Hacker News Reader

Comment by jaywalk | Hacker News Reader

If Let's Encrypt went away tomorrow, I'd Google "free SSL certificate" and find somebody else. Worst case, I'd either go back to the old way and buy a cheap certificate or go without SSL until a new free option comes along.

View on HN

The hits for "free SSL certificate" certainly won't be able to issue 200M certs in a day.

AWS ACM is free-as-in-complimentary-peanuts, and I'd bet they could handle a pretty big chunk, although 2000rps for a request that's calling external services and cryptographically signing things is a bit intimidating.

That's only viable if you're using AWS's load balancers or CDN, though.

You can also use ACM certificates directly on nitro-powered EC2 instances too

https://docs.aws.amazon.com/enclaves/latest/user/nitro-encla...

Honest question (I know just enough about SSL to be dangerous): Does certificate pinning throw a wrench in this plan?

If proper revoking procedures are being followed, no.

You can start reading more info here: https://developer.mozilla.org/en-US/docs/Web/Security/Certif...

(HPKP is considered obsolete, if by cert pinning you meant that. If you're confusing HSTS with HPKP, just know that HSTS makes it much harder to mistakenly access the site via http, while HPKP [now deprecated] is the practice of ensuring some hashes is found in the cert that the server sends to mitigate some attacks)

At this point, I don't think certificate pinning in the general internet/web environment is a thing.

Agreed. I MITM all my own traffic and I only have to exclude a handful of domains or A records on domains to not MITM.

Honestly curious, why do you MITM all your own traffic? For detailed logging?

Logging, ACL's for some mime types, overriding cache controls, shared cache for multiple devices, blocking some sites that I can't block using DNS.

> shared cache for multiple devices

Oh, that’s a neat one and would be very valuable for me. We have poor internet access at home and would be cool to reduce traffic going out to the net.

Thanks for the reply, appreciate it!

No problem. You can find examples of how to set up Squid-SSL-Bump or I can provide examples if you can't find any.

Before choosing to use pinning you should have planned for this situation. Rather than write it out here, I'll link a post I wrote in a Let's Encrypt forum in response to someone who'd just blown up their system due to a different pinning mistake.

https://community.letsencrypt.org/t/certificate-failure-due-...

Please don't enforce certificate pinning in user-facing software, at least without an opt-out. It becomes impossible to inspect my own traffic.

It also leads to a ton of clients who freak out when their app suddenly goes offline because they forgot to update the pinned cert. Seen that one countless times.

Pinning has uses, but if I'm running an app, I'm not doing pinning unless I have to.

Pinning to the issuing or root is much safer from an availability standpoint.

Just manually encrypt everything and you're good lol

Reply on news.ycombinator.com