So as Mozilla has put a bullet in StartSSL’s head (causing mass problems with thousands of free users worldwide), I can see there is a big gap in functionality between LE and the more mature StartSSL offering. Firstly, the requirement to validate every subdomain with LE is somewhat excessive. If yo…

[image] CRCinAU: The point is, StartSSL is now gone - and its widely acknowledged outside of the LE Echo Chamber that their free offering was fantastic. If you had 30 not-paid-up-front StartSSL certificates, it would cost $950 to revoke them.

… and your reply adds nothing to this conversation, technically, or even remotely related. Please keep on topic.

[image] CRCinAU: StartSSL is now gone That remains to be seen. They are free to run a competent and honest operation and reapply to Mozilla's trust store. They have also written something about dodging the consequences and issuing usable certificates soon, presumably by reselling another CA. …

I think you’re confusing this so-called “LE echo chamber” with the infosec community as a whole. I haven’t seen many infosec or Web PKI experts disagree with the fact that pushing for short-lived certificates is a good idea. In fact, I don’t recall any. Certainly, it would be easier for some use-cas…

[image] CRCinAU: I have a worry that there is a well established echo chamber that is of the opinion that 90 day certs is a good thing. The problem with echo chambers is that they only reinforce themselves. Short-lived certificates are a security gain. Period. There are usability tradeoffs, h…

[image] motoko: Well, except for the $30 per certificate revocation fee. The howling at that during the Heartbleed situation was quite a thing and likely kept some people from revoking their affected certificates when they really should have. Apparently LE also has some problems with revocati…

That’s an entirely different issue. The domain validation process was followed to the letter and by definition of the Baseline Requirements, that means it was not someone who should not be able to obtain it (even if the site in question was misconfigured or hacked). The subscriber (that is, the pers…

Just because your favourite SSL provider turned to crap, doesn’t mean the next best thing has to bend to your wishes. I would like a detailed analysis about how verifying the root domain is enough to issue certs for every name under it. That claim and request got thrown out there so willy-nilly, I …

[image] motoko: Their blatant disregard to the guidelines that all other registrars follow can cause severe problems with the trust of all CAs if nothing was to be done to them. if you ask me, we could abolish CAs (at least for DV) as a whole and upgrade to DANE/TLSA. it's simpler (no OSCP an…

[image] My1: if you ask me, we could abolish CAs (at least for DV) as a whole and upgrade to DANE/TLSA. it's simpler (no OSCP and all the stuff), safer (no anyone can everything), and easier for users (they dont have to do annoying validations with the CA, but just change it in the DNS) and a lo…

Bringing up LE to match StartSSL's offerings

Feature Requests

sigprof November 6, 2016, 11:48am 11

Apparently LE also has some problems with revocation — e.g., see the recent case when an LE certificate was issued to someone who should not have been able to obtain it, and @josh replied that the certificate will most likely not be revoked.

Topic		Replies	Views
Short certificate period - no useable on multi server scenario Help	53	11385	April 5, 2017
I just want a certificate	26	11330	December 11, 2015
Why doesn't Let's Encrypt issue CA certificates? Feature Requests	25	5451	February 7, 2021
Shouldn't verification via DNS record be a priority? Issuance Tech	61	41193	February 16, 2016
Certs for subdomains without the domain owner's permission Issuance Policy	53	15790	October 26, 2016

Bringing up LE to match StartSSL's offerings

Related topics