4 ms·
Because then you'd be centralizing control of certificate validation in a single corporation, and creating a too-big-to-fail CA that can't be distrusted if it s
by Ajedi32 7y ago
Because then you'd be centralizing control of certificate validation in a single corporation, and creating a too-big-to-fail CA that can't be distrusted if it screws up for fear of breaking the entire internet.
- vbezhenar 7y agoWe will have enough time to switch to the new CA if necessary. And ACME protocol is independent, so software just needs to update some configuration values. Anyway letsencrypt already serves 80% of market. So it's already too big to fail, I don't see much difference between 80% and 100%. But dozens of random CA roots in my browser do bother me.
- eridius 7y ago> Anyway letsencrypt already serves 80% of market. So it's already too big to fail, I don't see much difference between 80% and 100%. The difference is all the big websites still pay for certs, so if LE is distrusted then your bank will still work, google.com will still work, apple.com will still work, etc.
- M2Ys4U 7y agoYes, and we need ones that aren't in the USA's jurisdiction, too.