[CentOS] https and self signed

Mon Jun 20 17:16:52 UTC 2016
Gordon Messmer <gordon.messmer at gmail.com>

On 06/20/2016 07:47 AM, James B. Byrne wrote:
> On Sat, June 18, 2016 18:39, Gordon Messmer wrote:
>> I'm not interested in turning this in to a discussion on epistemology.
>> This is based on the experience (the evidence) of some of the world's
>> foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc).
> Really? Then why did you forward your reply a private message to a
> public mailing list if not to do exactly what you claim you wish to
> avoid?

Accidents happen.  I didn't intentionally mail you off-list, and when I 
noticed that I had, seconds later, I re-sent the message to the list, 
expecting that you'd notice and understand that I intended to keep the 
conversation on the list.

..which isn't relevant to the question of what you consider "evidence" 
of security practice implications.

Look, go to https://www.google.com/ right now and tell me what you see.  
Do you suddenly distrust the internet's single largest domain?  Do you 
think they implement poor security practices?

>> For someone who wants "evidence" you make a lot of unsupported
>> assertions.  You do see the irony, don't you?
> The difference is that I state this is my opinion and I do not claim
> it as a fact.  Your statement claimed a factual basis.  I was
> naturally curious to see what evidence supported your claim.

Citation required.

Allow me an example.  To quote you:
"The usual way a private key gets compromised is by theft or by 
tampering with its generation.  Putting yourself on a hamster wheel of 
constant certificate generation and distribution simply increases the 
opportunities for key theft and tampering."

Now, when you asked "what possible benefit accrues from changing secured 
device keys on a frequent basis?" I pointed you to letsencrypt's 
documentation, which describes the benefits of 90-day certificates.

So, please describe how I am "claiming a factual basis" while you are not.

> Automated security is BS.  It has always been BS and it always will be
> BS.  That is my OPINION.  It may not be a fact for I lack empirical
> evidence to support it.  However, it has long been my observation that
> when people place excessive trust in automation they are are
> eventually and inevitably betrayed by it.  Often at enormous cost.

This is what I consider "enormous cost":

After a major security bug which exposed private keys, hundreds of 
thousands of servers did not take the required action to secure their 
services, and the vast majority of those that took *some* action did it 
incorrectly and did not resolve the problem.

Had those sites been using letsencrypt and renewing automatically, the 
exposed keys would have been replaced within 90 days (typically 60 max, 
so 30 days on average).  Instead, it is likely that the problem will 
remain a risk for "months, if not years, to come."

And that's empirical evidence, which you have yet to offer.

> This impediment however is strictly an artefact of signing code with
> short term certificates.  I simply had to reset the date on my MB back
> to some future date when the certificate was valid and everything
> worked fine.

Apple's intermediate certs have a 10 year lifetime.  If you consider 
that "short term" then I fear that nothing is suitable in your opinion.

> But hey, what is my time worth in comparison to the security those
> certificates provided?  SECURITY that was trivially evaded in the end.

Fixing your clock is not "evading" security.

> Exactly what mindless person or committee of bike-shedders decided
> that software should be distributed so that copies of it expire?

Expiration is a fundamental aspect of x509 certificates.  Do you 
understand x509 at all?