Ask HN: HSTS vs. Letsencrypt | Hacker News Reader

Ask HN: HSTS vs. Letsencrypt

5 pointssschueller7 comments

The HSTS standard generally recommends an expiration of 6 months or more which was fine when certificates issued were valid for one year or more.

However with LE we now have certificates that are valid for 3 months. If we are unable to renew a certificate the HSTS header becomes an issue. In fact IMO the HSTS header should shorten by the days until the certificate is renewed to avoid this.

The issue I have is that all these "security" tests (that customers run) will moan that an HSTS is shorter than 6 months and deduct heavily from a score.

What are your opinions on the HSTS header and how do you deal with it if you are using LE?

View on HN

> The issue I have is that all these "security" tests (that customers run) will moan that an HSTS is shorter than 6 months and deduct heavily from a score.

There's a few ways to solve this:

Option 0) accept that in the case of a long enough LE outage[1], you'll be able to find another certificate issuer, or the carnage will be enough that HSTS is turned off in a browser update. Or it's related to some event in which you're going to be majorly disrupted anyway (you mentioned sanctions), and websites are not high on the priority list of concerns.

Option 1) detect the security testers and serve them an HSTS max-age that satisfies them, but serve other user-agents a max-age that satisfies you.

Option 2) serve 6 month HSTS on / which is used for tests; server something else on other resources. Also make sure / includes references to other resources that won't be cached. Last header served to the user-agent wins.

[1] I think most LE clients try to automatically renew once a day starting at 1 month away from expiration? so a one month outage is sufficient. There are other no-cost ACME issuers, and some ACME clients can be configured to have a priority list of issuers, so if your preferred option doesn't work, you can use another one.

You seem to be confusing pinning with hsts.

If there's a crisis that means you can no longer use LE, you can just buy a valid cert from another provider andlive up to what you were telling on hsts that way.

Indeed. HSTS doesn’t care about the cert, as long as it’s valid.

The issue I have is that it isn't just one cert. It's hundreds, manually purchasing those would be a huge untertaking.

In what way would HSTS be related to the lifecycle of a certificate?

If for example I am no longer able to generate new certificates (too many at a time, some sort of sanctions not permitting it or LE is down for 3 months etc. etc.).

HSTS requires that I am able to get a certificate, even thought very unlikely that I would not be able too there is that possibility.

How are your worries over LE being down for 3 months any different from another provider being down when you try to renew?

LE's setup for automation - if you've got your renewals schedule properly, you should "never" miss a renewal (you can renew several days (I forget how many) before expiration)

Reply on news.ycombinator.com