Bettertls Alternatives

bettertls reviews and mentions

• Just want simple TLS for your .internal network?
  8 projects | news.ycombinator.com | 17 Oct 2024

  A word of warning, client side support of name constraints may still be incomplete. I know it works on modern Firefox and Chrome, but there's lots of other software that uses HTTPS.

  This repo links to BetterTLS, which previously audited name constraint support, but BetterTLS only checked name constraint support at the intermediary certificates not at the trust anchors. I reported[1] the oversight a year back, but Netflix hasn't re-engineered the tests.

  Knowing how widely adopted name constraints are on the client side would be really useful, but I haven't seen a caniuse style analysis.

  Personally, I think the public CA route is better and I built a site that explores this[2].

  [1] https://github.com/Netflix/bettertls/issues/19

  [2] https://www.getlocalcert.net/

• Show HN: Anchor – developer-friendly private CAs for internal TLS
  4 projects | news.ycombinator.com | 1 Nov 2023

  Have you done any research about how well different web clients support name constraints? I know that Chrome only recently started respecting Name Constraint on root CAs [1]. The BetterTLS project tracks a bunch of related concerns, but oddly missed this one [2]. I'm wary of this approach since I don't know if the various software I use will enforce it.

  1. https://alexsci.com/blog/name-non-constraint/

  2. https://github.com/Netflix/bettertls/issues/19

• Running one’s own root Certificate Authority in 2023
  12 projects | news.ycombinator.com | 16 Sep 2023

  Wouldn't it be nice if LetsEncrypt could issue you a (1) name constrained, (2) 90-day limited intermediate CA with just the (3) DNS-01 challenge? I argue that such an intermediate CA would have no more authority than a wildcard cert which you can get today, so they should be able to issue it. [1] Everything supports name constraints now, which used to be an issue but isn't anymore.

  Then stick it in step-ca and issue all your certificates with internal ACME.

  This would solve a lot of problems, such as leaking private hostnames in the certificate transparency log, or hitting issuance rate limits on LE servers.

  [1]: https://news.ycombinator.com/item?id=29811552

  [2]: https://bettertls.com/

• Easy HTTPS for your private networks
  13 projects | news.ycombinator.com | 10 Jul 2023

  I've been pretty frustrated with how private CAs are supported. Your private root CA can be maliciously used to MITM every domain on the Internet, even though you intend to use it for only a couple domain names. Most people forget to set Name Constraints when they create these and many helper tools lack support [1][2]. Worse, browser support for Name Constraints has been slow [3] and support isn't well tracked [4]. Public CAs give you certificate transparency and you can subscribe to events to detect mis-issuance. Some hosted private CAs like AWS's offer logs [5], but DIY setups don't.

  Even still, there are a lot of folks happily using private CAs, they aren't the target audience for this initial release.

  [1] https://github.com/FiloSottile/mkcert/issues/302

  [2] https://github.com/cert-manager/cert-manager/issues/3655

  [3] https://alexsci.com/blog/name-non-constraint/

  [4] https://github.com/Netflix/bettertls/issues/19

  [5] https://docs.aws.amazon.com/privateca/latest/userguide/secur...

• A note from our sponsor - SaaSHub
  www.saashub.com | 17 Jan 2025

  SaaSHub helps you find the best software and product alternatives Learn more →