▲ 192 ▼ Sysadmins slam Apple’s SSL/TLS cert lifespan cuts (www.theregister.com) submitted 2 years ago by misk@sopuli.xyz to c/technology@lemmy.world 81 comments fedilink hide all child comments
[–] farcaller@fstab.sh -2 points 2 years ago (3 children) How complicated is it to have a CNAME? /s permalink fedilink source parent hideshow 3 child comments replies: [–] corsicanguppy@lemmy.ca 11 points 2 years ago If you think it's just too easy but people are still discussing it, please entertain the notion that you may have oversimplified the situation in your assessment and that as assumptions become clarified you may yet soon understand a horror that apple can't quite grok. permalink fedilink source parent [–] thesmokingman@programming.dev 2 points 2 years ago (1 child) Did we read the same article? DNS-01 challenges require updates to DNS. This means you need an API for your DNS. This means you now have to worry about DNS permissions in your application cert workflow. We’ve just massively increased blast radius! Or you could do it manually but that’s already failed. All of this is straightforward with infrastructure-as-code. While I don’t struggle with that, I’ve watched devs and sysadmins both stare blankly at this kind of thing for days at a time. permalink fedilink source parent hideshow 1 child comment replies: [–] farcaller@fstab.sh 1 point 2 years ago Updates to DNS, yes. Not necessarily to your primary zone. In other words, you don’t need access to the name servers for your highly privileged example.com zone, only the nameservers for inconsequential.example.com. With the challenge delegation you can easily narrow the scope by CNAMEing the relevant _acme-challenge enries in your primary domain once. This not only removes the need for the validator to modify your primary zone, but also scopes what subdomains it can validate, too. So the blast radius decreases. I, too, maintain several devices that insist on having the certificates (and keys, yuck) being fed to them by hand. I automated it all, because I don’t see why a human should be in a loop of copying the secret material. Automaton is good. permalink fedilink source parent
[–] corsicanguppy@lemmy.ca 11 points 2 years ago If you think it's just too easy but people are still discussing it, please entertain the notion that you may have oversimplified the situation in your assessment and that as assumptions become clarified you may yet soon understand a horror that apple can't quite grok. permalink fedilink source parent
[–] thesmokingman@programming.dev 2 points 2 years ago (1 child) Did we read the same article? DNS-01 challenges require updates to DNS. This means you need an API for your DNS. This means you now have to worry about DNS permissions in your application cert workflow. We’ve just massively increased blast radius! Or you could do it manually but that’s already failed. All of this is straightforward with infrastructure-as-code. While I don’t struggle with that, I’ve watched devs and sysadmins both stare blankly at this kind of thing for days at a time. permalink fedilink source parent hideshow 1 child comment replies: [–] farcaller@fstab.sh 1 point 2 years ago Updates to DNS, yes. Not necessarily to your primary zone. In other words, you don’t need access to the name servers for your highly privileged example.com zone, only the nameservers for inconsequential.example.com. With the challenge delegation you can easily narrow the scope by CNAMEing the relevant _acme-challenge enries in your primary domain once. This not only removes the need for the validator to modify your primary zone, but also scopes what subdomains it can validate, too. So the blast radius decreases. I, too, maintain several devices that insist on having the certificates (and keys, yuck) being fed to them by hand. I automated it all, because I don’t see why a human should be in a loop of copying the secret material. Automaton is good. permalink fedilink source parent
[–] farcaller@fstab.sh 1 point 2 years ago Updates to DNS, yes. Not necessarily to your primary zone. In other words, you don’t need access to the name servers for your highly privileged example.com zone, only the nameservers for inconsequential.example.com. With the challenge delegation you can easily narrow the scope by CNAMEing the relevant _acme-challenge enries in your primary domain once. This not only removes the need for the validator to modify your primary zone, but also scopes what subdomains it can validate, too. So the blast radius decreases. I, too, maintain several devices that insist on having the certificates (and keys, yuck) being fed to them by hand. I automated it all, because I don’t see why a human should be in a loop of copying the secret material. Automaton is good. permalink fedilink source parent