Ca-certificates: removal of SPI CA

I haven't yet had the need to try revocation, but Wosign is a more accessible option than startssl. No noncommercial restriction, 1 year free.

As someone implementing the S3 API (on Ceph) for a non-profit, another missing option is wildcard certificates.

> Let's Encrypt only issue certificates that are valid for 90 days[0] because they want you to automate renewal by having your server automatically run their script which needs root privileges

That script is FOSS; you can see exactly what it wants to do. And it uses a documented protocol ("ACME"), so you can write and run your own script if you want, using several different ways to prove you control the server. The script provided by Let's Encrypt mostly serves as a proof of concept and a simple implementation for some common cases; various alternatives already exist that integrate will with various server software.

> and they use Google as the gatekeeper of who is allowed a certificate[1].

> [1] https://letsencrypt.org/2015/10/29/phishing-and-malware.html

I've never once seen a report of a site finding itself on that list without actually serving malware; I don't see any obvious basis for such a complaint.

> doesn't pass every request to a corporation for approval.

Let's Encrypt is run by "Internet Security Research Group (ISRG)"; quoting https://letsencrypt.org/isrg/ : "ISRG is a California public benefit corporation". And personally, since I don't particularly want to see any trusted CA run by only one person, just about any CA will be a corporation of some kind. "corporation" is not a dirty word.

You can run the letsencrypt client as non-root, but it takes a greater degree of system configuration first. letsencrypt-auto in its current incarnation sure does run as root, however. The current state of affairs is to prioritize ease over running with the lowest degree of privilege that is feasible. (and there are other ACME-protocol implementations you can choose if you prefer not to run the letsencrypt client; ISTR reading about one implemented in Ruby)

I do feel more negatively about their choice to use a third-party list of domains to blacklist, particularly since they can't offer any effective appeals process (they can't afford to have people in the loop AT ALL at a price of zero)

Agreed. Not all uses of certs allow for easy automation. For example, ddwrt or a NAS. I would like to use proper certs but don't want to screw around in the firmware which might potentially break updates.

Does certificate revocation work better these days?

http://news.netcraft.com/archives/2013/05/13/how-certificate...

The SPI certificate authority was never a public one. It was only used to sign Debian sites (and the majority of those have certs issued by Gandi these days; I think it's just debconf.org left).

So StartCom's non-commercial restriction is fine, and Let's Encrypt's DFSG-compliant script is fine. (Frankly, they're not even relevant for the use case of replacing the SPI CA, because Debian can just pay for certificates. If there's somehow a problem with funding, which I don't think Debian has at this scale, I'm sure there are countless people who would be thrilled to donate some money.)

> Let's Encrypt only issue certificates that are valid for 90 days[0] because they want you to automate renewal by having your server automatically run their script which needs root privileges

The provided script:

1. Is FOSS. You can audit it before running.

2. Is an example, not required. You can write your own script from scratch if you want, or even do it by hand (although this would be admittedly tedious to do every 90 days).

> and they use Google as the gatekeeper of who is allowed a certificate[1].

That's a drastic oversimplification. The Google Safe Browsing API lists phishing and malware sites. I can see some concern that Google might mark sites as phishing or malware for political reasons or something, but so far I know of no cases of that happening. In fact, high-profile sites that do contain a lot of malware have been left unmarked: see Pirate Bay, Kickass Torrents, MegaUploads. I definitely have concerns about censorship, but so far I see no evidence that's happening. If you have such evidence, I'd be very receptive to seeing it.

> We are still short an option that issues certificates that are valid for 1+ years

That's not something I want, or something that's good for the security of the internet.

> can be used for any purpose and doesn't pass every request to a corporation for approval.

As long as the limitation continues to be on malware, I'm fine with it, and I'm not sure why you aren't.

P.S. To be clear, I know very little about StartCom and am not defending or attacking them.

StartCom does allow their free (Class 1) certificates to be used for commercial purposes. They just reserve certain features that many businesses would appreciate (like having your business name on the certificate) for paid certificates (Class 2 or higher).

From their FAQ:

"2.) The certificate is for my company, what shall I do?

In the Class 1 settings (free), the only possible relationship between StartCom and the subscriber is with individuals, i.e. natural persons. StartCom has no relationship with the organization a subscriber may represents and acknowledges only the subscriber. All responsibilities according to the StartCom CA Policy are that of the subscriber personally, even in case he/she decides to obtain certification as an employee or representative of an organization. Organizations should perform Class 2 validation and an organization name may only appear in a digital certificate at Class 2 level and higher." [0]

[0] http://www.startssl.com/?app=25#2

"all the certificates installed on a machine" and "certificates that [...] are shipped" are not necessarily the same thing.

You mean like the one Dell included?

Thank you.