5 ms·

Keep in mind that Let's Encrypt publishes a searchable list of all domains issued. https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7

• toomuchtodo 11y ago
  This is why we're not using Let's Encrypt for internal/sensitive non-user facing services at the moment. Wildcard instead.
• tootie 11y ago
  Why?
  • pfg 11y ago
    FWIW, keeping internal hostnames private might be part of a security-by-obscurity strategy.
  • technion 11y ago
    They are following that Certificate transparency standard that, eventually, everyone will need to follow. It's already a requirement for anyone issuing EV certificates. Note crt.sh is actually a Comodo website, for interrogating the CT logs.
  • schoen 11y ago
    One way of putting it is that we want to get caught as quickly as possible if we ever misissue a certificate. We don't think it's a benefit to us or the certificate-using (relying party) public if we have the ability to secretly issue certs that are erroneous.
• pred_ 11y ago
  As far as I can tell, the website can not be used to browse all certificates directly; when the number was at 500k, the site would consistently time out when trying to fetch the oldest ~250k. Is the raw data available somewhere? On a completely different and off-topic note, as someone who would normally just handle my certificate needs by piping together 10 openssl commands, your ACME client is super handy!
  • pfg 11y ago
    The raw data is publicly available on Certificate Transparency log servers[1]. There are various clients for CT log servers out there, but they all require you to essentially download the entire log to query it (there's no query API). [1]: https://www.certificate-transparency.org/known-logs https://www.certificate-transparency.org/known-logs
    • technion 11y ago
      Depending on your need, one of your options is my own service, which will monitor your own registered domain for issued certificates. https://ctadvisor.lolware.net https://ctadvisor.lolware.net