5 ms·
Maybe it's just the effect legalese sometimes has of making your head spin, but that looks like kind of a lot of "ifs" for something that's being touted as so u
by chc 11y ago
Maybe it's just the effect legalese sometimes has of making your head spin, but that looks like kind of a lot of "ifs" for something that's being touted as so universal it can justify killing HTTP.
A few requirements:
- You have not participated in the seizure of a
domain name that had ongoing lawful uses
- all information in Your Certificate regarding You or Your domain name is accurate, current, reliable, complete, and not misleading
- all information You have provided to ISRG is accurate, current, complete, reliable, complete, and not misleading
- You have taken all appropriate, reasonable, and necessary steps to secure and keep your Private Key secret
They can send you away even if you do everything they ask:
- ISRG may, in its sole discretion, refuse to grant Your request for a Let’s Encrypt Certificate, including for
reasons not stated in this Agreement
- ISRG may also, without advanced notice, revoke Your Certificate if it determines, in its sole discretion,
that … Your Certificate has become unreliable
- ISRG may also, without advanced notice, revoke Your Certificate if it determines, in its sole discretion,
that … information in your registration with ISRG or request for an Let’s Encrypt Certificate has changed
- Bedon292 11y agoThose seem like fairly reasonable 'ifs' to have. They have to cover themselves and prevent abuse, or else no one will trust the certificates they issue.
- sarciszewski 11y ago> or else no one will trust the certificates they issue I would. Especially if they refused to cooperate with the US gov't.
- chc 11y agoThey can't allow anybody who has ever been involved in a domain name seizure or no one will trust their certificates? I'm not following the causal chain there.
- mikeash 11y agoWhy? It seems to me like it should be really simple: I prove I control domain X, they issue me a certificate for domain X. End of story. Does there need to be more?
- UnoriginalGuy 11y agoWhat if someone hijacks a domain? Should they issue one then? I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.
- the8472 11y ago> What if someone hijacks a domain? But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.
- tedunangst 11y agoThe fact that I seized a domain ten years ago doesn't mean I'm not who I say I am today. Also, seizure and hijacking aren't equivalent.
- nly 11y agoWhat if a domain expires but a certificate for the domain has been issued by the previous owner?
- deleted 11y ago[deleted]
- the8472 11y agoalso > ISRG may disclose Private Recovery Information, however, if compelled to do so by court order or other compulsory legal process. If possible, ISRG will give You notice of the potential disclosure and an opportunity to contest it. this is what I expect, but then they also write > ISRG may also disclose your PRI if it believes disclosure is necessary to prevent loss of life, personal injury, damage to property, or significant financial harm. To me that sounds like an easy backdoor for corporate interests (significant financial harm) or law enforcement to bypass court orders. Isn't the legal process there in the first place to ensure that such claims are truthful? Granted, PRI seems to be about email addresses and phone numbers [possibly more? the text says "such as"], but getting disposable phone numbers is not that easy in some countries.
- ptx 11y agoIn particular the "disclose ... if it believes ... financial harm" part seems a little weird. Disclose to whom? To anybody? "If it believes" – it's impossible to disprove that someone holds a certain belief. (Can a person who is a non-human corporation even hold beliefs?) Maybe this should say something about "reasonably expect" or something along those lines, something that can be argued about if there is disagreement? As for financial harm, if I were to run a successful business on my domain, wouldn't my success in attracting customers be doing financial harm to my competitors? But, of course, IANAL!
- schoen 11y agoThanks for raising this concern. One thing to emphasize about the PRI is that (perhaps differently from what you might be used to with some domain registrars or certificate authorities), the PRI is always optional for Let's Encrypt, and is used only in case of a problem such as losing your private key. You don't have to provide the PRI in order to get a cert, and this isn't a backdoor effort to require people to give a legal name in order to get a cert. Having a working e-mail address is really valuable as a recovery mechanism -- but if you're very confident you won't need that and you don't want to give contact information, you need not do so.