Are you currently using #Cockpit with the builtin self-signed #TLS #certificate fallback? We would like to deprecate this, but need your input for that. Thank you in advance!
https://github.com/cockpit-project/cockpit/discussions/21695

Are you currently using #Cockpit with the builtin self-signed #TLS #certificate fallback? We would like to deprecate this, but need your input for that. Thank you in advance!
https://github.com/cockpit-project/cockpit/discussions/21695
#TLS
Tadam ! Bientôt Let's Encypt pourra signer des certificats pour des adresses IP (et pas juste des noms). https://github.com/letsencrypt/boulder/pull/8020
Let's Encrypt soon starts offering TLS certificates with just 6 days of lifetime. It's just an option and the 90 day certs are also still offered but I doubt that this will add a lot of security.
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/
Based on the number of occasions, I already had problems with the 90days renewals in the past (software bugs and human error), I see this the value in this move rather sceptical.
More supply chain thoughts.
Let's Encrypt is based in the United States.
New releases
• Kitten (rolling release)
• @small-tech/https version 5.3.2
• Auto Encrypt version 4.1.3
OCSP support has been reinstated in the server so existing sites with Let’s Encrypt certificates provisioned prior to the removal of the OCSP stapling requirement will not fail to load in Firefox.
Kitten servers in production will automatically update to this version in a few hours. You can also sign in to the Kitten settings page on your server and do a manual update to update Kitten immediately.
Thanks to @stefan and @s1r83r for bringing this to my attention. (https://mastodon.ar.al/@aral/113969540950647873)
New Kitten release
• Upgrades to version 5.3.1 of @small-tech/https¹ which has version 4.1.2 of Auto Encrypt² that l removes OCSP stapling (because Let’s Encrypt has removed OCSP support).
Please upgrade your Kitten as soon as possible or any new Kitten servers you try to set up will fail and any certificate renewals for existing servers will start to fail in May.
(To upgrade, run `kitten update`. Your production servers will update automatically.)
Enjoy!
¹ https://www.npmjs.com/package/@small-tech/https
² https://www.npmjs.com/package/@small-tech/auto-encrypt
@small-tech/https version 5.3.0 released
• Uses Auto Encrypt 4.1.1 (removes OCSP stapling support because Let]s Encrypt has removed OCSP support).
https://www.npmjs.com/package/@small-tech/https
This module is a drop in replacement for Node HTTPS module that automatically handles TLS certificate provisioning and renewal both at localhost (via Auto Encrypt Localhost¹) and at hostname (via Auto Encrypt with Let’s Encrypt certificates²).
So, this is how you create a HTTPS server in Node.js that uses this module and automatically handles TLS certificate provisioning and renewal for you both at localhost (during development) and at hostname (during production):
```js
import https from '@small-tech/https'
const server = https.createServer((request, response) => {
response.end('Hello, world!')
})
server.listen(443, () => {
console.log(' Server running at https://localhost.')
})
```
(Yes, that’s it! I wrote a metric shit-tonne of meticulously-tested code so you don’t have to.) :)
Note that the localhost certificate support via Auto Encrypt Localhost is 100% JavaScript and does NOT rely on an external binary like mkcert or certutil.
Needless to say, Kitten³ uses this module under the hood and it’s a big part of why Domain⁴ can deploy servers so easily that don’t require any day-to-day maintenance.
In case you’re wondering why I’m spending so much time releasing all these modules, it’s because I believe in sharing every brick of the house I’m building so others can easily build different houses if they want to. I’m not saying that what I’m building with Kitten, Domain, and Place⁵ will be the end all be all of the Small Web⁶ (the peer-to-peer web). And I want others to be able to experiment by building their own tools without having to go through the grueling development process I’ve had to in the past six years to build basic infrastructure.
Enjoy!
¹ https://codeberg.org/small-tech/auto-encrypt-localhost
² https://codeberg.org/small-tech/auto-encrypt
³ https://kitten.small-web.org
⁴ https://codeberg.org/domain/app
⁵ https://codeberg.org/place/app
⁶ https://ar.al/2024/06/24/small-web-computer-science-colloquium-at-university-of-groningen/
Auto Encrypt version 4.1.1 released
Fixed:
• User agent string now includes the correct Auto Encrypt version (and the name fragment “auto-encrypt” instead of “acme”).
• Tests now send `Connection: close` header so they’re not tripped up by the default `keep-alive` introduced in Node 19.
Auto Encrypt version 4.1.0 released
• Removes OCSP stapling, as Let’s Encrypt is removing OCSP support.
If you’re already using Auto Encrypt upgrade before May or your certificate renewals will start to fail. Upgrade now if you want to get certificates for new domains as new certificate requests are already failing.
https://codeberg.org/small-tech/auto-encrypt#readme
Auto Encrypt automatically provisions and renews Let’s Encrypt TLS certificates on Node.js https servers (including Kitten¹, Polka, Express.js, etc.)
Regular Node.js HTTPS server (without Let’s Encrypt certificates):
```js
import https from 'node:https'
const server = https.createServer(…)
```
Auto Encrypt https server with automatic Let’s Encrypt certificates:
```js
import AutoEncrypt from '@small-tech/auto-encrypt'
const server = AutoEncrypt.https.createServer(…)
```
(Certificates are provisioned on first hit and automatically renewed 30 days before expiry.)
Just released Node Pebble version 5.1.1
• Updated to Pebble version 2.7.0.
• Now also supports macOS and arm64 (because Pebble itself does).
https://codeberg.org/small-tech/node-pebble
Node Pebble is a Node.js wrapper for Let’s Encrypt’s¹ Pebble² that:
• Downloads the correct Pebble binary for your platform.
• Launches and manages a single Pebble process.
• Returns a reference to the same process on future calls (safe to include in multiple unit tests where order of tests is undetermined)
• Automatically patches Node.js’s TLS module to accept Pebble server’s test certificate as well as its dynamically-generated root and intermediary CA certificates.
² “A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production certificate authority.” https://github.com/letsencrypt/pebble
So I guess Let’s Encrypt has decided what I’ll be working on today then…
https://letsencrypt.org/2024/12/05/ending-ocsp/
(They’re ending OCSP stapling support. I’ll be updating Auto Encrypt¹ to remove OCSP support and then update @small-tech/https, which uses it, along with Auto Encrypt Localhost² to provide seamless TLS support regardless of whether you’re working in development or in production, and then update Site.js³ – deprecated but still used to serve some of our own sites at Small Technology Foundation⁴ – and Kitten⁵, with the latest @small-tech/https.)
¹ https://codeberg.org/small-tech/auto-encrypt
² https://codeberg.org/small-tech/auto-encrypt-localhost
³ https://codeberg.org/small-tech/https
⁴ https://small-tech.org
⁵ https://kitten.small-web.org
If I would like to use relayd to add security headers and tls to my website hosted via httpd, is there any solution how to specify custom path to keypair to tls?
NEW VIDEO! - Configuring TLS on A FreeBSD Mail Server
#FreeBSD #Unix #OpenSource #tls #garyhtech
https://youtu.be/bmI6yrVyXaQ?si=V5eICUPuRWXpbYf4 via @YouTube
Looks like Russia is now blocking Cloudflare's Encrypted Client Hello traffic if:
- SNI is cloudflare-ech.com
- TLS ClientHelloOuter contains the "encrypted_client_hello" extension
https://github.com/net4people/bbs/issues/417
Russia officially recommends "owners of information resources disable the TLS ECH extension or, more correctly, use domestic CDN services".
https://cmu.gov.ru/ru/news/2024/11/07/рекомендуем-отказаться-от-cdn-сервиса-cloudflare/
With increased ECH use, I expect certain other actors to follow suit.
... Well done BoM .. as a Federal Australian Govt. funded service, it's only taken you 15 years to achieve what is the standard for 99% of legitimate internet facing webpages, (even then, just a "Beta" web site) that are capable of delivering weather information to Australians, that use .. *gasp!* ... transport layer security ...
* Slow Clap * and a belated welcome to the rest of the internet...
My private suspicion is that that cyber.gov.au finally beat them over the head with the "Essential 8" stick ... as opposed to just showing them it exists.
#DNSSEC and #DANE should not replace the established #TLS certificate authority system, because it would undermine end-to-end encryption between client and server, but I do believe that DNSSEC/DANE serve a legitimate role: preventing #DNS spoofing by third parties, i.e. proving that a DNS record really comes from the correct name server.
And in order to keep DNS requests private, DoH/DoT/DoQ should be the default.
I don't fully understand #DNSSEC criticism yet: A major argument against it is that it's a “government-controlled PKI” and that, for example, “Gaddafi would have controlled bit.ly’s TLS keys if it had been deployed earlier”.
But isn't that a strawman? If a bad actor controls DNSSEC, they control all the other #DNS records too, i.e. the government can always point domains wherever they like and obtain valid #TLS certificates. The Taliban closed down queer.af completely without DNSSEC.
"Your certificates and encryption are only as good as your public key infrastructure (PKI). I could have the strongest mechanical lock on my front door. But if I leave my key where burglars can find it, it won’t be good at all.
So it’s absolutely crucial that you deploy, implement, and configure your PKI the right way, and avoid these very costly yet common mistakes."
This is new to my personal blog, even if it's not actually new. Please share.
https://medium.com/@kim_crawley/8-ways-youre-doing-pki-wrong-b631d42e8645