6 ms·
They aren't the only no-cost distributor, their downtime doesn't really matter so long as it's less than a month long. What exactly is the issue with centraliz
by RL_Quine 6y ago
They aren't the only no-cost distributor, their downtime doesn't really matter so long as it's less than a month long.
What exactly is the issue with centralization here?
- acct776 6y ago> They aren't the only no-cost distributor I couldn't name a second, which means they're probably not getting a huge %.
- cholmon 6y agoHow would Netlify feel about not being able to issue or renew any certs for any sites for a month? Plenty of platforms rely on LE exclusively for one-click/automatic HTTPS for their customers sites.
- Denvercoder9 6y agoLet's Encrypt isn't the only provider supporting ACME either. Sectigo (under the ZeroSSL name) is a notable alternative.
- mvolfik 6y agoThe thing is that we're not talking downtime here, but rather something in the CA compromised, which would mean that pretty much ANY website could be impersonated, as the attacker could issue a Let's Encrypt CA valid certificate for it. That is mitigated by invalidating this CA, but that also invalidates all legit certificates previously issued by them. So they need to reissue them all
- warkdarrior 6y agoLet's Encrypt publishes Certificate Transparency logs: https://letsencrypt.org/docs/ct-logs/ https://letsencrypt.org/docs/ct-logs/ You can both block certs that do not appear in the logs, and decide which certs not to trust ("everything after Friday the 13th at midnight is not trusted"), once you know the date/time of the intrusion.