[dead]
An idea to make EV certs somewhat more useful: EV Preload List Similar to HSTS Preload List, a domain owner can enroll the domain into an "EV only" program on a yearly basis, such that the list of "EV only" domains will…
Great work, did a similar analysis recently but only for the top 50, and in fact none of the top 50 had an EV at the time of the survey. I believe the only possible advantage of an EV is not a technical one, but rather…
Question for HN regarding EV certs: Have seen some entities request a large number of EV certs (more than 10, sometimes up to 40) for subdomains under a single domain. At the same time, they are requesting OV Wildcard…
> Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any…
Have done small to medium institutional rollouts of Firefox in different orgs, some of which were on top of a Linux base and others a Windows base. Windows deployments include Firefox in the base image and configuration…
If you want to update your ACME configuration to use these new 64-day certs now to get a head start on the transition... there's currently no way to do so. LE for reasons unknown did not opt to use their "profile"…
64 days might seem like an arbitrary number, but it’s a simple cascade: 64 days = 2 maximal month (62 days) + 1 day wiggle room + 1 day because 63 would be even weirder.
Agreed, there is a problem with how certs are managed in large organizations. Many copy the same private key and cert everywhere. They have no problem copying their single private key to budget VPS services or foreign…
I don't agree that this is a positive development if a resilient worldwide PKI is desired. 1. We have seen how Cloudflare can "break the Internet" due to their position as a SPoF. Let's Encrypt also became a SPoF as…
SOAP API in 2026 - this seems fine? Fundamentally we are talking about exchanging XML documents over a request/response protocol, generally HTTP, which is a still pretty well supported thing to do even in 2026. The…
[dead]
An idea to make EV certs somewhat more useful: EV Preload List Similar to HSTS Preload List, a domain owner can enroll the domain into an "EV only" program on a yearly basis, such that the list of "EV only" domains will…
Great work, did a similar analysis recently but only for the top 50, and in fact none of the top 50 had an EV at the time of the survey. I believe the only possible advantage of an EV is not a technical one, but rather…
Question for HN regarding EV certs: Have seen some entities request a large number of EV certs (more than 10, sometimes up to 40) for subdomains under a single domain. At the same time, they are requesting OV Wildcard…
> Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any…
Have done small to medium institutional rollouts of Firefox in different orgs, some of which were on top of a Linux base and others a Windows base. Windows deployments include Firefox in the base image and configuration…
If you want to update your ACME configuration to use these new 64-day certs now to get a head start on the transition... there's currently no way to do so. LE for reasons unknown did not opt to use their "profile"…
64 days might seem like an arbitrary number, but it’s a simple cascade: 64 days = 2 maximal month (62 days) + 1 day wiggle room + 1 day because 63 would be even weirder.
Agreed, there is a problem with how certs are managed in large organizations. Many copy the same private key and cert everywhere. They have no problem copying their single private key to budget VPS services or foreign…
[dead]
I don't agree that this is a positive development if a resilient worldwide PKI is desired. 1. We have seen how Cloudflare can "break the Internet" due to their position as a SPoF. Let's Encrypt also became a SPoF as…
SOAP API in 2026 - this seems fine? Fundamentally we are talking about exchanging XML documents over a request/response protocol, generally HTTP, which is a still pretty well supported thing to do even in 2026. The…