> Considering that literally anyone who roots any server at all, or can spoof one - even servers that have never used LetsEncrypt before - can generate new vali

> Considering that literally anyone who roots any server at all, or can spoof one - even servers that have never used LetsEncrypt before - can generate new valid LetsEncrypt certificates, and nothing generated has a password on it, I don't know if I would consider them trustworthy. This is true for the vast majority of all CAs. > If you want to passively monitor encrypted traffic on a massive scale and not get caught (other than via their log - and who is reading that to see if every server they have has been issued a cert unnecessarily, anyway?), LetsEncrypt is awesome. Wouldn't you rather pick a CA that doesn't log all certificates publicly? (At least while that's still possible - i.e. till early next year.) If you're doing this on a massive scale with a CA that logs publicly, there is absolutely no way you're not getting caught. Certificate Transparency Monitoring is fairly easy to set up, by the way. Even Facebook runs a public monitor you can use.