4 ms·

> How many times would LE have to accidentally issue gstatic.com or fbcdn.net before they get the Symantec treatment[1]? Too big to fail: It's not just for inve

> How many times would LE have to accidentally issue gstatic.com or fbcdn.net before they get the Symantec treatment[1]? Too big to fail: It's not just for investment banks. And that should give anyone seeking a decentralized internet pause. I agree that some problems are unfortunate. But let's contrast for a moment. LetsEncrypt has demonstrated track record of quickly fixing issues. Symantec has a demonstrated track record of hiding issues instead of fixing them. It's wise to consider options carefully. LetsEncrypt isn't the be-all end-all service for TLS and your needs might not be compatible. But I don't think it's fair to shove LetsEncrypt aside just because it's had its share of problems. For a free service it's pretty damn reputable.

treis 6y ago
It's a good service, but I think the GP's point is that it's not trivial to do. Lots of websites probably went down because they missed that e-mail and we've seen lots of major websites go down due to some issue related to their certificate. Let's Encrypt has lowered the bar, but it's still a bar that needs to be overcome.
- tialaramex 6y ago
  As we'd expect ISRG not only fixed the immediate problem they also accelerated plans to ensure that any similar problem would have less serious ill effects. In particular a current Certbot (or similar software from other developers) will conclude that it should try to replace a certificate which has been revoked and not only certificates that will shortly expire. So if a similar event happened, and you missed the email, your Certbot will treat the certificates much as if they'd expired and replace them automatically. Also if you didn't replace a revoked certificate the thing is: Online revocation is broken. Most of your users will not have noticed your certificate was revoked. Popular browsers do have an out-of-band way to enforce revocation but they didn't use it on that Let's Encrypt incident because they felt it was low risk. So maybe some people are running Internet Explorer (really?) or have explicitly turned on revocation, everybody else doesn't even see a warning page.

treis 6y ago

It's a good service, but I think the GP's point is that it's not trivial to do. Lots of websites probably went down because they missed that e-mail and we've seen lots of major websites go down due to some issue related to their certificate. Let's Encrypt has lowered the bar, but it's still a bar that needs to be overcome.

tialaramex 6y ago
As we'd expect ISRG not only fixed the immediate problem they also accelerated plans to ensure that any similar problem would have less serious ill effects. In particular a current Certbot (or similar software from other developers) will conclude that it should try to replace a certificate which has been revoked and not only certificates that will shortly expire. So if a similar event happened, and you missed the email, your Certbot will treat the certificates much as if they'd expired and replace them automatically. Also if you didn't replace a revoked certificate the thing is: Online revocation is broken. Most of your users will not have noticed your certificate was revoked. Popular browsers do have an out-of-band way to enforce revocation but they didn't use it on that Let's Encrypt incident because they felt it was low risk. So maybe some people are running Internet Explorer (really?) or have explicitly turned on revocation, everybody else doesn't even see a warning page.