I am amazed that Let's Encrypt has been around for 10 years.
I have used it for many years, but certainly not 10.
I still want to find time to deploy my own CA, but for most external-facing things, I just use Let's Encrypt, and I'm very pleased to be able to do so.
Rob Carlson
in reply to Neil Brown • • •Hugo Mills
in reply to Neil Brown • • •I, too, use Let's Encrypt.
And some day, I'd like to get back all the time that I used to spend generating my own CA, before LE came on the scene.
James Wells
in reply to Neil Brown • • •cacert.org
Welcome to CAcert.org
cacert.orgNeil Brown
in reply to James Wells • • •Amber
in reply to Neil Brown • • •Overview — Dogtag PKI documentation
www.dogtagpki.orgNeil Brown
in reply to Amber • • •JamesB
in reply to Neil Brown • • •Dustin Rue
in reply to Neil Brown • • •Shiri Bailem
in reply to Neil Brown • • •Neil Brown
in reply to Shiri Bailem • • •Shiri Bailem
in reply to Neil Brown • • •Shiri Bailem
in reply to Shiri Bailem • • •Neil Brown reshared this.
Jonathan McDowell
in reply to Shiri Bailem • • •silverwizard
in reply to Neil Brown • •Neil Brown
in reply to silverwizard • • •@silverwizard within the framework of the current approach, LE turned money for old rope into an easy to deploy, automatable, free convenience, IMHO.
Would it be ideal to change the system? Yes!
silverwizard
in reply to Neil Brown • •Neil Brown likes this.
Shiri Bailem
in reply to silverwizard • • •@silverwizard @Neil Brown has anyone actually established a better system really?
Not going to argue that LE doesn't have it's problems, or even just the underlying SSL system in general.
LE thanks to ease and being free without much "competition" it has the crucial problem of hosting far too high a proportion of the the certs for the whole internet.
SSL in general has the problem of CAs getting hacked and issuing fraudulent certs.
Only improvement I can think of in that security at all is maybe double-certified certificates? (require you to go through two wholly separate providers with the same key to have a valid key and requiring both to sign for any updates to go through and maybe a certificate chain for whenever it changes hands)
Beyond that it's always a cludge, people aren't going to check them themselves, they're not going to manage certificates themselves... so you just have a preauthed group of keys installed in your system, trust them to be above board, and then trust the providers of those keys to be above board. Honestly shocked we haven't had more issues, but that's kinda how security goes.
silverwizard
in reply to Shiri Bailem • •Shiri Bailem
in reply to silverwizard • • •silverwizard
in reply to Shiri Bailem • •Shiri Bailem
in reply to silverwizard • • •silverwizard likes this.
Jima
in reply to Neil Brown • • •Neil Brown
in reply to Jima • • •@jima
Neil-scale and enterprise-scale are very different beasts :)
Jima
in reply to Neil Brown • • •Roger Lipscombe
in reply to Neil Brown • • •there's nothing particularly technically complicated about deploying your own CA.
Here's mine: github.com/rlipscombe/elixir-c… (because OpenSSL has terrible UX).
The complicated bits are keeping the private keys safe, auto-renewal, deploying the root certs to your various devices, etc.
But if you want _other_ people to access your servers, you're pretty much restricted to Let's Encrypt (or spending money), because they're not gonna install random root certs.
GitHub - rlipscombe/elixir-certs: Certificate Authority, in Elixir, using 'x509' library
GitHubNeil Brown
in reply to Roger Lipscombe • • •@rogerlipscombe
No, indeed. I've done it before, and just need to find the time to set it up again, secure it, and perhaps automate distribution.
(Yes, only for me accessing my own stuff!)
Jim Flanagan
in reply to Roger Lipscombe • • •Jim Flanagan
in reply to Jim Flanagan • • •@rogerlipscombe The reason behind this outburst is that when you stand up CA, you do so with certain tacit assumptions about how the certificates will be used. These assumptions are brought to bear when you need to reason about the impact of changes to how the CA is operated
If certificates are outside your control, they are deployed with a different set of tacit assumptions. There’s nothing in an X.509 certificate that can effectively encode these assumptions
Jim Flanagan
in reply to Jim Flanagan • • •Jim Flanagan
in reply to Jim Flanagan • • •Jim Flanagan
in reply to Jim Flanagan • • •Roger Lipscombe
in reply to Jim Flanagan • • •@jimfl
Oh, for sure. Hard agree with almost all of that.
But there are scenarios (such as I think Neil's talking about) where you control the CA and the clients, and you are small enough to retain effective control but also small enough that you don't want to deal with the extra complexity.
Of course, once you get to a certain size, you should absolutely use something better, whether it's Let's Encrypt, a paid-for CA or (internal service stuff) cert-manager.
Jim Flanagan
in reply to Roger Lipscombe • • •@rogerlipscombe
> Hard agree with almost all of that.
This sounds like an opportunity for me to learn something
Roger Lipscombe
in reply to Jim Flanagan • • •@jimfl
Nothing specific, no. Just the lack of nuance. To be clear: in a lot of scenarios (particularly security) you don't *want* nuance; you want nailed-down rules.
So that's not a slight against anything you've said. Please don't take it as one.
But: for someone like Neil, who's (I assume) just tinkering, running his own CA is relatively immune from mission creep.
I run my own CA... in my *homelab*. In my dayjob, I'm not touching that stuff with a bargepole. I'll pay someone else.
Neil Brown
in reply to Roger Lipscombe • • •@rogerlipscombe @jimfl
Sort of - for some things, I use self-signed certs, so this would just be a step up from that.