dextercd 1y ago
No idea how many are first-party or vetted by Microsoft. Probably none of them. But I really, really doubt you can only run software that ticks one of those two boxes. Certify The Web has a 'Microsoft Partner' badge. If that&#x2
21.
by dextercd 1y ago
I learned a lot from TLS Mastery by Michael W. Lucas.
22.
by dextercd 1y ago
Let's Encrypt lists 10 ACME clients for Windows / IIS. If an organisation ignores all those options, then I suppose they should keep doing it manually. But at the end of the day, that is a choice. Maybe they'll reconsider now
23.
by dextercd 1y ago
If a CA or subscriber improves their security but had an undetected incident in the past, a hacker today has a 397 day cert and can reuse the domain control validation in the next 397 days, meaning they can MITM traffic for effectively 794
24.
by dextercd 1y ago
I think most orgs can get away with free ACME clients and free/cheap monitoring options. This will be painful for people in the short term, but in the long term I believe it will make things more automated, more secure, and less fragil
25.
by dextercd 1y ago
"outdated certificate data" would be domains you no longer control. (Example would be a customer no longer points a DNS record at some service provider or domains that have changed ownership). In the case of OV/EV certificate
26.
by dextercd 1y ago
CAs and certificate consumers (browsers) voted in favour of this change. They didn't do this because they're incompetent but because they think it'll improve security. It's really not that hard to automate renewals and m
27.
by dextercd 1y ago
NGINX detects attempts to use http for server blocks configured to handle https traffic and returns an unencrypted http error: "400 The plain HTTP request was sent to HTTPS port". Doing anything other than disconnecting or returni
28.
by dextercd 1y ago
Automate it, have the ACME client send alerts if renewal fails, and also monitor the system's certificate from a different system.
29.
CMake 4.0.0-rc1 is ready for testing(discourse.cmake.org)
1 points by dextercd 2y ago|0 comments
30.
Nginx: try_files Is Evil Too (2024)(getpagespeed.com)
80 points by dextercd 2y ago|19 comments

More ›