Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?
Let's Encrypt is Trusted
21–30 of 318 posts
Re: Let's Encrypt is Trusted
#22Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?
Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").
Re: Let's Encrypt is Trusted
#23Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there other technical reasons? Anyone know? I bet this has been asked before, but not I'm turning anything up with google.
Re: Let's Encrypt is Trusted
#24Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?
No, it allows site owners to create a certificate for any domain they can prove they own. Then, the certificate has to be installed on the server serving the site. Using it from any other server will cause browsers to reject the certificate.
Re: Let's Encrypt is Trusted
#25Chrome says they don't supply Certificate Transparency information. Is this something they should be doing?
This is something we entirely plan on doing, in fact we currently submit all issued certificates to a number of CT logs (which can be viewed here https://crt.sh/?Identity=%25&iCAID=7395).
Unfortunately the best candidate, at least for us, for supplying SCT receipts to end-users, via x509v3 extensions in OCSP responses, is currently not fully supported in Golang.
Re: Let's Encrypt is Trusted
#26Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?
Let's Encrypt does validate that you own the domain, using certain "challenges" involving the web server, etc.
Their technical overview explains how it works: https://letsencrypt.org/howitworks/technology/
Re: Let's Encrypt is Trusted
#27Why python for the client software if you obviously already have Go experience in-house? Using python means you have to run all this virtual-env crap in a bash script, apt-get install a bunch of crap for setup and not support Windows. Seems like using a (nearly) dependency-free Go application for the client as well would have been a no brainer. Was it just a case of having more access to python devs, or were there ot…
I can't speak for them obviously, but here's a Go ACME client if you're looking for one: https://github.com/xenolf/lego - we're using it in Caddy[1] to make HTTPS the default for websites.
Re: Let's Encrypt is Trusted
#28Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?
As a condition of being trusted, LetsEncrypt has promised to do "domain validation" before creating such a certificate. Domain validation is usually done by sending an email to the technical contact in the domain's WHOIS records.
Re: Let's Encrypt is Trusted
#29Could somebody clarify: LetsEncrypt allows anybody to create certificate for any domain, so would not that allow anybody to create MITM certificate for any such domain?
Look at the tech overview:
https://letsencrypt.org/howitworks/technology/
You can only obtain a certificate for a domain if you can validate that you control the domain. Their steps for that (place arbitrary content at an arbitrary URL they request, or create an arbitrary DNS record they request) are such that, if you weren't the legitimate controller of the domain but could do those things, you wouldn't need a fake cert -- you'd already have pwned it thoroughly enough to be able to MITM it in other ways.
Re: Let's Encrypt is Trusted
#30Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?
Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though.
Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.