5 ms·
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
by buboard 7y ago
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
- manderley 7y agoThat's due to US sanctions.
- deleted 7y ago[deleted]
- mcpherrinm 7y agoRight, that's another reason it would be good to have non-US competition. It's not LE's fault or anything they can do about, but there's plenty of reasons to have alternative options.
- tialaramex 7y agoSure, but it would be reasonable for an outfit to (seek funding for) a CA that isn't subject to US sanction rules. Of course there's a question of where you should put such a thing. Even Russians apparently don't find the idea of a Russian CA trustworthy (they expect that Putin would have his thumb on it, and who am I to argue?), a European CA is certainly not free of American influence, so where would this alternative be based? I don't have a good answer.
- dheera 7y agoStart a LetTheRestOfUsEncrypt.org based in a different country whose government isn't so full of themselves? Or better yet, is there a way to start a decentralized organization itself so that no jurisdiction has absolute power over it?
- henryfjordan 7y agoHow are you going to trust that decentralized org? Is it just voting? Can we all vote to revoke anyone's cert at any time for no reason? What happens when someone performs a 51% attack and takes over google.com's cert? CAs exist solely because you CAN trust them, otherwise what's the point? We'd just have every site self-sign and let the users choose who to trust.
- JohnFen 7y ago> CAs exist solely because you CAN trust them, otherwise what's the point? That's the idea, but in practice, I don't really trust the vast majority of them.
- dheera 7y agoMy thinking was that it would be similar to a GPG trust network.
- tatersolid 7y agoWe’ve seen nearly 30 years of web-of-trust failure and yet you still think it’s a workable idea?
- rswail 7y agoAs far as I am aware, the only organizations that aren't under the jurisdiction of any nation state or authority are those sponsored by/derived from the United Nations.
- jaas 7y agoYes we do. On what basis did you make that statement? We comply with U.S. sanctions by not issuing to entities on the SDN list, but that doesn't prevent us from serving the vast majority of people in those countries.
- henryfjordan 7y agoHow do you know if someone is on the list? When I registered my domain I got WHOIS protection and then LE just made sure I owned the domain. There was no asking about who I am or where I reside or what lists I might be on.
- jaas 7y agoYou can search the list here: https://www.treasury.gov/resource-center/sanctions/sdn-list/pages/default.aspx https://www.treasury.gov/resource-center/sanctions/sdn-list/... Some entries have specific domains associated with them, but we are obligated to not serve any domain directly associated with (i.e. controlled by) an SDN entity, not just those listed. If we become aware that we may be serving an entity on the SDN list (often via someone emailing us) we have to conduct an investigation which may result in termination of service.
- buboard 7y agoindeed I misread it. you don't provide certs for the governments of those countries (still a limitation tbh). I got that from this post of one of your employees https://community.letsencrypt.org/t/certificates-for-us-sanctioned-countries/1223 https://community.letsencrypt.org/t/certificates-for-us-sanc...
- falcongod082 7y agoWell that's interesting, so these are political certs?
- IfOnlyYouKnew 7y agono, they are legal certs.
- amiraliakbari 7y agoI haven't checked their TOS, but practically there isn't any limitations in getting certificates from Iranian IPs or for ir domains. If there is any problem, it is that browser vendors/root CAs/etc are not willing to trust CAs in those countries.