4 ms·
During normal certificate issuance, they do not generate or see the private key, so they can't compromise the certs they sign for you. Like any other CA, they
by advisedwang 7y ago
During normal certificate issuance, they do not generate or see the private key, so they can't compromise the certs they sign for you.
Like any other CA, they do have the technical ability to sign arbitrary other certs, so could issue a cert for MITM. As some other comments show, certificate transparency is starting to reduce this risk.
- jeffrallen 7y agoLE does not see the private key but certbot does. Who audits certbot?
- nwallin 7y agoAnyone. It's open source. You can if you'd like. https://github.com/certbot/certbot https://github.com/certbot/certbot