5 ms·
I suppose it would be trivial for them to issue compromised certificates or record the private key in a targetted attack for a specific domain without anyone no
by drummer 7y ago
I suppose it would be trivial for them to issue compromised certificates or record the private key in a targetted attack for a specific domain without anyone noticing.
- seanhunter 7y agoWould be trivial except for the fact that they don't issue certificates.
- advisedwang 7y agoDuring normal certificate issuance, they do not generate or see the private key, so they can't compromise the certs they sign for you. Like any other CA, they do have the technical ability to sign arbitrary other certs, so could issue a cert for MITM. As some other comments show, certificate transparency is starting to reduce this risk.
- jeffrallen 7y agoLE does not see the private key but certbot does. Who audits certbot?
- nwallin 7y agoAnyone. It's open source. You can if you'd like. https://github.com/certbot/certbot https://github.com/certbot/certbot