Re:Free, automated SSL certificates for Sandstorm self-hosters
by abritishguy on Monday October 05, 2015 @03:18PM
(#10334117)
Given they are managing the certs anyway they can revoke on behalf of the "average pleb", Just like CloudFlare did.
It is debatable how useful revoking is anyway so I agree that this provides more security, I just wasn't sure (until reply from Sandstorm) whether it would be worth the effort of setting up private key rotation.
Re:Free, automated SSL certificates for Sandstorm self-hosters
by kentonv on Monday October 05, 2015 @04:47PM
(#10334816)
> they can revoke on behalf of the "average pleb", Just like CloudFlare did.
Yes but the revocation infrastructure was totally overwhelmed by that and it's unclear if many of those revocations ever made it to users' browsers. E.g. Chrome only honors the revocation lists shipped with Chrome updates -- it does not query OCSP -- and browsers that do query OCSP will "fail open" if the servers don't reply (which they often don't).
(It sounds like you recognize this, just stating it for those who might not.)
I'd also argue that this is a massive help against heartbleed type vulns.
The average pleb(myself included) just patched the vuln and didn't do a thing regarding updating their(now potentially compromised) certs until their regular annual renewal hit.