SSL certs sound like something that should be in a blockchain. Why isnt it?
How would proving control of a domain work?
Let's Encrypt makes certs for 30% of web domains
41–50 of 147 posts
Re: Let's Encrypt makes certs for 30% of web domains
#42Earlier quoted context omitted.
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
Yes we do. On what basis did you make that statement? We comply with U.S. sanctions by not issuing to entities on the SDN list, but that doesn't prevent us from serving the vast majority of people in those countries.
How do you know if someone is on the list?
When I registered my domain I got WHOIS protection and then LE just made sure I owned the domain. There was no asking about who I am or where I reside or what lists I might be on.
Re: Let's Encrypt makes certs for 30% of web domains
#43Earlier quoted context omitted.
What problems would decentralization solve here?
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
I haven't checked their TOS, but practically there isn't any limitations in getting certificates from Iranian IPs or for ir domains. If there is any problem, it is that browser vendors/root CAs/etc are not willing to trust CAs in those countries.
Re: Let's Encrypt makes certs for 30% of web domains
#44Earlier quoted context omitted.
Letsencrypt doesnt issue certs to Iran, Syria, Cuba, Sudan et al.
That's due to US sanctions.
Start a LetTheRestOfUsEncrypt.org based in a different country whose government isn't so full of themselves?
Or better yet, is there a way to start a decentralized organization itself so that no jurisdiction has absolute power over it?
Re: Let's Encrypt makes certs for 30% of web domains
#45Author here. I'd figured they were big, but I had no idea that big until I did a www-wide TLS scan. Here for questions
You list the ciphersuite that got chosen for each connection, but I think this could use at least a caveat explaining that the way this works means you'd need to do a LOT more work to figure out what the servers might have agreed to do for some other client. What I mean here is that TLS up until TLS 1.2 goes like this: Client: "Hi, I know ciphersuites A, B, C, D, E, F and G" Server: "OK, let's do C" And so you can't…
With regards to the supported SSL/ TLS versions you can get that information from Shodan. We do explicit handshakes using each version. For example, here is an overview of servers supporting TLS 1.3:
https://www.shodan.io/report/unklm3m7
Disclaimer: I run Shodan.
Re: Let's Encrypt makes certs for 30% of web domains
#46One thing I don't understand about Let's Encrypt:
Why do the certificates expire after 90 days? What would be the downside of giving them a longer expiration time?
Re: Let's Encrypt makes certs for 30% of web domains
#47Earlier quoted context omitted.
What problems would decentralization solve here?
Improved security. So many sites are trusting Let's Encrypt and have cron jobs set to refresh data from them. If Let's encrypt were comprised or went offline, they are now a huge single-point-of-failure (or worse, single-point-of-exploit?) for all these domains. It's become a kind of monoculture. A more diverse ecosystem of offerings would be resilient to any single attack or failure.
On the flip side, more certificate authorities (who, remember, also have the ability to delegate intermediate authorities) also means more attack surface, because except in the case of key pinning (which is rare to my knowledge) any malicious authority or compromised authority's certs could be used to effectively intercept web TLS traffic. If let's encrypt was the only authority, yes that would be bad in many ways (and i'm not arguing for that) but it would mean less authorities to worry about. Anyone remember the bluecoat scandal? https://www.vice.com/en_us/article/78kkwd/a-controversial-su...
Re: Let's Encrypt makes certs for 30% of web domains
#48One thing I don't understand about Let's Encrypt: Why do the certificates expire after 90 days? What would be the downside of giving them a longer expiration time?
https://letsencrypt.org/2015/11/09/why-90-days.html
> They limit damage from key compromise and mis-issuance. Stolen keys and mis-issued certificates are valid for a shorter period of time.
> They encourage automation, which is absolutely essential for ease-of-use. If we’re going to move the entire Web to HTTPS, we can’t continue to expect system administrators to manually handle renewals. Once issuance and renewal are automated, shorter lifetimes won’t be any less convenient than longer ones.
Re: Let's Encrypt makes certs for 30% of web domains
#49One thing I don't understand about Let's Encrypt: Why do the certificates expire after 90 days? What would be the downside of giving them a longer expiration time?
If you loose control of the private key it limits the time an attacker could use it.
Re: Let's Encrypt makes certs for 30% of web domains
#50Certbot is awesome! It really gives you no excuse not to provide https on your website.