[CentOS] Certificates

[Robert Moskowitz]

On 08/31/2018 05:54 PM, John R. Dennison wrote:
> On Fri, Aug 31, 2018 at 05:30:53PM -0400, Robert Moskowitz wrote:
>> Letsencrypt is a very important development, but it has (IMHO) a shaking
>> foundation.  I would not build a production system around it.  But then I
>> have lived in aspects of PKI since '95...
> I presume you meant "shaky foundation"?

Yes.  I am not in California (or similar earthquake place!)  Good old 
stable Michigan (we do get mild ones once in a while.  :)

> If so, would you care to elaborate

It is designed for getting web servers quickly into TLS and then to a 
more stable provider.  "Make the web safe for all".  If your content is 
short information, your contacts will never notice that you go to a new 
cert quarterly.  Long-term users might also never see this, but I can 
see web services where a new cert every 90 days will cause a pain point.

And for other services like IMAP, SMTP, LDAP (maybe not LDAP) constant 
changing certs even with a long lived root may get old for your customers.

Plan on this to 'get into the pool', but not to live with it for more 
than a year.

Unfortunately, there has never been an effective business model for 
small customers.

We are kind of close with DMARC, but I think it misses the mark. Putting 
your domain root cert into your DNSSEC signed domain should be all that 
is needed to establish a rooted trust.

I have to speak with some IETF colleagues on this (particularly in 
DNSSEC and DMARC)....