4 ms·

I'm so excited for this to take off, and it's good to see they've taken the first steps, but can I at least download the CA Cert over HTTPS? Not sure how comfor

I'm so excited for this to take off, and it's good to see they've taken the first steps, but can I at least download the CA Cert over HTTPS? Not sure how comfortable I am installing a CA cert I downloaded via HTTP, since that's kind of the whole point of this whole thing.

_jomo 11y ago
You can download the cert via HTTPS from https://letsencrypt.org/certs/isrgrootx1.der https://letsencrypt.org/certs/isrgrootx1.der
- deleted 11y ago
  [deleted]
joshmoz 11y ago
Fixed, thanks for pointing that out.
- andrewstuart2 11y ago
  No problem :-) I actually noticed the link was HTTPS (presumably after you changed it) and thought I was taking crazy pills.
  - nailer 11y ago
    HTTP version really should redir to HTTPS.
    - eridius 11y ago
      That won't really fix anything, anyone who wants to MITM the HTTP can just kill the redirect.
      - Tushon 11y ago
        Not with HSTS enabled (which they do have). If you get caught before the first request ever, sure, but you've got bigger problems if that is the case.
eric_bullington 11y ago
I thought the same thing, so I wrote the comment below (I downloaded it using https and checked it against earlier posted copies of the cert): https://news.ycombinator.com/item?id=10218774 https://news.ycombinator.com/item?id=10218774