3 ms·

My limited understanding is that Let's Encrypt's mission is to make encrypted web traffic available to as wide a population as possible. A six page legal agreem

My limited understanding is that Let's Encrypt's mission is to make encrypted web traffic available to as wide a population as possible. A six page legal agreement seems like an obstacle to that, especially if they want to serve that portion of the population who might not be accustomed to such things. Keeping it short and simple would seem like a high priority; though perhaps this is as short and simple as it can reasonably get.

schoen 11y ago
I encourage people to propose ways that it might be made shorter. The CA/B Forum requires CAs to have legally-binding subscriber agreements covering the issuance of certificates. For example, check out section 9.6.1 of Baseline Requirements 1.3.0 ("CA Representations and Warranties"). https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.pdf https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.p...
- tedunangst 11y ago
  Is it necessary for lets encrypt to be a part of the cab forum? One might argue that the cab forum is part of the problem.
  - UnoriginalGuy 11y ago
    They're definitely part of the problem, but they're a powerful kingmaker in the industry. Without their approval several vendors won't include the Let's Encrypt CA at all. So it ultimately boils down to: Dance with the devil and become relevant, or maintain the moral high ground and accomplish nothing.
    - bifurcation 11y ago
      You've got things a little confused here. Let's Encrypt doesn't need to be part of the CABF in order to be included in the browsers, but they do need to demonstrate that they abide by the rules that CABF defines (the Baseline Requirements). They only need to join CABF if they want to be able to vote on those rules.
    - yellowapple 11y ago
      > Without their approval several vendors won't include the Let's Encrypt CA at all. Which ones? Let's Encrypt is Mozilla's baby IIRC, so this will almost certainly be recognized as valid by them with or without CAB membership, which means that Firefox and Firefox OS are both instantly covered. The former makes up a pretty sizable chunk of desktop user agents and (probably) a smaller but still significant chunk of mobile user agents (not including Firefox OS). This leaves Google, Microsoft, Apple, the major GNU/Linux distro vendors (Red Hat, Canonical, SUSE/Novell), and maintainers of other operating system projects ((Open|Free|Net)BSD, Solaris/illumos folks (Oracle, Joyent, etc.), etc.). * Google seems to be a proponent of ubiquitous encryption/HTTPS, and a free and easy-to-use CA aligns with that goal. I reckon they're more likely to support the Let's Encrypt CA than not for this reason, regardless of CAB membership. Thus, Chrome/Chromium, ChromeOS, and Android - the other significant chunk of desktop user agents, and arguably the most significant chunk of mobile user agents aside from feature phones (which will likely be phased out with low-cost Android and FirefoxOS devices anyway), will end up supporting Let's Encrypt's CA. * Most GNU/Linux distros I'm aware of use Firefox as the default/primary browser in desktop deployments (the notable exception being Lubuntu last I checked), and many of them use Mozilla's cert bundle for their CA needs. I'd expect most other free software operating systems to follow suit. * I'm not sure what Solaris uses as a default browser nowadays for desktop use (not that there are a whole lot of desktop Solaris users in the wild anymore...), but it's probably Firefox. Oracle tends to be more interested in bureaucratic institutions like the CAB, though, so they might hold off on Let's Encrypt for a long while (and thus further accelerating the effects of their sidaM touch on Solaris, but whatever). Most illumos-based operating systems (like OpenIndiana and SmartOS) will likely be more receptive to Let's Encrypt, though their desktop significance is also pretty low. * This leaves Microsoft and Apple. On one hand, these particular vendors - like Oracle - tend to favor bureaucracy over common sense. On the other hand, Let's Encrypt probably wouldn't be the first non-CAB CA they've recognized as valid. On the third hand, it wouldn't be above Microsoft to spin off some "Visual Cert.NET 3.11# for Workgroups(TM)" as a competitor of sorts to draw folks toward Microsoft's sphere of influence (meanwhile, Apple would be no stranger to waiting for a few years before taking the trendy idea that everyone else is coming up with, calling it the "Apple Cert" with an Apple logo instead of the word "Apple", and insist that everyone calling it the "iCert" are ignoramuses while politely ignoring that - like their watches - they're about half a decade late to the game). So - to summarize - two of the three most significant desktop browser vendors (Mozilla and Google), one of the two most significant smartphone browser/OS vendors (Google), and both of the two viable dumb->smart phone browser/OS vendors (Mozilla and Google) will in all likelihood recognize Let's Encrypt's validity regardless of whether or not it's a member of some random bureaucracy. That's a pretty substantial market driver.
  - schoen 11y ago
    Only 44 CAs are actually members of the Forum: https://cabforum.org/members/ https://cabforum.org/members/ You'll see that that's far from including all root or intermediate CAs that are active on the web. But the major browsers have incorporated the Forum's standards directly or indirectly into their root certificate programs. If a CA doesn't comply with the standards, it will be harder for the CA (or its parent, if it's an intermediate) to be trusted by browsers.

schoen 11y ago

I encourage people to propose ways that it might be made shorter. The CA/B Forum requires CAs to have legally-binding subscriber agreements covering the issuance of certificates. For example, check out section 9.6.1 of Baseline Requirements 1.3.0 ("CA Representations and Warranties"). https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.pdf https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.p...

tedunangst 11y ago
Is it necessary for lets encrypt to be a part of the cab forum? One might argue that the cab forum is part of the problem.
- UnoriginalGuy 11y ago
  They're definitely part of the problem, but they're a powerful kingmaker in the industry. Without their approval several vendors won't include the Let's Encrypt CA at all. So it ultimately boils down to: Dance with the devil and become relevant, or maintain the moral high ground and accomplish nothing.
  - bifurcation 11y ago
    You've got things a little confused here. Let's Encrypt doesn't need to be part of the CABF in order to be included in the browsers, but they do need to demonstrate that they abide by the rules that CABF defines (the Baseline Requirements). They only need to join CABF if they want to be able to vote on those rules.
  - yellowapple 11y ago
    > Without their approval several vendors won't include the Let's Encrypt CA at all. Which ones? Let's Encrypt is Mozilla's baby IIRC, so this will almost certainly be recognized as valid by them with or without CAB membership, which means that Firefox and Firefox OS are both instantly covered. The former makes up a pretty sizable chunk of desktop user agents and (probably) a smaller but still significant chunk of mobile user agents (not including Firefox OS). This leaves Google, Microsoft, Apple, the major GNU/Linux distro vendors (Red Hat, Canonical, SUSE/Novell), and maintainers of other operating system projects ((Open|Free|Net)BSD, Solaris/illumos folks (Oracle, Joyent, etc.), etc.). * Google seems to be a proponent of ubiquitous encryption/HTTPS, and a free and easy-to-use CA aligns with that goal. I reckon they're more likely to support the Let's Encrypt CA than not for this reason, regardless of CAB membership. Thus, Chrome/Chromium, ChromeOS, and Android - the other significant chunk of desktop user agents, and arguably the most significant chunk of mobile user agents aside from feature phones (which will likely be phased out with low-cost Android and FirefoxOS devices anyway), will end up supporting Let's Encrypt's CA. * Most GNU/Linux distros I'm aware of use Firefox as the default/primary browser in desktop deployments (the notable exception being Lubuntu last I checked), and many of them use Mozilla's cert bundle for their CA needs. I'd expect most other free software operating systems to follow suit. * I'm not sure what Solaris uses as a default browser nowadays for desktop use (not that there are a whole lot of desktop Solaris users in the wild anymore...), but it's probably Firefox. Oracle tends to be more interested in bureaucratic institutions like the CAB, though, so they might hold off on Let's Encrypt for a long while (and thus further accelerating the effects of their sidaM touch on Solaris, but whatever). Most illumos-based operating systems (like OpenIndiana and SmartOS) will likely be more receptive to Let's Encrypt, though their desktop significance is also pretty low. * This leaves Microsoft and Apple. On one hand, these particular vendors - like Oracle - tend to favor bureaucracy over common sense. On the other hand, Let's Encrypt probably wouldn't be the first non-CAB CA they've recognized as valid. On the third hand, it wouldn't be above Microsoft to spin off some "Visual Cert.NET 3.11# for Workgroups(TM)" as a competitor of sorts to draw folks toward Microsoft's sphere of influence (meanwhile, Apple would be no stranger to waiting for a few years before taking the trendy idea that everyone else is coming up with, calling it the "Apple Cert" with an Apple logo instead of the word "Apple", and insist that everyone calling it the "iCert" are ignoramuses while politely ignoring that - like their watches - they're about half a decade late to the game). So - to summarize - two of the three most significant desktop browser vendors (Mozilla and Google), one of the two most significant smartphone browser/OS vendors (Google), and both of the two viable dumb->smart phone browser/OS vendors (Mozilla and Google) will in all likelihood recognize Let's Encrypt's validity regardless of whether or not it's a member of some random bureaucracy. That's a pretty substantial market driver.
- schoen 11y ago
  Only 44 CAs are actually members of the Forum: https://cabforum.org/members/ https://cabforum.org/members/ You'll see that that's far from including all root or intermediate CAs that are active on the web. But the major browsers have incorporated the Forum's standards directly or indirectly into their root certificate programs. If a CA doesn't comply with the standards, it will be harder for the CA (or its parent, if it's an intermediate) to be trusted by browsers.