Hacker News Reader

Comment by jraph | Hacker News Reader

The decreasing validity time pushes for the process to be automated, and automation reduces the possible human errors.

Many things need to be run and automated when running stuff, I don't understand what makes SSL certificates special in this.

For a hobbyist, setting up certbot or acme.sh is pretty much fire and forget. For more complex settings well… you already have this complexity to manage and therefore the people managing this complexity.

You'll need to pick a client and approve it, sure, but that's once, and that's true for any tool you already use. (edit: and nginx is getting ACME support, so you might already be using this tool)

It's not the first time I encounter them, but I really don't get the complaints. Sure, the setup may take longer. But the day to day operations are then easier.

View on HN

> The decreasing validity time pushes for the process to be automated, and automation reduces the possible human errors.

There are environments and devices where automation is not possible: not everything that needs a cert is a Linux server, or a system where you can run your own code. (I initially got ACME/LE working on a previous job's F5s because it was RH underneath and so could get Dehydrate working (only needs bash, cURL, OpenSSL); not all appliances even allow that).

I'm afraid that with the 47-day mandate we'll see the return of self-signed certs, and folks will be trained to "just accept it the first time".

In these setups, the issue already exists: an appliance would have to renew its SSL certificate when it expires. I believe ssl certificates should already not be used anywhere they can't be renewed.

There's a difference between having to renew annually and having to do it every 47 days:

* https://news.ycombinator.com/item?id=43693900

For an appliance, if you embed a 1 year certificate that can't be renewed, the feature will stop working correctly after a year. That's already quite short. And if it can be renewed, then it can also most probably be renewed every month no problem.

You linked to a whole thread in which the top comment asks a question that's a slippery slope, and of which the top answer lists advantages of a reduced validity time (while pointing out that too short like 30 seconds poses reliability and scale risks, to address the slippery slope argument).

What did you mean to point out?

One of the arguments to be made is that while " automation reduces the possible human errors." it also reduces the amount of human oversight as well.

Do you really need more oversight on renewals than a simple success/failure notification?

For new certificate you can keep the existing amount of human oversight in place so nothing changes on that front.

Yes, because you want to know what certificates you're issuing. You could be automatically issuing and deploying certs on a system where the actual app was decommissioned. It's probably mostly a risk for legacy systems where the app gets killed, but the hardware stays live and potentially unpatched and is now vulnerable to a hacker taking it over.

With manual renewals, the cert either wouldn't get renewed and would become naturally invalid or the notification that the cert expired would prompt someone to finish the cleanup.

This is what Certificate Transparency is for. If you want to know what publicly trusted certificates are being issued for whatever domains are of interest to you, that's how you find out. It has the important advantage of always working no matter how heterogeneous your stack is; the clients that request certificates do not need to be connected to any particular notification system.

Then you set up a process to monitor the certs that have been issued.

No better way to create errors at scale than automation ;-)

Oversight over… what exactly? TLS certificates don't need human oversight. If you want to see which certificates have been issued for your domains, set up certificate transparency monitoring. But thank goodness we're past paying people for comparing certificate checksums.

Schrödinger's certificates are so mundane they don't need human oversight, but are so precious they need to be renewed every 47 days

Your point is..? That applies to a lot of automatically maintained infrastructure, and it works just fine.

Reply on news.ycombinator.com