New blog post: Why IP Address Certificates Are Dangerous and Usually Unnecessary www.agwa.name/blog/post/ip...
19.02.2026 14:16
👍 1
🔁 0
💬 0
📌 0
New blog post: Why IP Address Certificates Are Dangerous and Usually Unnecessary www.agwa.name/blog/post/ip...
Add GoDaddy (shocker, i know) to that list of CAs. A relative reached out to me for help because their biz website was getting flagged in Safari. New SSL cert issued by GoDaddy on 12/22 and one of the SCTs on the cert is for Digicert Sphinx 2027h1.
New blog post: Certificate Authorities Are Once Again Issuing Certificates That Don't Work
www.agwa.name/blog/post/ca...
Integrating with Google Cloud is a pick 2 of 3 situation:
1. No long-lived keys
2. Easy setup
3. Safe from suspension
I'm really disappointed in Google for artificially disincentivizing the secure options. 4/4
Alternative one is have the customer create a service account and share a key with SSLMate - easy but less secure because long-lived keys are bad.
Alternative two is OpenID Connect which is secure but Google has made unnecessarily hard to set up. 3/4
SSLMate's solution (we create a service account for each customer) is easy AND secure and worked great for 5 years until we started getting hit with suspensions. 2/4
Google just suspended SSLMate's Google Cloud account for the third time: www.agwa.name/blog/post/go...
The obvious fail is Google's trigger-happy account suspensions, but the more important fail is that Google is disincentivizing the secure options for cross-provider access with Google Cloud. 1/4
New blog post: I'm Independently Verifying Go's Reproducible Builds: www.agwa.name/blog/post/ve...
New blog post: SQLite's Durability Settings are a Mess www.agwa.name/blog/post/sq...
Turns out Alpine Linux has a copy of the same script from curl! I've raised an issue in their issue tracker: gitlab.alpinelinux.org/alpine/ca-ce...
I recently investigated how the Entrust distrust would be unintentionally disruptive to non-browser clients: sslmate.com/blog/post/en...
Good news since then: curl has fixed their CA bundle generator, a fix is pending for mkcert.org, and python-certifi is pausing releases until mkcert is fixed!