4 ms·

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV c

by kardos 11y ago

So what does this mean for the incumbent CAs? Are we going to see a lot of consolidation in that area? At a first glance it looks like LE has neutered the DV cert business. How much of their revenue is up for grabs here... how strong is the incentive to pursue extra-legal means of killing off LE? (Such as by stealing and leaking their signing keys...)

_qhtn 11y ago
My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to. So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification. EDIT: I am very wrong.
- oliwarner 11y ago
  This is incorrect, potentially in a few ways. DVs are available from almost every CA. They're popular because they involve no paper checks which makes them cheap and fast. You don't need a company to get one, like you do with OV and EV. DV should give some level of confidence that you're connecting with the owner of the domain name. CAs should make you go through a process that only a domain's controller could complete. So I can't get a DV for paypal.com but I can get one for olipaypal.com if I own that domain. I can't get an OV or EV for either domain showing Paypal as the company unless I somehow manage to register that as a company name somewhere. Possible? Probably.
- kardos 11y ago
  It looks [1] like some CAs depend heavily on DV certs (GoDaddy) while others do not (Digicert). [1] http://www.netcraft.com/internet-data-mining/ssl-survey/ http://www.netcraft.com/internet-data-mining/ssl-survey/
  - Kadin 11y ago
    Interesting. I wonder how critical to GoDaddy's business the certificate sales are, or if they're really just a sideline to their core hosting business.
- rev_bird 11y ago
  To be fair, with LE you do need to verify you're requesting the cert from the domain for which you're requesting it, so there's some validation. It would be really difficult (for me, impossible) to get a Let's Encrypt cert for, say, wellsfargo.com. It's not one of the fancy CV certs like at https://www.grc.com/intro.htm https://www.grc.com/intro.htm, but they're the same certs Amazon.com uses.
tallanvor 11y ago
I doubt it. CAs still have EV, wildcard, email, and code signing certificates that are often twice as expensive (or more) than their DV offerings. And some people will choose to pay for a DV cert just so they don't have to swap them out every 3 months anyway.
- IgorPartola 11y ago
  EV can die a fiery death. It is bullshit. I don't see a reason why LE can't issue wildcards in the future, though with their current setup they are even less important. Email certificates can be issued by LE as well. Code signing is the only one I see as problematic. In either case, I suspect that LE will take a huge bite out of CA's bottom lines, since there are a lot more DV certs out there than EV ones.
  - r0muald 11y ago
    Yeah, wildcards are a necessity when every certificate is difficult to obtain, but LE really means we hit post-scarcity and certificates can be issued on the fly for new domains and subdomains.
    - ris 11y ago
      To an extent - LE still has rate limits for the number of certificates issued to a second level domain (5 in 7 days currently), so if you have many subdomains it could conceivably become unmanageable to keep them all updated.
  - currysausage 11y ago
    Honest question: why is EV bullshit? It's easier for my mom to check for a green bar saying "Bank of America" than to understand the difference between bankofamerica.com and bankofamerica-onlinebanking491.com. EV may not be bulletproof, but it potentially makes some rather popular attacks way harder to execute at scale.
    - IgorPartola 11y ago

by kardos 11y ago

_qhtn 11y ago

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to. So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification. EDIT: I am very wrong.

oliwarner 11y ago
This is incorrect, potentially in a few ways. DVs are available from almost every CA. They're popular because they involve no paper checks which makes them cheap and fast. You don't need a company to get one, like you do with OV and EV. DV should give some level of confidence that you're connecting with the owner of the domain name. CAs should make you go through a process that only a domain's controller could complete. So I can't get a DV for paypal.com but I can get one for olipaypal.com if I own that domain. I can't get an OV or EV for either domain showing Paypal as the company unless I somehow manage to register that as a company name somewhere. Possible? Probably.
kardos 11y ago
It looks [1] like some CAs depend heavily on DV certs (GoDaddy) while others do not (Digicert). [1] http://www.netcraft.com/internet-data-mining/ssl-survey/ http://www.netcraft.com/internet-data-mining/ssl-survey/
- Kadin 11y ago
  Interesting. I wonder how critical to GoDaddy's business the certificate sales are, or if they're really just a sideline to their core hosting business.
rev_bird 11y ago
To be fair, with LE you do need to verify you're requesting the cert from the domain for which you're requesting it, so there's some validation. It would be really difficult (for me, impossible) to get a Let's Encrypt cert for, say, wellsfargo.com. It's not one of the fancy CV certs like at https://www.grc.com/intro.htm https://www.grc.com/intro.htm, but they're the same certs Amazon.com uses.

tallanvor 11y ago

I doubt it. CAs still have EV, wildcard, email, and code signing certificates that are often twice as expensive (or more) than their DV offerings. And some people will choose to pay for a DV cert just so they don't have to swap them out every 3 months anyway.

IgorPartola 11y ago
EV can die a fiery death. It is bullshit. I don't see a reason why LE can't issue wildcards in the future, though with their current setup they are even less important. Email certificates can be issued by LE as well. Code signing is the only one I see as problematic. In either case, I suspect that LE will take a huge bite out of CA's bottom lines, since there are a lot more DV certs out there than EV ones.
- r0muald 11y ago
  Yeah, wildcards are a necessity when every certificate is difficult to obtain, but LE really means we hit post-scarcity and certificates can be issued on the fly for new domains and subdomains.
  - ris 11y ago
    To an extent - LE still has rate limits for the number of certificates issued to a second level domain (5 in 7 days currently), so if you have many subdomains it could conceivably become unmanageable to keep them all updated.
- currysausage 11y ago
  Honest question: why is EV bullshit? It's easier for my mom to check for a green bar saying "Bank of America" than to understand the difference between bankofamerica.com and bankofamerica-onlinebanking491.com. EV may not be bulletproof, but it potentially makes some rather popular attacks way harder to execute at scale.
  - IgorPartola 11y ago