21–29 of 29 posts
This is a very nice recognition! I realized that the registrar I have my personal site with purposefully does not support Let's Encrypt as a CA. Anyone have a registrar they'd recommend these days to transfer a domain to? FYI, the crappy registrar/host in question is namecheap.com so you can avoid them in the future.
This is a very nice recognition! I realized that the registrar I have my personal site with purposefully does not support Let's Encrypt as a CA. Anyone have a registrar they'd recommend these days to transfer a domain to? FYI, the crappy registrar/host in question is namecheap.com so you can avoid them in the future.
The domain registrar is unrelated to LE and can’t block LE. Just install caddy on a $5/mo VPS instead of using your domain registrar as a host. It will automatically renew LE certs. Your current setup is almost always a terrible idea.
This is a very nice recognition! I realized that the registrar I have my personal site with purposefully does not support Let's Encrypt as a CA. Anyone have a registrar they'd recommend these days to transfer a domain to? FYI, the crappy registrar/host in question is namecheap.com so you can avoid them in the future.
If you don't feel like switching over this, I do this with dnsrobocert, with Namecheap's default DNS servers: https://github.com/adferrand/dnsrobocert
Earlier quoted context omitted.
Let's Encrypt is a CA. Their involvement with web cryptography begins and ends with signing certificates which are used for authentication -- they have no say over what cryptography actually gets used for a TLS connection.
They are concentrating authority which is never good
Honestly, not by much. There are maybe half a dozen major CAs that make up the vast majority (95%+) of certificate issuance, and that number has been shrinking as poorly run CAs have been shut down (like GeoTrust) and other CAs have gone through cycles of acquisition (like Verisign/Symantec/DigiCert).
Besides, a lot of the market share which Let's Encrypt has acquired has been by expanding the market, rather than taking it from other players. Ten years ago, less than 25% of web traffic was encrypted; now, 80-90% of it is, and a lot of that growth has been through increased availability of free or low-cost certificates.
Earlier quoted context omitted.
What about the theory that the NIST encryption curves may be backdoored ? If this is the case, if I would be the NSA I would strongly push for free cryptography, to make sure that only the US can decrypt the communications and have a strategic advantage.
Let's Encrypt is a CA. Their involvement with web cryptography begins and ends with signing certificates which are used for authentication -- they have no say over what cryptography actually gets used for a TLS connection.
If you use Let's Encrypt, you are likely using Certbot, which means that everybody uses a tool that a central authority strongly recommends to you.
I wonder how they generate the key, for example, it may be using secp256r1: https://github.com/certbot/certbot/blob/5c111d0bd1206d864d7c... (this seems to be the default?)
Some time ago, I remember seeing secp256r1 in some tech talks like here: https://www.johndcook.com/blog/2018/08/21/a-tale-of-two-elli...
"The “k” in sepc256k1 stands for Koblitz and the “r” in sepc256r1 stands for random. A Koblitz elliptic curve has some special properties that make it possible to implement the group operation more efficiently. It is believed that there is a small security trade-off, that more “randomly” selected parameters are more secure. However, some people suspect that the random coefficients may have been selected to provide a back door."
If a solution is plausible, and this solution can bring dozens of billions of USD in in direct economic value or protect populations, certainly the smart people would/should think about a way to do it (and this could even be the right thing to do).
I'm not saying that Let's Encrypt is backdoored; what I'm saying is that it's a juicy target and that one potential solution to this problem is to encourage decentralization.
Earlier quoted context omitted.
The registrar doesn't really have much to say about which CA you use, but a hosting provider would. Given that all certs are limited to a year, we're only a few steps away from the Let's Encrypt setup being automated everywhere.
Just imagine: - Not allowed to change authoritative DNS - CAA set to everything except LE - cannot set CAA to LE Wouldn't it be nice?
Registrars are contractually required to allow registrants to change the nameservers associated with their domain.
Earlier quoted context omitted.
Just imagine: - Not allowed to change authoritative DNS - CAA set to everything except LE - cannot set CAA to LE Wouldn't it be nice?
> - Not allowed to change authoritative DNS Registrars are contractually required to allow registrants to change the nameservers associated with their domain.
Earlier quoted context omitted.
> - Not allowed to change authoritative DNS Registrars are contractually required to allow registrants to change the nameservers associated with their domain.
Some "free" or "low cost" "registrars" actually are hosting providers that register the domain for you, and then provide you limited access to the tools normally available.
Earlier quoted context omitted.
Some "free" or "low cost" "registrars" actually are hosting providers that register the domain for you, and then provide you limited access to the tools normally available.
Do these still exist? I remember running into one of them around 2005, but I haven't heard of any since -- it's been a long time since "give away hosting and run ads against the content" was a viable business model.