Hacker News Reader

The thing is that we're not talking downtime here, but rather something in the CA compromised, which would mean that pretty much ANY website could be impersonated, as the attacker could issue a Let's Encrypt CA valid certificate for it. That is mitigated by invalidating this CA, but that also invalidates all legit certificates previously issued by them. So they need to reissue them all

View on HN

Let's Encrypt publishes Certificate Transparency logs: https://letsencrypt.org/docs/ct-logs/

You can both block certs that do not appear in the logs, and decide which certs not to trust ("everything after Friday the 13th at midnight is not trusted"), once you know the date/time of the intrusion.

Chrome already blocks certs not appearing in CT logs, at least if it was issued in 2018 or newer.

hmm, the logs are valid point. what scenario are we addressing here then?

but the issuance time isn't relevant, they can easily backdate the cert

Reply on news.ycombinator.com