Let's Encrypt
letsencrypt.org
Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report.

Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

  • RoyaltyInTraining@lemmy.worldEnglish
    15·
    4 days ago

    Let’s Encrypt is amazing, but are there any equally trustworthy alternatives people could switch to if something bad happens to it?

    • dan@upvote.auEnglish
      2·
      3 days ago

      ZeroSSL, plus a few paid companies support ACME (I know Sectigo and GoDaddy do). Sure, the latter are paid services, but in theory you can switch to them and use the exact same setup you’re currently using with Let’s Encrypt, just with some config changes.

    • treadful@lemmy.zipEnglish
      10·
      4 days ago

      They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it’s so difficult and expensive.

      • xthexder@l.sw0.comEnglish
        11·
        4 days ago

        Well, it’s difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.

        • treadful@lemmy.zipEnglish
          21·
          3 days ago

          Correct me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.

          The impact is not serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.

          It doesn’t improve encryption compared to a self-signed cert though.

          • xthexder@l.sw0.comEnglish
            81·
            4 days ago

            If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It’s effectively allows MITM for any certificate. Worse, it’s not even limited to certificates under that CA. The browser has no way of knowing there’s 2 “valid” certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is a possibility).

            Certificate pinning might save things, since that will force the same certificate as was previously used, but I’m not sure this is a common default.

    • fmstrat@lemmy.nowsci.comEnglish
      7·
      4 days ago

      If it begins to enshitify, someone will quickly take up the helm. It’s become so core now that someone like Cloudflare would just be like “We do this now.”

      • dan@upvote.auEnglish
        1·
        3 days ago

        I think Cloudflare enshittifying is a bigger risk that Let’s Encrypt.