4 ms·

I wonder how long it will take for conspiracy comments like these to pass. Anyone know how long it took for people to trust Lets Encrypt? Or did we all forget

I wonder how long it will take for conspiracy comments like these to pass. Anyone know how long it took for people to trust Lets Encrypt? Or did we all forget (myself included) of the times when people talked about the issue of trusting some random 3rd party handing out free certificates?

tialaramex 7y ago
If you mean mechanically, Let's Encrypt uses cross-signed intermediates. What that means is, out of the box your Let's Encrypt cert comes supplied with a "chain" of two certificates, one says "Let's Encrypt says www.example.com has this public key K1, here's proof for Let's Encrypt's public key K2" and then the next says "Let's Encrypt key K2 is trusted on behalf of IdenTrust, here's proof for IdenTrust's key K3". The vast majority of clients in the Web PKI (including all popular web browsers when Let's Encrpyt launched) has baked in trust of IdenTrust via key K3. [ To see an example of what happens if you trust lots of other things from that era but not IdenTrust, try the web browser in a Nintendo WiiU] In parallel the not-for-profit that delivers the Let's Encrypt service, ISRG, sought similar "root trust" in their own key, let's call this K4, and created certificates that says "Let's Encrypt key K2 is trusted on behalf of ISRG, here's proof for IdenTrust's key K4" It took quite some time for the last major trust store to trust ISRG, Microsoft in I think 2018. And there will be lots of smaller or unmaintained trust stores that never catch up to this change. In 2020 ISRG has said they plan to begin weaning people off the cross-signed intermediates, providing a chain with the ISRG signatures instead. In any vaguely modern web browser this will Just Work™ but avoids any problems if at some future date IdenTrust is no longer trusted and avoids ISRG needing continuing help from IdenTrust. If you meant emotionally, I don't know. There are still plenty of people who feel sure that for some reason Let's Encrypt can't be any good because it doesn't cost money.
ohazi 7y ago
You don't need to trust Let's Encrypt anywhere near as much as you need to trust Cloudflare. With Let's Encrypt, I generate my own encryption keys and never show the private key to anyone. LE just signs the public key. The risk is that they might also sign someone else's public key as being valid for my domain. But my servers will reject any traffic that isn't encrypted with my real public key. The best an attacker could do is set up a phishing operation. But any CA can improperly sign a public key as being valid for my domain, not just LE. This is just a result of the CA system being broken by design. On the other hand, Cloudflare is usually only useful if you let them terminate TLS on your behalf. So you have to give them your private key, and they really do have access to all of your traffic. At this point, they can do whatever they want with it, largely undetectably (i.e. without the risk of releasing obviously fake certificates into the wild).

tialaramex 7y ago

If you mean mechanically, Let's Encrypt uses cross-signed intermediates. What that means is, out of the box your Let's Encrypt cert comes supplied with a "chain" of two certificates, one says "Let's Encrypt says www.example.com has this public key K1, here's proof for Let's Encrypt's public key K2" and then the next says "Let's Encrypt key K2 is trusted on behalf of IdenTrust, here's proof for IdenTrust's key K3". The vast majority of clients in the Web PKI (including all popular web browsers when Let's Encrpyt launched) has baked in trust of IdenTrust via key K3. [ To see an example of what happens if you trust lots of other things from that era but not IdenTrust, try the web browser in a Nintendo WiiU] In parallel the not-for-profit that delivers the Let's Encrypt service, ISRG, sought similar "root trust" in their own key, let's call this K4, and created certificates that says "Let's Encrypt key K2 is trusted on behalf of ISRG, here's proof for IdenTrust's key K4" It took quite some time for the last major trust store to trust ISRG, Microsoft in I think 2018. And there will be lots of smaller or unmaintained trust stores that never catch up to this change. In 2020 ISRG has said they plan to begin weaning people off the cross-signed intermediates, providing a chain with the ISRG signatures instead. In any vaguely modern web browser this will Just Work™ but avoids any problems if at some future date IdenTrust is no longer trusted and avoids ISRG needing continuing help from IdenTrust. If you meant emotionally, I don't know. There are still plenty of people who feel sure that for some reason Let's Encrypt can't be any good because it doesn't cost money.

ohazi 7y ago

You don't need to trust Let's Encrypt anywhere near as much as you need to trust Cloudflare. With Let's Encrypt, I generate my own encryption keys and never show the private key to anyone. LE just signs the public key. The risk is that they might also sign someone else's public key as being valid for my domain. But my servers will reject any traffic that isn't encrypted with my real public key. The best an attacker could do is set up a phishing operation. But any CA can improperly sign a public key as being valid for my domain, not just LE. This is just a result of the CA system being broken by design. On the other hand, Cloudflare is usually only useful if you let them terminate TLS on your behalf. So you have to give them your private key, and they really do have access to all of your traffic. At this point, they can do whatever they want with it, largely undetectably (i.e. without the risk of releasing obviously fake certificates into the wild).