Thought experiment:

@letsencrypt offers certificates to encrypt the traffic between a website & your browser.

They reside in the US & thus are subject to the judiciary system of the US.

What are the possible risks for websites outside the US, given the current unstable political situation & administration? What type of damage could an executive order do? How could this be mitigated?

Boosts appreciated.

Let's Encrypt soon starts offering TLS certificates with just 6 days of lifetime. It's just an option and the 90 day certs are also still offered but I doubt that this will add a lot of security.

https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/

Based on the number of occasions, I already had problems with the 90days renewals in the past (software bugs and human error), I see this the value in this move rather sceptical.

More supply chain thoughts.

Let's Encrypt is based in the United States.

For those who want a local (non-cloud) tool for checking TLS certificate expiration as a result of Let's Encrypt dropping support for expiration notices via email, here's a small shell script which will do it. It needs the OpenSSL command-line tool and an email sender (I use msmtp):

#!/bin/bash

MINIMUM_EXPIRY_DAYS={{ minimum_expiry_days }}
MINIMUM_EXPIRY=$((${MINIMUM_EXPIRY_DAYS} * 86400))

for cert in /etc/letsencrypt/live/*/cert.pem
do
echo Checking ${cert}
if openssl x509 -noout -in ${cert} -checkend ${MINIMUM_EXPIRY} > /dev/null
then
:
else
msmtp --read-envelope-from --read-recipients <<EOF
From: (sender address here)
To: (recipient address here)
Subject: Certificate Expiration Alert

${cert} will expire in fewer than ${MINIMUM_EXPIRY_DAYS} days.
EOF
fi
done

CC @letsencrypt @johns

New releases

• Kitten (rolling release)
• @small-tech/https version 5.3.2
• Auto Encrypt version 4.1.3

OCSP support has been reinstated in the server so existing sites with Let’s Encrypt certificates provisioned prior to the removal of the OCSP stapling requirement will not fail to load in Firefox.

Kitten servers in production will automatically update to this version in a few hours. You can also sign in to the Kitten settings page on your server and do a manual update to update Kitten immediately.

Thanks to @stefan and @s1r83r for bringing this to my attention. (https://mastodon.ar.al/@aral/113969540950647873)

New Kitten release

• Upgrades to version 5.3.1 of @small-tech/https¹ which has version 4.1.2 of Auto Encrypt² that l removes OCSP stapling (because Let’s Encrypt has removed OCSP support).

Please upgrade your Kitten as soon as possible or any new Kitten servers you try to set up will fail and any certificate renewals for existing servers will start to fail in May.

https://kitten.small-web.org

(To upgrade, run `kitten update`. Your production servers will update automatically.)

Enjoy!

¹ https://www.npmjs.com/package/@small-tech/https
² https://www.npmjs.com/package/@small-tech/auto-encrypt

Auto Encrypt version 4.1.0 released

• Removes OCSP stapling, as Let’s Encrypt is removing OCSP support.

If you’re already using Auto Encrypt upgrade before May or your certificate renewals will start to fail. Upgrade now if you want to get certificates for new domains as new certificate requests are already failing.

https://codeberg.org/small-tech/auto-encrypt#readme

Auto Encrypt automatically provisions and renews Let’s Encrypt TLS certificates on Node.js https servers (including Kitten¹, Polka, Express.js, etc.)

Regular Node.js HTTPS server (without Let’s Encrypt certificates):

```js
import https from 'node:https'
const server = https.createServer(…)
```

Auto Encrypt https server with automatic Let’s Encrypt certificates:

```js
import AutoEncrypt from '@small-tech/auto-encrypt'
const server = AutoEncrypt.https.createServer(…)
```

(Certificates are provisioned on first hit and automatically renewed 30 days before expiry.)

¹ https://kitten.small-web.org

Let's Encrypt will discontinue sending expiration notification emails, and they can recommend

Red Sift Certificates Lite
Lite is the free tier of Red Sift Certificates, providing expiration monitoring for up to 250 certificates and 7-day email alerts to prevent downtime.

https://redsift.com/pulse-platform/certificates-lite

Just released Node Pebble version 5.1.1

• Updated to Pebble version 2.7.0.

• Now also supports macOS and arm64 (because Pebble itself does).

https://codeberg.org/small-tech/node-pebble

Node Pebble is a Node.js wrapper for Let’s Encrypt’s¹ Pebble² that:

• Downloads the correct Pebble binary for your platform.

• Launches and manages a single Pebble process.

• Returns a reference to the same process on future calls (safe to include in multiple unit tests where order of tests is undetermined)

• Automatically patches Node.js’s TLS module to accept Pebble server’s test certificate as well as its dynamically-generated root and intermediary CA certificates.

¹ https://letsencrypt.org

² “A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production certificate authority.” https://github.com/letsencrypt/pebble

So I guess Let’s Encrypt has decided what I’ll be working on today then…

https://letsencrypt.org/2024/12/05/ending-ocsp/

(They’re ending OCSP stapling support. I’ll be updating Auto Encrypt¹ to remove OCSP support and then update @small-tech/https, which uses it, along with Auto Encrypt Localhost² to provide seamless TLS support regardless of whether you’re working in development or in production, and then update Site.js³ – deprecated but still used to serve some of our own sites at Small Technology Foundation⁴ – and Kitten⁵, with the latest @small-tech/https.)

¹ https://codeberg.org/small-tech/auto-encrypt
² https://codeberg.org/small-tech/auto-encrypt-localhost
³ https://codeberg.org/small-tech/https
⁴ https://small-tech.org
⁵ https://kitten.small-web.org

How to start a new CA?
#letsencrypt #fosdem #janson #fosdem2025

Let’s Encrypt intends to discontinue sending expiration notification emails

https://letsencrypt.org/2025/01/22/Ending-Expiration-Emails

ohno, #letsencrypt is ending notification emails? time to write my own monitoring and notification service? or is there already a free software based one?

https://letsencrypt.org/2025/01/22/ending-expiration-emails/

People have probably seen this before, and I have - but not to this extent.

All certificates that are public, are actually "streamed" to public databases, that in line with regulation set by CA's, browsers and other vendors.

What that means, is that if you issue (or buy) a certificate from a public CA - and you are only using it in an internal environment - people WILL know that you have a host with that particular CommonName somewhere.

I've issued a couple of certificates today, and since I host my own Authoritive DNS-servers, I am able to fully trace the requests coming into my DNS-zone.
Immediately after I've issued said certificates - I see many request arriving from all over the world, together with port-scans and all that shit.
And if you dont have a A-record for that particular hostname - the portscans will go directly against @.
All that from Cloud providers such as AWS, GCP, and shit.

Fascinating.

And if you want to check all the certificates that is issued - in real time, Check out "certstream"

https://certstream.calidog.io/

If you use #Codeberg for your #Git hosting, which other services you rely on can you recommend further?

For instance, we appreciate the service by #LetsEncrypt for our TLS certificates and Anoxinon for our Mastodon instance.