Leebra technology
login register

Let's Encrypt Announces New-Certificate-Every-6-Days Offering

2 years ago by misk to c/technology

save

share

report

This letter was originally published in our 2024 Annual Report. The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent security and stability. Our understanding of what it will take to make more privacy-preserving metrics more mainstream via our Divvi Up project is evolving in important ways.
load all comments
hsdkfr734r 90 points 2 years ago

When I look at the default list of trusted CAs in my browser, I get the feeling that certificate lifetimes isn't the biggest issue with server certificates.

save

path: 0 13995092, hotness: undefined, score: 90, children: 15
jagged_circle 0 points 2 years ago

Yes X.509 is broken. If you're a developer and not pinning certs, you're doing it wrong.

save

path: 0 13995092 13997562, hotness: undefined, score: 0, children: 12
stinky 8 points 2 years ago

What

save

path: 0 13995092 13997562 13999723, hotness: undefined, score: 8, children: 8
jagged_circle -5 points 2 years ago

What part are you confused about, and are you a developer?

Edit: why was I downvoted for asking this?

save

path: 0 13995092 13997562 13999723 13999755, hotness: undefined, score: -5, children: 7
semi 13 points 2 years ago

I'm a developer and would appreciate you going into more specifics about which certificates you suggest pinning.

save

path: 0 13995092 13997562 13999723 13999755 14002650, hotness: undefined, score: 13, children: 6
jagged_circle 6 points 2 years ago

I'm saying that if you're a developer of software that communicates between two nodes across the internet, you shouldn't rely on X.509 because the common root stores have historically been filled with compromised CAs, which would let someone with that CA decrypt and view the messages you send with TLS.

You should mint your own certs and pin their fingerprints so that your application will only send messages if the fingerprint of the cert on the other end matches your trusted cert.

save

path: 0 13995092 13997562 13999723 13999755 14002650 14004502, hotness: undefined, score: 6, children: 5
semi 7 points 2 years ago

OK, so cases where you control both ends of the communication. Thanks for the clarification.

save

path: 0 13995092 13997562 13999723 13999755 14002650 14004502 14009874, hotness: undefined, score: 7, children: 0
Pieisawesome 3 points 2 years ago

And your software stops functioning after X years due to this.

Don’t do this, this is a bad idea.

save

path: 0 13995092 13997562 13999723 13999755 14002650 14004502 14008723, hotness: undefined, score: 3, children: 3
technology
technology

@lemmy.world

login for more options
87360
21248
15760

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

go to feed...