Hacker News Reader

Out of curiosity: why isn't it realistic for every company?

Some systems aren't internet connected 24/7 and thus not able to autorenew all the time.

Not a problem if someone has to do it manually every year or two years, but it becomes a bigger issue if you need to renew a cert every 30 days.

Also, some systems are internal only, so can't use http-01 validation.

We have a bunch of these like this, so for our "foo.int.example.com" systems, in our public DNS we have a CNAME pointing to "foo.int.dnsauth.example.com", and have set up a new DNS infrastructure so that we can use dns-01 validation of TXT records there:

* https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode

* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

I had no idea that this functionality existed until fairly recently.

And the DNSSEC is authenticated with how often renewed certificate?

If there's no DNSSEC, this is entirely worthless. DNS is very easy to attack.

CAs are in general CT-logged now, and major sites all monitor the CT logs (hell, even small sites do at this point). If it's so easy to attack DNS to achieve misissuance, why isn't it happening all the time?

It is, some people just think making them hire better engineers and fix shitty infra is too hard

Reply on news.ycombinator.com