4 ms·

If you are using the free SSL provided your Webhost "Let's Encrypt" certificate, you will be fine. That is not a Symantec cert.

wolco 9y ago
When will google decide let's encrypt is not secure enough and start giving a warning around that.
- SteveNuts 9y ago
  Considering Google is a major sponsor of the project, I'd say likely never. Not to mention that Google has been pushing hard for https on all sites, which is exactly LE's goal.
  - problems 9y ago
    Not only that, but they're doing things like Certificate Transparency - publishing every certificate they sign into public logs and they're funded and supported by some of the biggest names in online security and privacy. They're probably the most trustworthy CA on the planet.
    - peterwwillis 9y ago
      Considering that literally anyone who gets even local access to any server at all, or can spoof one - even servers that have never used LetsEncrypt before - can generate new valid LetsEncrypt certificates, and nothing generated has a password on it, I don't know if I would consider them trustworthy. If you want to passively monitor encrypted traffic on a massive scale and not get caught (other than via their log - and who is reading that to see if every server they have has been issued a cert unnecessarily, anyway?), LetsEncrypt is awesome. It's plausible to do this without LetsEncrypt, but they made it a lot easier.
      - gruez 9y ago
        >Considering that literally anyone who roots any server at all - even servers that didn't use LetsEncrypt before - can generate new valid LetsEncrypt certificates As opposed to any other CAs? There are plenty of other CAs that will happily grant a certificate if you prove control of a server that the domain resolves to. >nothing generated has a password on it, I don't know if I would consider them really trustworthy. If you have root on the server, can't you just dump the certificate out of memory, even if there's a password on it? short of using a HSM, you need the certificate decrypted so the server can use it.
        peterwwillis 9y ago
        Well I have a problem with the fact that you can't stop random CAs from issuing certs for a domain you own. But I don't think that's changing anytime soon. Passwords provide security for data at rest, a properly hardened server makes it very difficult to dump memory in certain circumstances, and hsm are practically a requirement in some environments. And finally, say I wanted to use LetsEncrypt, but I wanted to manage the keys myself, and require only private key X could be used to sign Y, and manage it myself. They don't really let me set those requirements at the CA level - it's all on my own host + network security, which IMHO is unnecessarily risky.
        detaro 9y ago
        > Another thing is, let's say I use some other CA for my certs, and I don't want LetsEncrypt issuing any. I can't really stop them, can I? CAA records. If you want full control over when issuance happens, you can even set the list of allowed CAs to empty and only change it when you actually want a certificate. > And finally, say I wanted to use LetsEncrypt, but I wanted to manage the keys myself If someone can submit a CSR and complete the challenges they get a signed cert, yes, just like with other DV-CAs. LE code (certbot or other clients) doesn't have to touch your private keys, as long as you give them CSRs, as with other CAs.
        pfg 9y ago
        > Another thing is, let's say I use some other CA for my certs, and I don't want LetsEncrypt issuing any. I can't really stop them, can I? You absolutely can. Let's Encrypt was one of the first CAs to support CAA (and, IIRC, they supported it when they first launched). CAA is a DNS record that lets you specify which CAs are permitted to issue certificates for your domain. > And finally, say I wanted to use LetsEncrypt, but I wanted to manage the keys myself, and require only private key X could be used to sign Y, and manage it myself. They don't really let me set those requirements at the CA level - it's all on my own host + network security. I'm not quite sure what you're saying here. Do you want the ability to issue certificates under your own (constrained) intermediate certificate? That's unfortunately not possible under the current Baseline Requirements unless you get audited as a CA. If you just want to use your own private key, that's of course possible (in fact, there's no way for Let's Encrypt to generate a key for you). Or is it that you want to limit limit issuance for domain X to key Y? What other CA allows you to do that? And how would you prevent some other CA from issuing a certificate for a different key, even if Let's Encrypt would support such a feature? With that in mind, it becomes clear that in the end it's up to your host and network security again, even with such an agreement in place.
  - hollander 9y ago
    Pushing TLS on all sites is only possible with free certificates. LE is essential. Nevertheless, never say "never".
- sofaofthedamned 9y ago
  When they do the stupid that other CAs have?
  - agwa 9y ago
    Exactly. And to be clear, the malfeasance by Symantec is voluminous and well-documented: https://wiki.mozilla.org/CA:Symantec_Issues https://wiki.mozilla.org/CA:Symantec_Issues Distrusting Symantec is not an arbitrary action as some people seem to believe.
- castis 9y ago
  Probably some time after Let's Encrypt shows some form of negligence while issuing certificates.
- 0xfeba 9y ago
  Considering how bad these violations were, and how carefully FF and Chrome are documenting everything, I'd say about never.
- bitmapbrother 9y ago
  >When will google decide let's encrypt is not secure enough and start giving a warning around that When they start issuing illegitimate certificates.
- formula1 9y ago
  for a decentralized web - a way for people to be compensated for their time - mesh network - decentralized dns market - reservation system that supports known brands keeping their name - allows enough fluctuations that a name can be rereserved - opensource browser - keeping it simple enough for newbies to figure it out - a way to associate a public key to an IP address, reverify it and legitimize it - p2p shared files - trackers/dht torrent - decentralized hueristics - timelimit, algorithm fn, score fn, prize for heighest score

wolco 9y ago

When will google decide let's encrypt is not secure enough and start giving a warning around that.

SteveNuts 9y ago
Considering Google is a major sponsor of the project, I'd say likely never. Not to mention that Google has been pushing hard for https on all sites, which is exactly LE's goal.
- problems 9y ago
  Not only that, but they're doing things like Certificate Transparency - publishing every certificate they sign into public logs and they're funded and supported by some of the biggest names in online security and privacy. They're probably the most trustworthy CA on the planet.
  - peterwwillis 9y ago
    Considering that literally anyone who gets even local access to any server at all, or can spoof one - even servers that have never used LetsEncrypt before - can generate new valid LetsEncrypt certificates, and nothing generated has a password on it, I don't know if I would consider them trustworthy. If you want to passively monitor encrypted traffic on a massive scale and not get caught (other than via their log - and who is reading that to see if every server they have has been issued a cert unnecessarily, anyway?), LetsEncrypt is awesome. It's plausible to do this without LetsEncrypt, but they made it a lot easier.
    - gruez 9y ago
      >Considering that literally anyone who roots any server at all - even servers that didn't use LetsEncrypt before - can generate new valid LetsEncrypt certificates As opposed to any other CAs? There are plenty of other CAs that will happily grant a certificate if you prove control of a server that the domain resolves to. >nothing generated has a password on it, I don't know if I would consider them really trustworthy. If you have root on the server, can't you just dump the certificate out of memory, even if there's a password on it? short of using a HSM, you need the certificate decrypted so the server can use it.
      - peterwwillis 9y ago
        Well I have a problem with the fact that you can't stop random CAs from issuing certs for a domain you own. But I don't think that's changing anytime soon. Passwords provide security for data at rest, a properly hardened server makes it very difficult to dump memory in certain circumstances, and hsm are practically a requirement in some environments. And finally, say I wanted to use LetsEncrypt, but I wanted to manage the keys myself, and require only private key X could be used to sign Y, and manage it myself. They don't really let me set those requirements at the CA level - it's all on my own host + network security, which IMHO is unnecessarily risky.
        detaro 9y ago
        > Another thing is, let's say I use some other CA for my certs, and I don't want LetsEncrypt issuing any. I can't really stop them, can I? CAA records. If you want full control over when issuance happens, you can even set the list of allowed CAs to empty and only change it when you actually want a certificate. > And finally, say I wanted to use LetsEncrypt, but I wanted to manage the keys myself If someone can submit a CSR and complete the challenges they get a signed cert, yes, just like with other DV-CAs. LE code (certbot or other clients) doesn't have to touch your private keys, as long as you give them CSRs, as with other CAs.
        pfg 9y ago
        > Another thing is, let's say I use some other CA for my certs, and I don't want LetsEncrypt issuing any. I can't really stop them, can I? You absolutely can. Let's Encrypt was one of the first CAs to support CAA (and, IIRC, they supported it when they first launched). CAA is a DNS record that lets you specify which CAs are permitted to issue certificates for your domain. > And finally, say I wanted to use LetsEncrypt, but I wanted to manage the keys myself, and require only private key X could be used to sign Y, and manage it myself. They don't really let me set those requirements at the CA level - it's all on my own host + network security. I'm not quite sure what you're saying here. Do you want the ability to issue certificates under your own (constrained) intermediate certificate? That's unfortunately not possible under the current Baseline Requirements unless you get audited as a CA. If you just want to use your own private key, that's of course possible (in fact, there's no way for Let's Encrypt to generate a key for you). Or is it that you want to limit limit issuance for domain X to key Y? What other CA allows you to do that? And how would you prevent some other CA from issuing a certificate for a different key, even if Let's Encrypt would support such a feature? With that in mind, it becomes clear that in the end it's up to your host and network security again, even with such an agreement in place.
- hollander 9y ago
  Pushing TLS on all sites is only possible with free certificates. LE is essential. Nevertheless, never say "never".
sofaofthedamned 9y ago
When they do the stupid that other CAs have?
- agwa 9y ago
  Exactly. And to be clear, the malfeasance by Symantec is voluminous and well-documented: https://wiki.mozilla.org/CA:Symantec_Issues https://wiki.mozilla.org/CA:Symantec_Issues Distrusting Symantec is not an arbitrary action as some people seem to believe.
castis 9y ago
Probably some time after Let's Encrypt shows some form of negligence while issuing certificates.
0xfeba 9y ago
Considering how bad these violations were, and how carefully FF and Chrome are documenting everything, I'd say about never.
bitmapbrother 9y ago
>When will google decide let's encrypt is not secure enough and start giving a warning around that When they start issuing illegitimate certificates.
formula1 9y ago
for a decentralized web - a way for people to be compensated for their time - mesh network - decentralized dns market - reservation system that supports known brands keeping their name - allows enough fluctuations that a name can be rereserved - opensource browser - keeping it simple enough for newbies to figure it out - a way to associate a public key to an IP address, reverify it and legitimize it - p2p shared files - trackers/dht torrent - decentralized hueristics - timelimit, algorithm fn, score fn, prize for heighest score