4 ms·

Those seem like fairly reasonable 'ifs' to have. They have to cover themselves and prevent abuse, or else no one will trust the certificates they issue.

sarciszewski 11y ago
> or else no one will trust the certificates they issue I would. Especially if they refused to cooperate with the US gov't.
chc 11y ago
They can't allow anybody who has ever been involved in a domain name seizure or no one will trust their certificates? I'm not following the causal chain there.
mikeash 11y ago
Why? It seems to me like it should be really simple: I prove I control domain X, they issue me a certificate for domain X. End of story. Does there need to be more?
- UnoriginalGuy 11y ago
  What if someone hijacks a domain? Should they issue one then? I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.
  - the8472 11y ago
    > What if someone hijacks a domain? But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.
    - _cpancake 11y ago
      Part of HTTPS is making sure that the person you're talking to is the person you think you're talking to.
      - the8472 11y ago
        That's what EV certificates are for. Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.
  - tedunangst 11y ago
    The fact that I seized a domain ten years ago doesn't mean I'm not who I say I am today. Also, seizure and hijacking aren't equivalent.
- nly 11y ago
  What if a domain expires but a certificate for the domain has been issued by the previous owner?
  - mikeash 11y ago
    I would think a cert shouldn't be issued with an expiration date after that of the domain registration itself.
    - kijin 11y ago
      That would work with common gTLDs, but some ccTLDs have a very annoying policy where they only allow one-year renewals and the renewal doesn't show up in the whois until the last moment. Anyway, it's trivial to find out whether a domain was expired and re-registered. The date of initial registration in the whois will change, so you can just compare it with the value you saw when you first issued a certificate for that domain.

sarciszewski 11y ago

> or else no one will trust the certificates they issue I would. Especially if they refused to cooperate with the US gov't.

chc 11y ago

They can't allow anybody who has ever been involved in a domain name seizure or no one will trust their certificates? I'm not following the causal chain there.

mikeash 11y ago

Why? It seems to me like it should be really simple: I prove I control domain X, they issue me a certificate for domain X. End of story. Does there need to be more?

UnoriginalGuy 11y ago
What if someone hijacks a domain? Should they issue one then? I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.
- the8472 11y ago
  > What if someone hijacks a domain? But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.
  - _cpancake 11y ago
    Part of HTTPS is making sure that the person you're talking to is the person you think you're talking to.
    - the8472 11y ago
      That's what EV certificates are for. Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.
- tedunangst 11y ago
  The fact that I seized a domain ten years ago doesn't mean I'm not who I say I am today. Also, seizure and hijacking aren't equivalent.
nly 11y ago
What if a domain expires but a certificate for the domain has been issued by the previous owner?
- mikeash 11y ago
  I would think a cert shouldn't be issued with an expiration date after that of the domain registration itself.
  - kijin 11y ago
    That would work with common gTLDs, but some ccTLDs have a very annoying policy where they only allow one-year renewals and the renewal doesn't show up in the whois until the last moment. Anyway, it's trivial to find out whether a domain was expired and re-registered. The date of initial registration in the whois will change, so you can just compare it with the value you saw when you first issued a certificate for that domain.