4 ms·
>Now I can just get a free cert and turn on TLS. What's the problem, exactly? Certs weren't free for business use until let's encrypt.
by hueving 11y ago
>Now I can just get a free cert and turn on TLS. What's the problem, exactly?
Certs weren't free for business use until let's encrypt.
- joshschreuder 11y agoThat's kind of the point. They weren't but now are, and now there's even less of an excuse not to have a cert.
- dsp1234 11y agoIs it possible to get a Let's Encrypt certificate without a public facing website (which is unrelated to wanted to run a mail server)?
- tokenizerrr 11y agoYes, they recently enabled the DNS validation. Otherwise, it wants to use a webserver to validate ownership. It can spin up an embedded webserver if you don't have one already.
- zAy0LfpBZLC8mAC 11y agoI would say the opposite: There is no excuse for cementing the role of CAs for SMTP. DANE doesn't need any CA, and there is no problem with legacy clients that require CA-signed certs.
- nly 11y agoWoSign never seemed to care.
- linkregister 11y agoLong before Let's Encrypt, SMTP transactions with STARTTLS have permitted self-signed and non-root-CA chained certificates. The pervasiveness of self-signed certificates for SMTP servers means that rejecting them would drop large amounts of email. STARTTLS is basically useful for thwarting passive collection of network traffic.
- makomk 11y agoGmail's new rules on unencrypted e-mail don't support self-signed certificates though - you have to use an offcial CA-issued certificate from one of Google's approved CAs.
- zAy0LfpBZLC8mAC 11y agoWhat's your source for that?
- technion 11y agoThat doesn't bring a lot of extra security though, because there's no name verification. I can get a valid letsencrypt cert on anyrandomdomain.com, and if I can hijack your MX and point at it, it's "valid".
- hueving 11y agoWhat? How can you get a cert for a domain you don't control?
- technion 11y agoI don't need to control your domain. If I control my own domain, which could be any throwaway domain I just purchased, I can get an SSL certificate on it. And if I can point your MX records there, via hijack or any other means, then I have a valid SSL certificate for receiving your email.
- jbclements 11y agoI'm not so sure about that; I use a self-signed cert for port 25 TLS, and I just sent from google to my domain, and didn't see a warning.
- bigiain 11y agoIt's been a long time since the cost of a cert was an inhibiting factor - at least for 1st world businesses. (I don't suppose I'd want to be paying for a US dollar priced TLS cert in Zambian kwacha or trying to get a petty cash reimbursement for one on a typical IT salary in South Sudan...)