Ryan Dickson

Technical Program Manager at @GoogleChrome and hobbyist beekeeper. Tweets are my own, not my employer’s.

[Ryan Dickson @ryancdickson]

Thank you @PrincetonCITP for introducing this work to the CA/Browser Forum at F2F Meeting 57!

[Cryptoki @Cryptoki]

CA/Browser Forum ballot SC-067 is in discussion to require Multi-Perspective Issuance Corroboration (aka MPIC) by CAs for domain validation and CAA checks to make certain attacks on #TLS validation more difficult https://t.co/KVQJkq2nDP

[Ryan Dickson @ryancdickson]

@mholt6 Duration…and I heard that 864,000 seconds (or less) is a great default value. 😃

https://t.co/0GnkRe9o4s

[Ryan Dickson @ryancdickson]

@__apf__ She’s just trying to get buzzed in!

Looks like a honeybee, who will be responsible for producing 1/12 of a teaspoon of honey in her ~45 day lifetime!

Un-bee-lievable!

[Ryan Dickson @ryancdickson]

@rmhrisk Ran it against Let’s Encrypt, https://t.co/1knovMDUCF, ZeroSSL, BuyPass, and Google Trust Services moments after getting his email!

Thank you Andrew, indeed!

[Ryan Hurst @rmhrisk]

Chrome gets it, ACME and automation is the key to unlocking reliable, at-scale certificate usage. #WebPKI https://t.co/FlRwzd2wOM

[Ryan Dickson @ryancdickson]

@dadrian But *this* time will be different!

[Ryan Hurst @rmhrisk]

Do you use ACME in a enterprise or large scale service and would be willing to be quoted on a site focused on increasing ACME adoption about your experience? If so please DM me and I’ll share more context.

[Ryan Dickson @ryancdickson]

@mholt6 This is my fourth year. It’ll be a lifelong hobby.

[Ryan Dickson @ryancdickson]

It’s been an un-bee-lievable year for beekeeping.

So far, I’ve pulled almost 300 pounds (about 25 gallons) of honey from two hives - and there’s still a few weeks left in the season!

[Ryan Dickson @ryancdickson]

@mholt6 @Crypt32 @rmhrisk @webprofusion Stapling is great, but it’s barely used. We describe our observations re: stapling in the background doc linked via the Pull Request I shared earlier.

Link: https://t.co/LIP9jLD21C

[Ryan Dickson @ryancdickson]

@rmhrisk @mholt6 @webprofusion Within the CA/B Forum, it feels like we’re getting close to voting on the proposed SC-63, which intends to make OCSP optional (enhancing user privacy), and incentivizes automation and short-lived certificates.

More here: https://t.co/KXv9Z6zpNo

[Ryan Dickson @ryancdickson]

@mjg59 We have a general FAQ located here (https://t.co/1S192uOct7), and generally describe the Windows certificate stores we pull from here (https://t.co/WF2wRG7FW3).

If you can share more specifics about the issues you faced, I’d be happy to see how we can improve the FAQ.

[Ryan Dickson @ryancdickson]

@mholt6 @rmhrisk @mholt6 - can you share your specific concerns/suggested areas of improvement re: ARI?

[Ryan Dickson @ryancdickson]

@seakoz @elonmusk Don’t forget to practice “defense-in-depth” by also storing the hashes and notAfter dates in a poorly named spreadsheet owned by the Admin who was replaced “5 admins ago.” 🤓

[Ryan Dickson @ryancdickson]

It’s time to automate certificate management @elonmusk!

[Elon Musk @elonmusk]

Caused by expired ground station cert. We’re scrubbing the system for other single-point vulnerabilities.

[Elon Musk @elonmusk]

Caused by expired ground station cert. We’re scrubbing the system for other single-point vulnerabilities.

[Ryan Dickson @ryancdickson]

@jozefizso Not everyone supports automation to the extent that “short-lived” certificates can be the norm. However, we’re trying to incentivize their use within the CA/Browser Forum (https://t.co/KXv9Z6yRXQ).

[Ryan Dickson @ryancdickson]

Let’s move the web PKI forward - together.

https://t.co/n5S6CooFKc

[Ryan Dickson @ryancdickson]

@awakecoding @BoreanJordan And, FWIW, many CAs agree that certificate lifetime should be shortened. Example: https://t.co/PicMk7vRVH

[Ryan Dickson @ryancdickson]

@awakecoding @BoreanJordan Root programs (like Chrome’s) define expectations and minimum requirements for initial and continued inclusion of a certificate in the corresponding root store (e.g., https://t.co/bKBkksYzqV). Those requirements are defined at the program operator’s sole discretion.

[Ryan Dickson @ryancdickson]

@awakecoding @BoreanJordan Personal opinion: we must prioritize security over profitability. Every time.