4 ms·

LetsEncrypt, no. they don't ask you for your private key when you get a certificate, so they can't decrypt anything.

• jjeaff 8y ago
  They couldn't decrypt, but as a CA, like any other trusted CA, they could man-in-the-middle the traffic, read it, then pass it along to your server, re-encrypted.
  • tialaramex 8y ago
    When a Chrome (and soon to be also Safari, Firefox) connects to a web server over TLS it expects to see SCTs, Signed Certificate Timestamps from some qualified logs (in Chrome's case at least one of these logs must be operated by Google and at least one must not). In most people's setups they get these baked inside their certificates, but you can do it in other ways and that'll work too. The SCTs can only be produced by these logs, and only when the log is shown the tbsCertificate data. The intent is that the log service promises to log all certificates for which it provides a timestamp. A Merkle Tree is used so that we can examine a log and obtain proof that it does indeed contain every certificate we've seen SCTs for. So, your conspiracy needs to involve the Certificate Authority (Let's Encrypt in this case), the CT logging team at Google, and at least one third party log operator. Or it would be detected when it was tried.
    • jjeaff 8y ago
      >So, your conspiracy needs to involve the Certificate Authority (Let's Encrypt in this case), the CT logging team at Google... No, as you alluded to, my conspiracy only needs that the user uses any of the many browsers besides chrome.