192
Sysadmins slam Apple’s SSL/TLS cert lifespan cuts (www.theregister.com)
submitted 2 years ago by to c/technology@lemmy.world
81 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 67 points 2 years ago (21 children)

I'm sorry, but has no-one heard of https://letsencrypt.org that issues certificates via API for free?

I would not be surprised if certificates at some point will be issued for each session.

  • permalink
  • fedilink
  • source
  • hideshow 21 child comments
    •
  • [–] 72 points 2 years ago (9 children)

    I'm sorry, but have you ever needed to manage some certificates for a legacy system or something that isn't just a simple public facing webserver?

    Automation becomes complicated very quickly. And you don't want to give DNS mutation access to all those systems to renew with DNS-01.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 51 points 2 years ago (2 children)

    Ahh yes the: we can't have self signed certificates for security reasons but also can't open up the environment to the web, and we dont have our own CA server, trifecta.

    Solution: awkward, manual, certificate import process from a 3rd party vendor.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 24 points 2 years ago (1 child)

    Even if you have an internal CA, few appliances support this kind of automation. At best, they have an API, and you get to write that automation yourself for each appliance.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 21 points 2 years ago (5 children)

    You can delegate to isolated nameservers with DNS-01, there's no need to have control over the primary zone: https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 19 points 2 years ago (4 children)

    Yes, and that is where we enter the complicated territories..

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] -2 points 2 years ago (3 children)

    How complicated is it to have a CNAME? /s

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 11 points 2 years ago

    If you think it's just too easy but people are still discussing it, please entertain the notion that you may have oversimplified the situation in your assessment and that as assumptions become clarified you may yet soon understand a horror that apple can't quite grok.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago (1 child)

    Did we read the same article? DNS-01 challenges require updates to DNS. This means you need an API for your DNS. This means you now have to worry about DNS permissions in your application cert workflow. We’ve just massively increased blast radius! Or you could do it manually but that’s already failed.

    All of this is straightforward with infrastructure-as-code. While I don’t struggle with that, I’ve watched devs and sysadmins both stare blankly at this kind of thing for days at a time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago

    Updates to DNS, yes. Not necessarily to your primary zone. In other words, you don’t need access to the name servers for your highly privileged example.com zone, only the nameservers for inconsequential.example.com. With the challenge delegation you can easily narrow the scope by CNAMEing the relevant _acme-challenge enries in your primary domain once. This not only removes the need for the validator to modify your primary zone, but also scopes what subdomains it can validate, too. So the blast radius decreases.

    I, too, maintain several devices that insist on having the certificates (and keys, yuck) being fed to them by hand. I automated it all, because I don’t see why a human should be in a loop of copying the secret material. Automaton is good.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 2 years ago (6 children)

    It's not the issuance that's the headache, it's the installation. There are more things that need valid certs than just webservers

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [+] -8 points 2 years ago (5 children)

    Certbot is basically automatic, think mines on a cronjob now.

    Who actually does this shit manually?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 10 points 2 years ago (3 children)

    This has a lot of "I can use the bus perfectly fine for my needs, so we should outlaw cars" energy to it.

    There are several systems, like firewalls , switches, routers, proprietary systems and so on that only has a manual process for updating, that can't be easily automated.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 2 years ago* (2 children)

    With 45 day certs it will get that functionality real fast

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago (1 child)

    AWS makes this impossible in a few places such as a fair number of ACM use-cases.

    I think your cert-per-session idea is interesting. We’d need significant throughput and processing boosts to make that happen, probably at least on the order of 10X computing speeds and 10X transmission speeds across the board minimum. These operations are computationally intense and add data to the wire so, for example, a simple Lemmy server with hundreds of users slows to a crawl and a larger site eg Mastodon goes to dialup speeds or worse. You can test at home by trying to generate an x509 self-signed cert before connecting to a website every time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago

    Well AWS ACM already automates this, so if the renewal period gets shortened, I'm guessing that this will be updated to suit, unless I'm misunderstanding your point.

    I hadn't considered the CPU load, but that's a fair point. I'm guessing that a suitable piece of code will utilise specialised hardware, or perhaps leverage the GPU or just in time SSL certificates will become a thing.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago (1 child)

    Does not work well for large corporate roll outs. Last I checked no way to auto-enroll on a NetScaler or an F5

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago
  • permalink
  • fedilink
  • source
  • parent