If you know anything about SSL/TLS, you'll see that a certificate issued by the CA is only a notarized proof of hostname ownership, the actual key exchange or e

If you know anything about SSL/TLS, you'll see that a certificate issued by the CA is only a notarized proof of hostname ownership, the actual key exchange or encryption is done by the TLS servers and clients independently from the CA. Even with old-fashioned, forward-insecure static RSA keys, CA does not have any knowledge of its value. And with forward-secure Diffie-Hellman in modern ciphersuits, the key is not used for encryption at all. Hence, it's cryptographically impossible to exploit TLS by simply issuing certificates. Then, what are some alternative possibilities? They may include... (1) Release a backdoored version of certbot - Highly unlikely. It's a community project and has both internal and external contributors, doing so will create a highly publicized incident. Also, the issuance of certificates is performed by invoking the standardized ACME protocol and there are many independent implementations of ACME clients, not just certbot alone. (2) Arbitrarily forge certificates - It doesn't make sense at all. Of course, the NSA can do this. But setting up Let's Encrypt doesn't give you the capabilities you don't already have in your hands. The list of trusted CAs already includes hundreds of authorities, each can issue a valid certificate for an arbitrarily hostname. Also, such an attack would be a highly targeted attack, and requires a man-in-the-middle attack by hijacking the traffic of a targeted individual at the Internet backbone. It cannot be used at a large scale. (3) Issue a crafted certificate to pwn a webserver, e.g. as soon as a server gets a certificate, it exploits a buffer overflow in the ASN.1 code in some crypto libraries. Unlikely. First of all, it requires an unpatched 0day vulnerability. Even if we assume NSA does have such a 0day in its arsenal, the issued certificate would be signed by the CA, leaving an undeniable proof. In theory, this can be erased by the exploit process itself, but it will be a highly targeted attack with a lead time of three months (a certificate renewal period). It cannot be used at a large scale. If the NSA is planning to compromise your webserver using this method, you'll have more serious things to worry - the NSA may choose to exploit your TCP stack or webserver as well. All things considered, you cannot use (1), (2) and (3) for an mass surveillance campaign against the majority of users in a way similar to the surveillance of plaintext HTTP. As soon as you scale it up, it'll be detected immediately. And speaking of targeted attacks, the NSA always has more than one way to execute such an attack, Let's Encrypt can only give the NSA a minor advantage. Nevertheless, if you are a conspiracy-minded tin-foil hatter, the following story can make better sense than (1), (2) or (3)... > The NSA is doing this as a psychological operation with the intend of increasing the public trust of the existing SSL/TLS systems, so that a potential alternative system to SSL/TLS with better security properties would not be developed, thus, by supporting and popularizing the use of SSL/TLS via Let's Encrypt, it gives NSA a chance to continue exploiting existing flaws in TLS systems. But this is a new level of absurd mental gymnastics.