4 ms·
Let's encrypt is also "hilariously" centralised. What do you do if Let's encrypt is blocked in your country or they refuse to issue you a certificate because of
by sschueller 8y ago
Let's encrypt is also "hilariously" centralised. What do you do if Let's encrypt is blocked in your country or they refuse to issue you a certificate because of US sanctions?
- lolc 8y agoBlock Let's Encrypt? How would that even work? They'd have to block all addresses where the webserver uses Let's Encrypt certificates. Or MITM your SSL connections. If Let's Encrypt is blocked, you're not getting the full Internet. Complain with your ISP or government if they do that! If Let's Encrypt refuses to cert your domains, got to another provider. They're not the only one.
- amaccuish 8y ago> They'd have to block all addresses where the webserver uses Let's Encrypt certificates. They're talking about blocking access to letsencrypt servers, which would prevent you from getting a certificate.
- lolc 8y agoOh. That exists? I still don't see how that would be a problem Debian should consider in their considertions around SSL. After all, if your server's upstream is blocks access to Let's Encrypt servers, why are you trying to operate an official Debian mirror there? What's the point of having a Debian mirror connected to such a shitty upstream?
- sschueller 8y agoThere is also the possibility that Let's Encrypt will not issue your domain TLD a certificate if for example there are US sanctions against that country. There is a strong need for a second "Let's Encrypt" based in another country other than the US. Preferably two or three based in Europe and Asia. [1] https://community.letsencrypt.org/t/certificates-for-us-sanctioned-countries/1223/4 https://community.letsencrypt.org/t/certificates-for-us-sanc...