Hacker News Reader

Comment by _qhtn | Hacker News Reader

My limited understanding- LE certs only say that the data sent between you and the server is encrypted, while traditional CAs also tell you 'who' that server belongs to.

So, your connection to _qhtn.org may be secure, but it may not be this _qhtn you're exchanging data with. Traditional CAs claim to do some sort of ID verification.

EDIT: I am very wrong.

View on HN

This is incorrect, potentially in a few ways.

DVs are available from almost every CA. They're popular because they involve no paper checks which makes them cheap and fast. You don't need a company to get one, like you do with OV and EV.

DV should give some level of confidence that you're connecting with the owner of the domain name. CAs should make you go through a process that only a domain's controller could complete.

So I can't get a DV for paypal.com but I can get one for olipaypal.com if I own that domain. I can't get an OV or EV for either domain showing Paypal as the company unless I somehow manage to register that as a company name somewhere. Possible? Probably.

To be fair, with LE you do need to verify you're requesting the cert from the domain for which you're requesting it, so there's some validation. It would be really difficult (for me, impossible) to get a Let's Encrypt cert for, say, wellsfargo.com. It's not one of the fancy CV certs like at https://www.grc.com/intro.htm, but they're the same certs Amazon.com uses.

It looks [1] like some CAs depend heavily on DV certs (GoDaddy) while others do not (Digicert).

[1] http://www.netcraft.com/internet-data-mining/ssl-survey/

Interesting. I wonder how critical to GoDaddy's business the certificate sales are, or if they're really just a sideline to their core hosting business.

Reply on news.ycombinator.com