Inefficient management of SSL certificates leading to frequent outages and security risks

Signals over time

2 observed signals across 1 sources, tracked for 5 days. Confidence: low.

What people are saying Observed

• “Even if your own personal key handling security measures are better than the security of your domain registrar, which I seriously doubt is the case for most people who handle certificates, the impact of an attacker managing to obtain your real long-lived cert is significantly worse. An attacker who manages to get a cert provider to mint a new certificate for your domain might be able to appear legitimate, but remember that it's a new cert, not an identical one to the cert you already have. You as the domain owner can easily detect this new cert was created using CT logs and visitors to your site can potentially detect the cert prematurely changed or they see two certs for the same domain depending on whether the attacker can convince them to only visit the spoofed site. Short lived certificates also mean the attacker must execute their new cert attack frequently if they want longer term success. On the other hand, an attacker who manages to penetrate your impenetrable personal cert management security measures now has the real cert they can use to pretend to be you for as long as your certificate is good for. And unless you detected their one-time break-in, there is no way for”

  Hacker News · frustration

• “Agreed, there is a problem with how certs are managed in large organizations. Many believe a Wildcard cert is a license to copy the same private key and cert everywhere. They have no problem copying their single private key to budget VPS services or foreign providers who are known CLOUD and collection program participants, the same private key used for "high security" on premise servers. Also amusing to see some organizations using ACME cert tools manually on each and every server in fleets of 10 to 100, every 80 days or so, when they remember to do so. Outages tend to be pretty frequent due to missed renewals. The only solution is automation, whether with an off the shelf ACME client with a cron job or a more complete automation platform. Let's Encrypt is not the only CA that supports automation, there are quite a few that support ACME or other nonstandard APIs. There is almost no setup that cannot be fully automated: legacy web servers, hardware load balancers, cloud load balancers, etc. It is also absolutely possible to automate OV and EV renovation if an organization insists on these "fancy" certs, which are frankly irrelevant to security because browse”

  Hacker News · complaint