6 ms·
Are they planning on not relying on a 3rd party root CA and instead, ask all browsers and OS vendors to include LetsEncrypt CA? IOW, is this [trusting IdenTrust
by teabee89 11y ago
Are they planning on not relying on a 3rd party root CA and instead, ask all browsers and OS vendors to include LetsEncrypt CA? IOW, is this [trusting IdenTrust] a first step, or is this the original goal?
- tkinom 11y agoInstead of 3rd party CA, wouldn't it be more secure if the browser will send a hash of website's public key to a few trusted websites and have them verified the public key is valid? If someone needs to create a fake CA/public key, they have to hack multiple trusted sites. It is not current https sys design, but would it be more secure?
- kej 11y agoThis is a temporary step. There are two versions of their intermediate cert, the one in this article that is cross-signed and another that is signed by their own root (which isn't yet included everywhere). There's a diagram on this page that explains the situation: https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/