HNHacker News
TopNewBestAskShowJobs

crapsalot

1 karma · joined January 15, 2016

submissionscomments
crapsalot··on Ask HN: Is Let's Encrypt Harmful?
2. Should I trust domains with Let's Encrypt-issued certificate less than those with paid certificates with identity validation?

No...

Lets Encrypt should not have the same level of trust as the basic DV level cert from a standard CA.

There is a security hole in ACME which is glossed over with handwaving from the fanbois.

crapsalot··on Ask HN: Is Let's Encrypt Harmful?
Wrong.

Most SSL cert CA's check DNS for email addresses and only validate DNS entries.

Lets Encrypt only checks DNS for IP addresses and issues certs based on root access to the IP addresses.

A CA DV is not equivalent to a Lets Encrypt cert.