4 ms·
Thomas, I’m not sure what you mean when you say that certificates are free. Self-signed certs are free, but only situationally useful in a business context. Let
by politician 4y ago
Thomas, I’m not sure what you mean when you say that certificates are free. Self-signed certs are free, but only situationally useful in a business context. Let’s Encrypt certs are free, but not usable in all contexts. GoDaddy, Namecheap, and Verisign will still gladly charge $50-$1500 for certs will various features like $50/SAN, and extended validation. If you want to terminate TLS at an AWS managed edge resource, the happy path is ACM. These are “free”, but arguably you’re paying for the cert with the load balancer or edge resource.
There’s no difference between a blockchain and a cryptographically secure write ahead log, indeed that is how blockchains are defined. Perhaps you assumed that I meant cryptocurrency when I said blockchain? I did not.
(Sorry for the delayed reply.)
- tptacek 4y agoTell me more about the contexts in which you can't use LetsEncrypt certificates.
- ipaddr 4y agoOlder OS. Certbot only supports a limited number of OS (centos 6 not so much). Longer expiry dates.
- devman0 4y agoCertbot isn't the only way to automate Let's Encrypt certificate issuance, and even if it was, you can use hooks to have certbot push certs to other machines.
- politician 4y agoSure - for example, when the organization requires an OV or EV certificate.
- tptacek 4y agoYeah, and that happens where?
- akerl_ 4y agoWhat’s the use case for OV/EV certs? I thought it was reasonably well established that they herald from the same era as “this site secured by Symantec” icons, and were basically just the same security as DV certs but with the wheels painted chrome and an extra tax for gullible buyers.
- tptacek 4y agoIt doesn't matter, right? Because anyone who relies on OV/EV certs has chosen to rely on OV/EV certs. If we replaced the whole WebPKI edifice with a blockchain, they'd still make the same decision not to trust the baseline system. When we talk about the WebPKI being coercively annoying, what we're really talking about are the roots of trust that the browsers have chosen to trust. No browser requires OV/EV.
- politician 4y agoYes, a baseline system built on a blockchain could support the validated identity and KYC features of OV/EV certificates. Indeed, this already exists in Sovrin (sovrin.org).
- politician 4y agoThe use case is knowing that a server is owned by who it says it's owned by as validated by a trusted KYC provider. For example, Stripe has an EV cert. Let's Encrypt does not support OV/EV because they cannot automate the KYC checks. Let's Encrypt is focused on the encrypted connection use case.