4 ms·

Let's Encrypt is awesome—it's great to be able to not have to deal with buying and renewing certs, and I think the ease of doing this now is great for securing

Let's Encrypt is awesome—it's great to be able to not have to deal with buying and renewing certs, and I think the ease of doing this now is great for securing the Web. It's great to hear that they're spinning out ISRG as a separate organization to do the same thing for other parts of the Internet. The only thing that worries me about LE is that it's almost too easy. What happens when 90+% of the Web is running certificates from the same issuer? Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt from becoming a single point of failure?

jaas 8y ago
Let's Encrypt is the name of a service, ISRG is the non-profit legal entity that provides the service. ISRG was created in 2013 to be the legal entity behind the Let's Encrypt service. It's not being "spun out," we just never had a website for the legal entity itself until recently.
xoa 8y ago
>The only thing that worries me about LE is that it's almost too easy. What happens when 90+% of the Web is running certificates from the same issuer? Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt from becoming a single point of failure? Not that I've given it deep thought, but do you think their core strategy would fundamentally make it easier for a second wave if it ever came to that? Compared to traditional CAs Let's Encrypt is all about automation and rapid expiration, and they've not only built significant open source tools to that effect but also gotten the community used to operating that way. At least at a high level it seems like they had a steeper hill to climb just in terms of being quite different from before, but now that the standards have improved and practices are in place it'd be a lot easier for everyone to simply point at new ACME CAs if LE ever went down, and old certificates would then cycle out rapidly and automatically. Obviously actually establishing a good new CA that would be trusted wouldn't be trivial itself, but it's also more abstracted from the end user then before. And there are major entities that could step up in an emergency. I may be missing something here, but at least my feeling has been that LE is not merely providing a good service for now, but permanently improving the entire ecosystem in a lasting way and that if root forbid a meteor hit them or something it'd still be possible to recover better then before.
- sudhirj 8y ago
  Absolutely. Not only has it encouraged other capable companies to start their own CAs, switching between CAs will pretty much be a endpoint configuration. Think that’s already the case with the test vs production server, no reason it can’t point anywhere else.
marcosdumay 8y ago
> What happens when 90+% of the Web is running certificates from the same issuer? It looks like a bad thing, but the TLS CAs are organized in such a way that any rogue issuer can compromise any certificate. This way, consolidation only reduces the risks.
- toast0 8y ago
  Consolidation reduces the risk of a CA issuing a rogue certificate, probably. It increases the risk that the rogue CA is the CA that issued your certificates; in the worst case of swift revocation of the CA by browsers, that's not a fun place to be as a customer. Especially if you've done something like CA pinning (in or out of browser context)
cpach 8y ago
”Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt from becoming a single point of failure?” This is an interesting question. Let’s Encrypt is built on openness and open source software, so it’s possible to ”clone” their service. However, it would require some funds to do so. (According to the article, they now operate on $3.6M/year.) So I can’t see that happening soon, not as long as Let’s Encrypt run their service in a trustworthy manner. But perhaps some entity would spin up a niched version. E.g. if a country would launch it’s own LE service for their citizens and domestic companies and organizations. [Edited again regarding funds required.]

jaas 8y ago

Let's Encrypt is the name of a service, ISRG is the non-profit legal entity that provides the service. ISRG was created in 2013 to be the legal entity behind the Let's Encrypt service. It's not being "spun out," we just never had a website for the legal entity itself until recently.

xoa 8y ago

>The only thing that worries me about LE is that it's almost too easy. What happens when 90+% of the Web is running certificates from the same issuer? Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt from becoming a single point of failure? Not that I've given it deep thought, but do you think their core strategy would fundamentally make it easier for a second wave if it ever came to that? Compared to traditional CAs Let's Encrypt is all about automation and rapid expiration, and they've not only built significant open source tools to that effect but also gotten the community used to operating that way. At least at a high level it seems like they had a steeper hill to climb just in terms of being quite different from before, but now that the standards have improved and practices are in place it'd be a lot easier for everyone to simply point at new ACME CAs if LE ever went down, and old certificates would then cycle out rapidly and automatically. Obviously actually establishing a good new CA that would be trusted wouldn't be trivial itself, but it's also more abstracted from the end user then before. And there are major entities that could step up in an emergency. I may be missing something here, but at least my feeling has been that LE is not merely providing a good service for now, but permanently improving the entire ecosystem in a lasting way and that if root forbid a meteor hit them or something it'd still be possible to recover better then before.

sudhirj 8y ago
Absolutely. Not only has it encouraged other capable companies to start their own CAs, switching between CAs will pretty much be a endpoint configuration. Think that’s already the case with the test vs production server, no reason it can’t point anywhere else.

marcosdumay 8y ago

> What happens when 90+% of the Web is running certificates from the same issuer? It looks like a bad thing, but the TLS CAs are organized in such a way that any rogue issuer can compromise any certificate. This way, consolidation only reduces the risks.

toast0 8y ago
Consolidation reduces the risk of a CA issuing a rogue certificate, probably. It increases the risk that the rogue CA is the CA that issued your certificates; in the worst case of swift revocation of the CA by browsers, that's not a fun place to be as a customer. Especially if you've done something like CA pinning (in or out of browser context)

cpach 8y ago

”Are there any plans to run alternate free ACME CAs to prevent Let's Encrypt from becoming a single point of failure?” This is an interesting question. Let’s Encrypt is built on openness and open source software, so it’s possible to ”clone” their service. However, it would require some funds to do so. (According to the article, they now operate on $3.6M/year.) So I can’t see that happening soon, not as long as Let’s Encrypt run their service in a trustworthy manner. But perhaps some entity would spin up a niched version. E.g. if a country would launch it’s own LE service for their citizens and domestic companies and organizations. [Edited again regarding funds required.]