Hacker News Reader

Comment by sschueller | Hacker News Reader

I am also concerned about the centralisation of everyone going to Let's encrypt. Yes they are non-profit but they are located in the United States and must follow US laws.

View on HN

Too big to fail: It's not just for banks any more.

If LE is compromised a few times and some fraudulent facebook.com or google.com certs leak out, how long before Firefox/Chrome/Edge blacklist their root cert like they did with Symantec[1], and end up breaking half the internet?

I understand that ACME is an open standard, but can someone point me to an alternative ACME provider that isn't "please call us for a quote" enterprise-grade?

[1]: https://blog.mozilla.org/security/2018/03/12/distrust-symant...

Seems like a reasonable fear, but it is mitigated by short certificate lifespans. Symantec was much more painful to distrust due to multi-year certificate lengths.

Anyone could launch LE2 outside of US. All the protocols are open. You need some capital though.

And some already trusted CA to cross-sign your certificate...

That is not strictly required though. LE did this in order to speed up the rollout but you can also skip that step and submit the root CA to the appropriate places, e.g. Mozillaʼs CA Certificate Program.

And then you lose all the older browser installations... There was a reason if LE went the way they went and basically it is retro-compatibility.

Anyway I'm not arguing that it would be impossible to create an LE2 but it would not be that simple. Especially if the buyer is someone already in the certificates business that wants to destroy the "free-for-all" concept.

To help produce an LE2, please contribute to https://github.com/tdelmas/Let-s-Clone

Reply on news.ycombinator.com