Thoughts, Any Forums?

Thoughts, Any Forums?

Attached: le-logo-twitter-noalpha.png (640x640, 24.05K)

Other urls found in this thread:

michael.orlitzky.com/articles/lets_not_encrypt.xhtml
twitter.com/SFWRedditGifs

No. My head is empty.

honeypot

🤔

Certbot just werks.

Fucking garbage. We should use self-signed certificates for TLS

michael.orlitzky.com/articles/lets_not_encrypt.xhtml

Why do I have to ask someone else's permission to use https in my home lab?

I'm all for getting something better than the current CA infrastructure we use for HTTPS/TLS because it is flawed due to CA compromise (I use a local CA for anything TLS in my home network to avoid the flaws but a typical public website shouldn't do this because it doesn't help the current situation).
But suggesting trust-on-first-use like what SSH uses by default for the web is stupid. TOFU's security model relies on you having secure access to the server on first use to check that the host key fingerprint is correct (eg. you have a server at home connected to a keyboard and monitor, and you can see their host key fingerprint on the monitor, and therefore know it's identical with the host key fingerprint shown on the client upon first connecting).
If I wanted to go on a random website for the first time, I'd need to meet them in person to get their host key fingerprint, which is absolutely not happening.

>muh mitm
Good luck MITMing between LE servers and my cloud provider. MITM is performed near the client, not the server.
>auto renew bad
Automatic renewal is THE way to go nowadays. Manually installing certificates is a fool's errand. If your tool is not reliable enough to give you a correct certificate every time, the solution is to get a tool that works or fix it, not replace the tool with manual labor.