Get in the bin: Let's Encrypt gives admins until February 13 to switch off TLS-SNI-01

End-of-life followed 2018 fake Website certificate drama


If you're still using TLS-SNI-01, stop: a year after a slip-up allowed miscreants to claim Let's Encrypt certificates for domains they didn't own, the free certificate authority has announced the final sunset of the protocol involved.

In January 2018, Let's Encrypt discovered that validation based on TLS-SNI-01 and its planned successor TLS-SNI-02 could be abused. As we explained at the time: "A company might have investors.techcorp.com set up and pointed at a cloud-based web host to serve content, but not investor.techcorp.com. An attacker could potentially create an account on said cloud provider, and add a HTTPS server for investor.techcorp.com to that account, allowing the miscreant to masquerade as that business – and with a Let's Encrypt HTTPS cert, too, via TLS-SNI-01, to make it look totally legit.”

HTTPS key

Let's Encrypt plugs hole that let miscreants grab HTTPS web certs for strangers' domains

READ MORE

The SNI extension to the TLS protocol is supposed to validate the name presented by the server, something particularly important when a single IP address is serving a large number of websites. As we noted last year, the opportunity for abuse arises if the hosting provider doesn't verify ownership of a domain.

Let's Encrypt's response at the time was to block TLS-SNI-01 for new accounts. However, it decided to continue support for certificates already issued.

That's going to end on February 13, 2019, the organisation has now confirmed.

In the blog post, Internet Security Research Group executive director Josh Aas explained that anyone still using TLS-SNI need to switch to DNS-01 and HTTP-01 as their validation mechanism.

"We apologize for any inconvenience but we believe this is the right thing to do for the integrity of the Web PKI," Aas concluded. ®


Other stories you might like

  • NASA delays SLS rollback due to concerns over rocky path to launchpad
    The road to the Moon is paved with... river rock?

    NASA's Moon rocket is to trundle back into its shed today after a delay caused by concerns over the crawlerway.

    The massive transporter used to move the Space Launch System between Vehicle Assembly Building (VAB) and launchpad requires a level pathway and teams have been working on the inclined pathway leading to the launchpad where the rocket currently resides to ensure there is an even distribution of rocks to support the mobile launcher and rocket.

    The latest wet dress rehearsal was completed on June 20 after engineers "masked" data from sensors that would have called a halt to proceedings. Once back in the VAB, engineers plan to replace a seal on the quick disconnect of the tail service mast umbilical. The stack will then roll back to the launchpad for what NASA fervently hopes is the last time before a long hoped-for launch in late August.

    Continue reading
  • Datacenter operator Switch hit with claims it misled investors over $11b buyout
    Complainants say financial projections were not disclosed, rendering SEC filing false and misleading

    Datacenter operator Switch Inc is being sued by investors over claims that it did not disclose key financial details when pursuing an $11 billion deal with DigitalBridge Group and IFM Investors that will see the company taken into private ownership if it goes ahead.

    Two separate cases have been filed this week by shareholders Marc Waterman and Denise Redfield in the Federal Court in New York. The filings contain very similar claims that a proxy statement filed by Switch with the US Securities and Exchange Commission (SEC) in regard to the proposed deal omitted material information regarding Switch's financial projections.

    Both Redfield and Waterman have asked the Federal Court to put the deal on hold, or to undo it in the event that Switch manages in the meantime to close the transaction, and to order Switch to issue a new proxy statement that sets out all the relevant material information.

    Continue reading
  • Google to pay $90m to settle lawsuit over anti-competitive behavior on the Play Store
    US developers that qualify could receive more than $200,000

    Google is to pay $90 million to settle a class-action lawsuit with US developers over alleged anti-competitive behavior regarding the Google Play Store.

    Eligible for a share in the $90 million fund are US developers who earned two million dollars or less in annual revenue through Google Play between 2016 and 2021. "A vast majority of US developers who earned revenue through Google Play will be eligible to receive money from this fund," said Google.

    Law firm Hagens Berman announced the settlement this morning, having been one of the first to file a class case. The legal firm was one of four that secured a $100 million settlement from Apple in 2021 for US iOS developers.

    Continue reading
  • Devops tool Jenkins now requires Java 11: This might sting a bit
    Final shift set for version 2.357 of developer automation platform

    It has taken a while, but the Jenkins project confirmed this week that Java 11 will be required from this week's Jenkins 2.357 and for the upcoming September LTS release.

    Jenkins, originally authored by Kohsuke Kawaguchi, recently passed its 10th anniversary. Originally known as Hudson, before the Oracle / Sun deal resulted in a fork, the platform is a veteran of the continuous integration and continuous delivery world. It is also written in Java.

    It's going to be a bit of a wrench. Java 11 itself was released in 2018 as a long-term support version, and the Jenkins LTS core has been Java 11-capable for a while now. The June LTS also supports Java 17 (the latest LTS of Java SE.)

    Continue reading

Biting the hand that feeds IT © 1998–2022