Comment on Decreasing Certificate Lifetimes to 45 Days
vzqq@lemmy.blahaj.zone 1 week agoDude, you need to figure out a way to automate that. It’s no way to live.
Comment on Decreasing Certificate Lifetimes to 45 Days
vzqq@lemmy.blahaj.zone 1 week agoDude, you need to figure out a way to automate that. It’s no way to live.
embMaster@lemmy.world 1 week ago
I agree, but it’s impossible to convince my less tech savy roommates and friends to let me install a root certificate. “That sounds like i could read all their private messages”, lol. Just let me have my certificate for https in my local net. I don’t need to be “even more” secure. I get that that’s necessary for public services, but surely not for local selfhosting. I don’t even have a port open other than wireguard. And i would not even care “if a roommate hacks/gets access to a guests voice commands for home assistant.” (Not complaining at you but at this trend. I do think my use case is valid)
You are gonna laugh if i tell you how i partly automated this workaround. A script changes the (dyn) dns entries of all subdomains to point to my public server in a datacenter. There, it ssh’s in and requests the certificates with certbot. Then, it restores the dns entries and downloads and installs the certificates in the local net. Still requires manual supervision and sometimes intervention. My domains do not support automated dnssec. I don’t have time to secure my local net enough to feel good about opening ports. If all certificate lifetimes get shorter, i’ll either have to switch my domain provider or give up selfhosting for other people.
bearboiblake@pawb.social 1 week ago
Allowing a certificate without proper validation for local only networks is a terrible, terrible idea. I could super easily use this as a loophole to set up a honeypot public free wi-fi, redirect all traffic through a reverse proxy and man-in-the-middle every single HTTPS connection, effectively allowing me to harvest everyone’s passwords in a really quick and easy way.
Just use DNS verification. It’s not that hard.
helvetpuli@sopuli.xyz 1 week ago
I’ve had dns-01 validation running for a while now. It’s not difficult, just a paradigm shift. I spent a minute just now looking for a concise how-to for you and didn’t find one, so I suppose I’ll have to write it.
I’ll bookmark this comment so I can find you once I’ve done that.