News for hackers. Stuff that matters.

A comment on Google wants to reduce lifespan for HTTPS certificates to one year. Parent comment

Re:Google wants to reduce lifespan for HTTPS certificates to... by throw0101a on Sunday August 18, 2019 @07:54PM (#20733726)
Also, some systems are internal only, so can't use http-01 validation.

We have a bunch of these like this, so for our "foo.int.example.com" systems, in our public DNS we have a CNAME pointing to "foo.int.dnsauth.example.com", and have set up a new DNS infrastructure so that we can use dns-01 validation of TXT records there:

* https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode

* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

I had no idea that this functionality existed until fairly recently.

[ Parent | on HN ]
Re:Google wants to reduce lifespan for HTTPS certificates to... by AstralStorm on Monday August 19, 2019 @10:32AM (#20738071)
And the DNSSEC is authenticated with how often renewed certificate?

If there's no DNSSEC, this is entirely worthless. DNS is very easy to attack.

[ Parent | on HN ]
Re:Google wants to reduce lifespan for HTTPS certificates to... by tptacek on Monday August 19, 2019 @07:22PM (#20742616)
CAs are in general CT-logged now, and major sites all monitor the CT logs (hell, even small sites do at this point). If it's so easy to attack DNS to achieve misissuance, why isn't it happening all the time?
[ Parent | on HN ]