Hacker News Reader

Comment by dextercd | Hacker News Reader

Let's Encrypt lists 10 ACME clients for Windows / IIS.

If an organisation ignores all those options, then I suppose they should keep doing it manually. But at the end of the day, that is a choice.

Maybe they'll reconsider now that the lifetime is going down or implement their own client if they're that scared of third party code.

Yeah, this will inconvenience some of the CA/B participant's customers. They knew that. It'll also make them and everyone else more secure. And that's what won out.

The idea that this change got voted in due to incompetence, malice, or lack of oversight from the companies represented on the CA/B forum is ridiculous to me.

View on HN

> Let's Encrypt lists 10 ACME clients for Windows / IIS.

How many of those are first-party/vetted by Microsoft? I'm not sure you understand how enterprises or secure environments work, we can't just download whatever app someone found on the Internet that solves the issue.

No idea how many are first-party or vetted by Microsoft. Probably none of them. But I really, really doubt you can only run software that ticks one of those two boxes.

Certify The Web has a 'Microsoft Partner' badge. If that's something your org values, then they seem worth looking into for IIS.

I can find documentation online from Microsoft where they use YARP w/ LettuceEncrypt, Caddy, and cert-manager. Clearly Microsoft is not afraid to tell customers about how to use third party solutions.

Yes, these are not fully endorsed by Microsoft, so it's much harder to get approval for. If an organisation really makes it impossible, then they deserve the consequences of that. They're going to have problems with 397 day certificates as well. That shouldn't hold the rest of the industry back. We'd still be on 5 year certs by that logic.

[flagged]

Stealing a private key or getting a CA to misissue a certificate is hard. Then actually making use of this in a MITM attack is also difficult.

Still, oppressive states or hacked ISPs can perform these attacks on small scales (e.g. individual orgs/households) and go undetected.

For a technology the whole world depends on for secure communication, we shouldn't wait until we detect instances of this happening. Taking action to make these attacks harder, more expensive, and shorter lasting is being forward thinking.

Certificate transparency and Multi-Perspective Issuance Corroboration are examples of innovations without bothering people.

Problem is, the benefits of these improvements are limited if attackers can keep using the stolen keys or misissued certificates for 5 years (plus potentially whatever the DCV reuse limit is).

Next time a DigiNotar, Debian weak keys, or heartbleed -like event happens, we'll be glad that these certs exit the ecosystem sooner rather than later.

[flagged]

Can you please follow the site guidelines when posting to HN, regardless of how wrong anyone else is or you feel they are? You broke them more than once in this thread (e.g. in this comment, in https://news.ycombinator.com/item?id=43698063, and arguably in your root post to the thread too - https://news.ycombinator.com/item?id=43687459).

I'm sure you have legit reasons to feel strongly about the topic and also that you have substantive points to make, but if you want to make them on HN, please make them thoughtfully. Your argument will be more convincing then, too, so it's in your interests to do so.

Reply on news.ycombinator.com