Let's Encrypt: How It Works
letsencrypt.org
Let's Encrypt: How It Works
1–10 of 123 posts
Re: Let's Encrypt: How It Works
#2I am somewhat excited about letsencrypt, but isn't ownership verification via DNS not a bit, hmm, strange? After all, a proper certificate should defend against MITM attacks; so if an attacker would be able to take control over the target's DNS, he could easily create a certificate, which looks legit for all intended purposes. Or do I miss something in that regard?
Re: Let's Encrypt: How It Works
#3Sorry for the newbie question....
So if I have apache running http://example.com on port 80 and I follow the instructions ($ lets-encrypt example.com)
Will Apache now be correctly serving encrypted traffic on port 443 with a cert for https://example.com ?
Re: Let's Encrypt: How It Works
#4I am somewhat excited about letsencrypt, but isn't ownership verification via DNS not a bit, hmm, strange? After all, a proper certificate should defend against MITM attacks; so if an attacker would be able to take control over the target's DNS, he could easily create a certificate, which looks legit for all intended purposes. Or do I miss something in that regard?
Ownership verification is already done via DNS by existing CAs. If an attacker has full control over your DNS, he can already change the DNS records and trick a CA into delivering him a genuine certificate.
This isn't really a MITM attack.
Re: Let's Encrypt: How It Works
#5I am somewhat excited about letsencrypt, but isn't ownership verification via DNS not a bit, hmm, strange? After all, a proper certificate should defend against MITM attacks; so if an attacker would be able to take control over the target's DNS, he could easily create a certificate, which looks legit for all intended purposes. Or do I miss something in that regard?
I think you're right, however this is no different from how your average domain-verified certificate is issued (where you'd receive a confirmation mail to something like webmaster@example.com or serve a file given to you by the CA on a specific path). If an attacker manages to hijack your DNS, he could also modify your MX/A records and receive that mail/host the file.
You could argue it's even slightly better, since with this solution, DNS is the only attack surface, whereas with email verification a vulnerable mail or web server would be enough. That is, if DNS is their only supported verification mechanism (which I don't think is true.)
Re: Let's Encrypt: How It Works
#6Sorry for the newbie question.... So if I have apache running http://example.com on port 80 and I follow the instructions ($ lets-encrypt example.com) Will Apache now be correctly serving encrypted traffic on port 443 with a cert for https://example.com ?
That's the idea. It assumes you are using an OS with a package manager, and letting it manage your software and (to some extent) config files.
Re: Let's Encrypt: How It Works
#7It seems like the one thing this doesn't/can't address is the IP shortage. Does help much if example.com is virtual hosted on the same IP address as 100 other sites?
Re: Let's Encrypt: How It Works
#8It seems like the one thing this doesn't/can't address is the IP shortage. Does help much if example.com is virtual hosted on the same IP address as 100 other sites?
The SNI stuff (http://en.wikipedia.org/wiki/Server_Name_Indication) helps with this if you can do without XP support.
Re: Let's Encrypt: How It Works
#9It seems like the one thing this doesn't/can't address is the IP shortage. Does help much if example.com is virtual hosted on the same IP address as 100 other sites?
This really isn't a problem any more with SNI. With XP dying out, there's really no excuse anymore to not use it for shared hosting.
Re: Let's Encrypt: How It Works
#10What kind of impact is Let's Encrypt going to have on the CA industry? I'm not that familiar with the current state of the CA companies, nor do I understand this industry well enough to know if this is going to be a major hit to them or not.
Is there any reason why a company would prefer a CA other than Let's Encrypt?