Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt root certificate trusted by Mozilla

bugzilla.mozilla.org

Post reply on HN
Print view View original

21–30 of 166 posts

Re: Let's Encrypt root certificate trusted by Mozilla

#21

Post by devy »

xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

It's been discussed in details here the reason why they don't support wildcard: "doing domain validation for wildcard certificates is not currently in the ACME spec because it's a hard problem."[1]

LetsEncrypt CA allows Subject Alternative Names (SAN), the true need for an unlimited sub-domains TLS cert vs. a SAN TLS cert is minimum, given Certbot's automation capability.

[1]: https://github.com/certbot/certbot/issues/66#issuecomment-16...

Re: Let's Encrypt root certificate trusted by Mozilla

#22

Post by ge0rg »

chillydawg wrote: post #12

Excellent news. The more trust the better. It's still no good using LE for API endpoints as many client libs (java, etc) don't trust it or it's cross-signer.

It is a good practice to use key / certificate pinning for your API endpoints anyway, and there you can provide any trusted KeyStore you want...

Re: Let's Encrypt root certificate trusted by Mozilla

#26

Post by jerf »

wiradikusuma wrote: post #20

Question: any possible case of bad apples that make let's encrypt suddenly lose their trust? Eg bcoz it's free, it's used by "bad guys" just like .info tld.

The purpose of Let's Encrypt, and the SSL certificate infrastructure in general, isn't to prevent "bad guys" from getting certificates. It's to ensure that if you own the box, the certificate verifies that a web client is speaking directly to that box with nothing in between. (Or more generally, directly to an authorized end point by the owner of that DNS entry. Authority can be delegated.)

In other words, it keeps bad guys out of the middle, not the end point. That's all SSL can do, even if it works perfectly. Bad guys will still own end points, in both the conventional sense of the word own and the pwning sense of the word own. SSL can not (directly) do much about that. If you speak SSL to a bad actor, well, there aren't any other actors between you and the bad actor, but you're still speaking on an encrypted, authenticated channel to a bad actor.

This is in contrast to the DNS infrastructure in which it is sensible for a TLD owner to attempt to prevent "people they don't want on their TLD" (more generally than "bad guys" since a lot of the restrictions enforced are far beyond that).

Re: Let's Encrypt root certificate trusted by Mozilla

#28

Post by throwaway29464 »

xutopia wrote: post #15

The one thing stopping adoption for a lot of people is wilcard support. https://community.letsencrypt.org/t/please-support-wildcard-...

Check out GlobalSigns Cloud SSL product if you want a cert that can mix wildcards with top level SANs....not free but....https://www.globalsign.com/en/cloud/

Re: Let's Encrypt root certificate trusted by Mozilla

#29

Post by gsnedders »

mtgx wrote: post #8
heinrich5991 wrote: post #6

Earlier quoted context omitted.

Other browsers do not have their own certificate stores but use those provided by the OS. Next interesting things are whether Windows and Mac OS X add the root certificate. I think Linux distributions tend to follow Mozilla's trust.

Since Google is already cracking down on OEMs modifying the Android root store for various countries, I think it would make sense for Chrome to have the same root store as Android does (especially in light of Lenovo's Superfish, Dell's eDellroot and so on).

Chrome already has the ability to de-trust things trusted at the OS level, FWIW. It might be interesting to see how many OEM-installed certificates they could de-trust by default.

Re: Let's Encrypt root certificate trusted by Mozilla

#30

Post by sleepychu »

wiradikusuma wrote: post #20

Question: any possible case of bad apples that make let's encrypt suddenly lose their trust? Eg bcoz it's free, it's used by "bad guys" just like .info tld.

I think there are 2 factors. 1) Do LE do a good job of ensuring that they only grant certificates to domain holders. 2) Do they do a good job of representing what they're signing (authentication versus identification http://imgur.com/a/fAaYH)

The certificate is a kind of "encryption only" certificate, it's treated as a second class citizen (you might get a grey lock for example) so it's encrypting the communication but it's not very useful for convincing you that you're talking to your bank when you aren't.

Of course if LE don't do a good job of (1) then we're f*ed because they'll issue certificates to bad actors and LE have a hard job because now they're trusted they're a good target for DNS cache poisoning etc.

Post reply on HN