4 ms·

I am also concerned about the centralisation of everyone going to Let's encrypt. Yes they are non-profit but they are located in the United States and must foll

I am also concerned about the centralisation of everyone going to Let's encrypt. Yes they are non-profit but they are located in the United States and must follow US laws.

cpach 7y ago
Anyone could launch LE2 outside of US. All the protocols are open. You need some capital though.
- darkwater 7y ago
  And some already trusted CA to cross-sign your certificate...
  - cpach 7y ago
    That is not strictly required though. LE did this in order to speed up the rollout but you can also skip that step and submit the root CA to the appropriate places, e.g. Mozillaʼs CA Certificate Program.
    - darkwater 7y ago
      And then you lose all the older browser installations... There was a reason if LE went the way they went and basically it is retro-compatibility. Anyway I'm not arguing that it would be impossible to create an LE2 but it would not be that simple. Especially if the buyer is someone already in the certificates business that wants to destroy the "free-for-all" concept.
      - GuyPostington 7y ago
        To help produce an LE2, please contribute to https://github.com/tdelmas/Let-s-Clone https://github.com/tdelmas/Let-s-Clone
user1980 7y ago
Too big to fail: It's not just for banks any more. If LE is compromised a few times and some fraudulent facebook.com or google.com certs leak out, how long before Firefox/Chrome/Edge blacklist their root cert like they did with Symantec[1], and end up breaking half the internet? I understand that ACME is an open standard, but can someone point me to an alternative ACME provider that isn't "please call us for a quote" enterprise-grade? [1]: https://blog.mozilla.org/security/2018/03/12/distrust-symantec-tls-certificates/ https://blog.mozilla.org/security/2018/03/12/distrust-symant...
- move-on-by 7y ago
  Seems like a reasonable fear, but it is mitigated by short certificate lifespans. Symantec was much more painful to distrust due to multi-year certificate lengths.

I am also concerned about the centralisation of everyone going to Let's encrypt. Yes they are non-profit but they are located in the United States and must follow US laws.

cpach 7y ago

Anyone could launch LE2 outside of US. All the protocols are open. You need some capital though.

darkwater 7y ago
And some already trusted CA to cross-sign your certificate...
- cpach 7y ago
  That is not strictly required though. LE did this in order to speed up the rollout but you can also skip that step and submit the root CA to the appropriate places, e.g. Mozillaʼs CA Certificate Program.
  - darkwater 7y ago
    And then you lose all the older browser installations... There was a reason if LE went the way they went and basically it is retro-compatibility. Anyway I'm not arguing that it would be impossible to create an LE2 but it would not be that simple. Especially if the buyer is someone already in the certificates business that wants to destroy the "free-for-all" concept.
    - GuyPostington 7y ago
      To help produce an LE2, please contribute to https://github.com/tdelmas/Let-s-Clone https://github.com/tdelmas/Let-s-Clone

user1980 7y ago

Too big to fail: It's not just for banks any more. If LE is compromised a few times and some fraudulent facebook.com or google.com certs leak out, how long before Firefox/Chrome/Edge blacklist their root cert like they did with Symantec[1], and end up breaking half the internet? I understand that ACME is an open standard, but can someone point me to an alternative ACME provider that isn't "please call us for a quote" enterprise-grade? [1]: https://blog.mozilla.org/security/2018/03/12/distrust-symantec-tls-certificates/ https://blog.mozilla.org/security/2018/03/12/distrust-symant...

move-on-by 7y ago
Seems like a reasonable fear, but it is mitigated by short certificate lifespans. Symantec was much more painful to distrust due to multi-year certificate lengths.