News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by xg15 on Sunday June 28, 2020 @12:34PM (#23669957)
This won't work either, btw: You'd have to request from Let's Encrypt a new certificate for each individual device. LE has several rate limits that will prevent that from working for anything more than a trivial number of devices: https://letsencrypt.org/docs/rate-limits/

The only way I see how this would work is if you not just purchase a domain but also an internet-facing server and do the renewal and certificate management centrally for all devices - at which point, your device is definitly not standalone anymore.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by AdamJacobMuller on Sunday June 28, 2020 @01:05PM (#23670224)
This will work fine. LetsEncrypt will raise ratelimits for you. I've done it for a commercial CDN and they were very accommodating and helpful.

Plex does this, for example, though they use DigiCert's free certificates: https://www.plex.tv/blog/its-not-easy-being-green-secure-com...

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by sokoloff on Sunday June 28, 2020 @02:32PM (#23670955)
The LE rate limits are (mostly?) for new cert issuance. I’ve never run into a rate limit on automated renewals and seem to recall it was either non-existent or comically far away from anything any individual would hit.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by MikeHardman on Sunday June 28, 2020 @12:44PM (#23670030)
You can do wildcard certs with LE, I run hundreds of k8s services all secured with LE and wildcard certs.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by stefan_ on Sunday June 28, 2020 @12:50PM (#23670088)
We're talking about customer hardware. If someone looks at the insides of the device and finds, of course, the private key for your one shared wildcard certificate, the issuer is required to invalidate it immediately.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by lvh on Sunday June 28, 2020 @12:51PM (#23670099)
You can, but that wouldn't quite work for the prosumer router manufacturer case the OP mentioned: LE would revoke the cert once you distributed it.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by AdamJacobMuller on Sunday June 28, 2020 @01:05PM (#23670230)
You can, but, you can't (by policy) distribute keys across multiple customers.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by tgsovlerkhgsel on Sunday June 28, 2020 @01:49PM (#23670592)
I have a nasty habit of requesting revocation of such compromised keys whenever I find them. CAs are required to revoke within 24 hours, I think, though unfortunately revocation is surprisingly ineffective.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by AdamJacobMuller on Sunday June 28, 2020 @03:57PM (#23671579)
Do you actually find those often? I've actually never seen one. I will admit I've also never specifically looked very hard.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by tgsovlerkhgsel on Monday June 29, 2020 @12:13PM (#23678932)
I'd say one every couple of years.

https://letsencrypt.org/docs/certificates-for-localhost/ has great documentation on that topic, including more examples.

[ Parent | on HN ]