4 ms·
> TL;DR: Forget your EV or other certs. Just run “Let’s Encrypt”. It gets you a cert, it’s fresh, and it does not make any difference whatsoever. At least not a
by peterwwillis 9y ago
> TL;DR: Forget your EV or other certs. Just run “Let’s Encrypt”. It gets you a cert, it’s fresh, and it does not make any difference whatsoever. At least not any you or anyone else can check for, or cares for.
Let's Encrypt shut down their new test interface because of a security flaw they found. If this was in a production service, this would have been about as bad of a security flaw as is possible in a PKI system.
Let's not get all high and mighty assuming Let's Encrypt won't get compromised; they probably will. We should be planning for how to deal with that.
- majewsky 9y agoThat doesn't make sense. You cannot criticize someone for finding an issue in the testing environment before it hits production. That's literally what the testing environment is for.
- peterwwillis 9y agoI was not criticizing them (can you quote the part of my comment that was critical?). I was illustrating that they are not perfect, and just using them without considering that they too could be compromised is a bad idea.
- aidenn0 9y agoAt least with LE we're not paying to have our data compromised :)