Comment

Comment on Decreasing Certificate Lifetimes to 45 Days

I’m sorry but if you aren’t using automated renewals then you are not using let’s encrypt the way it’s intended to be used. You should take this as an opportunity to get that set up.

source

Sort:hotnew top

jj4211@lemmy.world ⁨2⁩ ⁨days⁩ ago
Ours is automated, but we incur downtime on the renewal because our org forbids plain http so we have to do TLS-ALPN-01. It is a short downtime. I wish let’s encrypt would just allow http challenges over https while skipping the cert validation. It’s nuts that we have to meaningfully reply over 80…

Though I also think it’s nuts that we aren’t allowed to even send a redirect over 80…

source
- kungen@feddit.nu ⁨2⁩ ⁨days⁩ ago
  Hot take: for-profit orgs should be buying TLS certificates from the CA cartel instead of using Let’s Encrypt. Unless you’re donating to LE, and in that case it’s cool.
  
  source
  - jj4211@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Frankly, another choice virtually forced by the broader IT.
    
    If the broader IT either provides or brokers a service, we are not allowed to independently spend money and must go through them.
    
    Fine, they will broker commercial certificates, so just do that, right? Well, to renew a certificate, we have to open a ticket and attach our csr as well as a “business justification” and our dept incurs a hundred dollar internal charge for opening that ticket at all. Then they will let it sit for a day or two until one of their techs can get to it. Then we are likely to get feedback about something like their policy changing to forbid EC keys and we must do RSA instead, or vice versa because someone changed their mind. They may email an unexpected manager for confirmation in accordance to some new review process they implemented. Then, eventually, their tech manually renews it with a provider and attaches the certificate to the ticket.
    
    It’s pretty much a loophole that we can use let’s encrypt because they don’t charge and technically the restrictions only come in when purchasing is involved. There was a security guy raising hell that some of our sites used that “insecure” let’s encrypt and demanding standards change to explicitly ban them, but the bearaucracy to do that was insurmountable so we continue.
    
    source
- Atemu@lemmy.ml ⁨20⁩ ⁨hours⁩ ago
  Forgive my ignorance but why would that incur a downtime?
  
  The only way I can think of for downtime to happen if you switched certs before the new one was signed (in which case …don’t) or am I missing something?
  
  It also strikes me as weird that LE requires 80 but does allow insecure 443 after a redirect. Why not just do/allow insecure 443 in the first place?
  
  source
  - jj4211@lemmy.world ⁨19⁩ ⁨hours⁩ ago
    the TLS-ALPN-01 challenge requires a https server that implements generating a self-signed certificate on demand in response to a specific request. So we have to shut down our usual traffic forwarder and let an ACME implementation control the port for a minute or so. It’s not a long downtime, but irritatingly awkward to do and can disrupt some traffic on our site that has clients from every timezone so there’s no universal ‘3 in the morning’ time, and even then our service is used as part of other clients ‘3 in the morning’ maintenance windows… Folks can generally take a blip in the provider but don’t like that we generate a blip in those logs if they connect at just the wrong minute in a month…
    
    As to why not support going straight to 443, don’t know why not. I know they did TLS-ALPN-01 to keep it purely as TLS extensions to stay out of the URL space of services which had value to some that liked being able to fully handle it in TLS termination which frequently is nothing but a reverse proxy and so in principle has no business messing with payload like HTTP-01 requires. However for nginx at least this is awkward as nginx doesn’t support it.
    
    source
- nialv7@lemmy.world ⁨2⁩ ⁨days⁩ ago
  
  our org forbids plain http
  
  is redirecting http to https also out of the question? because let’s encrypt HTTP-01 accepts http -> https redirects:
  
  Our implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and only to ports 80 or 443. It does not accept redirects to IP addresses. When redirected to an HTTPS URL, it does not validate certificates.
  
  source
  - jj4211@lemmy.world ⁨2⁩ ⁨days⁩ ago
    They in fact refuse to even do a redirect… it’s monumentally stupid and I’ve repeatedly complained, but ‘security’ team says port 80 doing anything but dropping the packet or connection refused is bad…
    
    source
    nialv7@lemmy.world ⁨2⁩ ⁨days⁩ ago
    oh my god
    
    source
- Routhinator@startrek.website ⁨2⁩ ⁨days⁩ ago
  Can’t use DNS?
  
  source
  - jj4211@lemmy.world ⁨2⁩ ⁨days⁩ ago
    The same screwed up IT that doesn’t let us do HTTP-01 challenges also doesn’t let us do DNS except through some bs webform, and TXT records are not even vaguely in their world.
    
    It sucks when you are stuck with a dumber broad IT organization…
    
    source
    Routhinator@startrek.website ⁨2⁩ ⁨days⁩ ago
    Yikes. I feel for you man.
    
    source
    StopSpazzing@lemmy.world ⁨2⁩ ⁨days⁩ ago
    Wow…
    
    source
Mikelius@lemmy.ml ⁨3⁩ ⁨days⁩ ago
I’ve got it setup automated on all my external domains, but trying to automate it on my internal-only domain is rather tedious since not only do I NOT want to open a port for it to confirm, but I have 2 other devices/services on the network not behind my primary reverse proxy that share the same cert.

What In need to do is setup my own custom cron that hits the hosting provider to update the DNS txt entries. Then I need to have it write and restart the services that use the cert. I’ve tried to automate this once before and it did not go so smoothly so I’ve been hesitant on wasting time to try it again… But maybe it’s time to.

What would be ideal is if I could allow it to be automated just by getting a one time dns approval and storing a local private/public key to prove to them that I’m the owner of the domain or something. Not aware of this being possible though.

source
- nialv7@lemmy.world ⁨2⁩ ⁨days⁩ ago
  Depends on which DNS service you are using, a plugin might already exist that would do it for you. e.g. I use cloudflare for DNS and certbot is able to automatically set the txt record.
  
  source
- Limonene@lemmy.world ⁨2⁩ ⁨days⁩ ago
  For internal stuff, it may be easier to set up your own CA.
  
  source
bss03@infosec.pub ⁨3⁩ ⁨days⁩ ago
Technically my renews aren’t automated. I have a nightly cronjob that should renew certificates and restart services, but when the certificates need renewal, it always fails because it wants to open a port I’m already using in order to answer the challenge.

I hear there’s an apache module / configuration I can use, but I never got around to setting it up. So, when the cron job fails, I get an email and go run a script that stops apache, renews certs, and restarts services (including apache). I will be a bit annoying to have to do that more often, but maybe it’ll help motivate me to configure apache (or whatever) correctly.

Debian Stable

source
- eclipse@lemmy.world ⁨3⁩ ⁨days⁩ ago
  You could try using the DNS challenge instead; I find it a lot more convenient as not all my services are exposed.
  
  source
  - bss03@infosec.pub ⁨2⁩ ⁨days⁩ ago
    While I do have some control over my DNS and can create arbitrary TXT entries, I can’t to that in an automated way easily. I’m using Gandi.net to host my DNS rather than running my own DNS sever(s).
    
    source
- Limonene@lemmy.world ⁨2⁩ ⁨days⁩ ago
  The usual way for me is to give certbot write access to a directory in the HTTP root, so the server can keep running.
  
  source
Zanathos@lemmy.world ⁨3⁩ ⁨days⁩ ago
While I agree for my personal use, it’s not so easy in an enterprise environment. I’m currently working to get services migrated OFF my servers that utilize public certificates to avoid the headache of manual intervention every 45 days.

While this is possible for servers and services I manage, it’s not so easy for other software stacks we have in our environment. Thankfully I don’t manage them, but I’m sure I’ll be pulled into them at some point or another to help figure out the best path forward.

The easy path is obviously a load balanced front-end to load the certificate, but many of these services are specialized and have very elaborate ways to bind certificates to services outside of IIS or Apache, which would need to trust the newly issued load balancer CA certificate every 47 days.

source
- fatalicus@lemmy.world ⁨3⁩ ⁨days⁩ ago
  Yeah, this has become an issue for us at work as well.
  
  Currently we are doing a POC for an in-house developed solution where a azure function app handles the renewal of certificates for any domain we have, both wildcard and named, and place the certificates in a key vault where services that need them can get access.
  
  Looks to be working, so the main issue now is finding a non-US certificate provider that supports acme. EU has some but even more local there aren’t many options.
  
  source
merc@sh.itjust.works ⁨3⁩ ⁨days⁩ ago
I’m using automated renewals.

But, that just means there’s a new cert file on disk. Now I have to convince a half a dozen different apps to properly reload that changed cert. That means fighting with Systemd. So Systemd has won the first few skirmishes, and I haven’t had the time or energy to counterattack. Now instead of having to manually poke at it 4x per year, it’s going to be closer to once a month. Ugh.

source
- nialv7@lemmy.world ⁨2⁩ ⁨days⁩ ago
  Half a dozen sounds like a lot, kinda curious what you are running? If they all are web services maybe use a reverse proxy or something?
  
  source
  - merc@sh.itjust.works ⁨2⁩ ⁨days⁩ ago
    Web services, and then various components of an email system.
    
    source
    JadedBlueEyes@programming.dev ⁨2⁩ ⁨days⁩ ago
    If you have the time to set it up, Stalwart can manage its own cert renewal.
    
    source
    -> View More Comments
- NotMyOldRedditName@lemmy.world ⁨3⁩ ⁨days⁩ ago
  Don’t worry, they’ll sell you new software for another $50.00/m to help with the new certificate fiddling you now have to do monthly.
  
  source
- eclipse@lemmy.world ⁨3⁩ ⁨days⁩ ago
  You could try a path unit watching the cert directory (there are caveats around watching the symlinks directly) or most acme implementations have post renewal hooks you can use which would be more reliable.
  
  source