Posted by schmuckonwheels 22 hours ago
> These new intermediates do not contain the “TLS Client Authentication” Extended Key Usage due to an upcoming root program requirement. We have previously announced our plans to end TLS Client Authentication starting in February 2026, which will coincide with the switch to the Generation Y hierarchy.
So we use this to authenticate based on our fixed-IP/PTR/DNS to connect server to server to a 3rd party.
If we don't have the Client Authentication bit set, then the cert will be invalid for outgoing connections.
What do we use instead?
These days it seems like even the tiniest of projects have random sysadmin work like a compulsory change to https certs with little notice.
It's frustrating and I think has contributed to the death of the noncommercial corners of the internet.
2 factor Auth now compulsory.
Please validate your identity with our third party identity provider so we can confirm you are not on the sanctions list. If you do not, your account will be blocked.
Etc etc. Every third party service requires at least a little work and brainspace.
This feels in many respects worse than what we had with plain HTTP, and we can’t even go back now.
Do you have any examples of sites that have been blocked by the free ACME providers?
Maybe this will just teach everyone to click through SSL warnings the same way they click through GDPR popups - for better or worse.
At least under the new scheme if you let the domain sit for 45 days you'll know only you hold valid certificates for it.
https://www.certkit.io/certificate-management
You CNAME the acme challenge DNS to us, we manage all your certificates for you. We expose an API and agents to push certificates everywhere you need them, and then do real-time monitoring that the correct certificate is running on the webserver. End-to-end auditability.
There really is no alternative to LE.
Let's Encrypt could easily refuse to issue a certificate for a certain domain, even if you don't have a registered account. I don't see much difference.
Granted, you're locked into their ecosystem, can't export PK, etc. so it's FAR from a perfect solution here but I've actually been pretty impressed with the product from a "I need to run my personal website and don't want to have to care about certificates" perspective. Granted, you're paying for the cert, just not directly.
I agree with your statement completely though.
Now we have a “Y” generation showing up, but it seems like whoever thought of “X” didn’t anticipate more than three generations, or they would have used A1/A2.
Using Y to denote the "next generation" of roots is a scheme I came up with in the past year while planning our YE/YR ceremony, so it's certainly not something that people were thinking about when they named the first roots.