What are the viable alternatives to LE? And in case none exists, what does it take to build one?
Requirements: free, available to everyone, automation friendly, issues certificates that are actually considered trustworthy by other parties.
Requirements: free, available to everyone, automation friendly, issues certificates that are actually considered trustworthy by other parties.
Google Trust Services – free ACME certs, requires a Google account for registration
SSL.com Free DV SSL – offers free 90-day certs through ACME
It seems a bit silly that a service that could be forced by EO to revoke foreign certificates is the backbone of so much of the internet.
It's a bit mathy, but if you can make it through that, I highly recommend watching the whole video, especially if you like dad jokes.
None. Big tech intentionally made Let's Encrypt a single point of giant failure.
> And in case none exists, what does it take to build one?
A new Internet and Web standards stack. The whole problem is self-imposed -- we could have published self-signed Ed25519 keys on the DNS instead, and the result would be more secure than whatever it is we have now.
Let's Encrypt is incredible.