Hacker News Reader

Comment by londons_explore | Hacker News Reader

This is a good start...

But I think it would be far better for them to focus on alerting webmasters if someone does manage to get a new certificate issued for a domain before the old one expires.

Certbot should reference the old certificate when doing a renewal. If someone registers a new certificate while an old one is valid and without referencing the old one, the owner of the old certificate should be notified loudly (sms, different-domain email, etc). Same if they register a certificate through a different provider.

Today all of the above is possible with certificate transparency logs, but nobody looks in them, so they're useless.

View on HN

>Today all of the above is possible with certificate transparency logs, but nobody looks in them, so they're useless.

I check mine once or twice a month manually, but it is pretty trivial to monitor it automatically as well, e.g. there are APIs for crt.sh or they even offer direct public read access to their database.

I believe certificate users should remain responsble for their own monitoring. Alerting as you say would be very annoying since you couldn't preemptively replace certs without getting alerted unecesarily, and it would divert Let's Encrypt developer resources away from more useful projects.

> very annoying since you couldn't preemptively replace certs

You would sign your request for a new cert with the private key of your old cert, proving you are the same person, which would suppress the alert.

Obviously the key provisioning tooling would do that automatically, so you needn't do it manually.

I built this project to make such automated monitoring easier:

https://ctadvisor.lolware.net

Love the site, great sense of humor.

Wish you all the best with this project.

Many thanks! And thank you to the people that signed up to try it out.

Seems like a great solution, I will test it for a few domains.

Multi domain registration could be nicer ;)

Maybe you actually need the security, but a lot of people just got certificates to avoid browser warnings. Saying every non-technical guy with a blog they update once a year should set up their own monitoring is a ridiculous ask.

https://developers.facebook.com/tools/ct/

You can check your domains there or subscribe for email notifications.

Many LetsEncrypt users are one-man shops or side project owners, they don't WANT another burden like monitoring certificates that doesn't add to the bottom line (yes, I know a non-working certificate will be very painful for a side project).

How can someone "reference" an old certificate with CT data? CT logs only contain precerts and certs, right?

I suppose one could compare the public key of two leaf certificates, but reusing the private key is also a bad practice.

From CA end, it could check if the certificate is requested from the same account key. One can even use a DNS record to public the account keys (CAA + TLSA).

Reply on news.ycombinator.com