# Email feedback: "Let’s Encrypt Subscriber Agreement Update" **URL:** \ **Category:** ISRG/Organizational\ **Created:** [July 14, 2022, 4:34pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231 "2022-07-14T16:34:19Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![SarahGran](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sarahgran/32/11646_2.png) [@SarahGran](https://community.letsencrypt.org/u/SarahGran)\ **Post date:** [July 14, 2022, 4:34pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/1 "2022-07-14T16:34:19Z")
We will be publishing an updated Subscriber Agreement. I'd like to get feedback from our community on the email that will be sent to all subscribers for whom we have an email address. Please let me know if you have ideas for how to make it more clear! Title: Let’s Encrypt Subscriber Agreement Update Recipients: All Let’s Encrypt Subscribers with an email address on file * * * Dear Let’s Encrypt Subscriber: We’re writing to you because we’ve updated our Subscriber Agreement, effective X, MONTH 2022. This is the agreement that governs the relationship between you and ISRG with regards to your acquisition and use of SSL/TLS digital certificates issued by ISRG (via Let’ Encrypt). You don’t need to take any action to continue to use the Let’s Encrypt service but we encourage you to review the new agreement. The main updates are: we now link to instructions on choosing a revocation reason if you revoke a certificate. This is a requirement for Subscriber Agreements from all Certificate Authorities as of this year. Also, we've removed unneeded capitalization, removed a section that is redundant with our Certificate Policy (CP), and tweaked the wording of the requirement to "assure" control of your private key so it matches the Baseline Requirements (BRs). You can find the updated agreement (v1.3), along with a document that shows the differences between the previous and current agreement and the full text of the previous agreement here: `https://letsencrypt.org/repository/` If you have any questions about the new agreement, please post them in the following thread on our community forum so Let’s Encrypt staff can review. [Thread link forthcoming] Let’s Encrypt is a free service because we want to make the Web more secure and privacy-respecting for everyone. We’re able to operate as a nonprofit thanks to corporate sponsorships and donations. Please consider joining our sponsorship program: `https://www.abetterinternet.org/sponsor/` Or donate now during our summer fundraising campaign to support this service (and get neat apparel!). `https://letsencrypt.org/donate/` Thank you, The Let’s Encrypt Team ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 14, 2022, 5:07pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/2 "2022-07-14T17:07:24Z")
Generally seems fine to me. The main things that I see that might have some room for improvement are: 1. Some words are informal (like "merch") or techy-type-jargon (like "diff"). I'm not sure exactly what tone would be best in general, but particularly whereas this may be going to not-extremely-technical users or people with limited proficiency in English, it may be good to ensure that everything is as clear as possible. 2. It looks like half of this is actually a plea to get funding rather than being just the notification of the agreement change. (Though some of that may just due to the forum's boxing and formatting of the links that I don't know if would show in an email the same way.) I don't know if that might make people see this as closer to "spam" rather than a "helpful service update". ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 14, 2022, 7:41pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/3 "2022-07-14T19:41:53Z")
Split this topic on July 14, 2022, 7:41pm UTC 8 posts were split to a new topic: [I got an email and don't know what to do](https://community.letsencrypt.org/t/i-got-an-email-and-dont-know-what-to-do/181238) ---
**Author:** ![SarahGran](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sarahgran/32/11646_2.png) [@SarahGran](https://community.letsencrypt.org/u/SarahGran)\ **Post date:** [July 14, 2022, 5:27pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/4 "2022-07-14T17:27:50Z")
Thanks for the feedback. I'll spell things out more fully. The funding part will not include previews as in the forum, but instead will just be plain text links. That will reduce its visual presence significantly. While it does consume a non-trivial amount of space in the email, it seems important to first convey that we are a public benefit nonprofit since many people do not realize that, and then take the opportunity to ask that people give back. We try not to be too pushy, but we do need to raise the money needed for this service. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 14, 2022, 6:00pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/5 "2022-07-14T18:00:23Z")
If I were you, I would include the most important changes in the SA related to the user in the email. Or at least explain what the majority of the changes are and what the implications to the user _might_ be. Without that, I'm missing the entire point of the email a little bit, frankly. I think 99.99999 % of users don't even know what a Subscriber Agreement actually is. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 14, 2022, 8:10pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/6 "2022-07-14T20:10:49Z")
I fully concur with @petercooperjr's and @Osiris's suggestions here. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [July 15, 2022, 5:26pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/7 "2022-07-15T17:26:15Z")
> [@SarahGran](#): > > The funding part will not include previews as in the forum, but instead will just be plain text links. That will reduce its visual presence significantly. I edited the original post to quote the URLs so the forum won't preview them. Now it looks closer to what the email will look like. ---
**Author:** ![SarahGran](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sarahgran/32/11646_2.png) [@SarahGran](https://community.letsencrypt.org/u/SarahGran)\ **Post date:** [July 15, 2022, 6:21pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/8 "2022-07-15T18:21:57Z")
Thanks! I updated the post to include an explanation of the SA's purpose. I hear where you're coming from on describing the changes but we are publishing a document that shows the differences between versions. That seems like the best way for people to determine what's new. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 15, 2022, 6:29pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/9 "2022-07-15T18:29:00Z")
> [@SarahGran](#): > > I updated the post to include an explanation of the SA's purpose. I like it! > [@SarahGran](#): > > I hear where you're coming from on describing the changes but we are publishing a document that shows the differences between versions. That seems like the best way for people to determine what's new. True, I _probably_ can live with that, assuming the difference isn't that major that 50 % of subscribers would stop using Let's Encrypt due to the changes if they actually read them 😉 This diff hasn't happened between previous SA's, so I'm not sure what to expect as a "diff" though. An actual `diff` or a human-written text? 😛 Just curious. Also, a typo: > [@SarahGran](#): > > issued by ISRG (via Let’ Encrypt) It's missing the `s` from `Let's` 🙂 I also would perhaps change > [@SarahGran](#): > > (…) along with a diff of the previous and current agreement (…) to: > (…) along with a document ~~with only~~ highlighting the changes between the previous and current agreement (…) Or something else not using the term `diff` as mentioned by @petercooperjr earlier. ---
**Author:** ![mcpherrinm](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mcpherrinm/32/59604_2.png) [@mcpherrinm](https://community.letsencrypt.org/u/mcpherrinm)\ **Post date:** [July 15, 2022, 6:30pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/10 "2022-07-15T18:30:57Z")
> [@Osiris](#): > > An actual `diff` Microsoft word / legal-style redlining, most likely ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 15, 2022, 6:33pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/11 "2022-07-15T18:33:03Z")
Like the [redlined baseline requirements](https://cabforum.org/baseline-requirements-documents/)? ---
**Author:** ![mcpherrinm](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mcpherrinm/32/59604_2.png) [@mcpherrinm](https://community.letsencrypt.org/u/mcpherrinm)\ **Post date:** [July 15, 2022, 6:35pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/12 "2022-07-15T18:35:26Z")
Yeah. I don't know if we plan to have a more readable version / summary of changes -- the redlined versions is what we've been reviewing internally, though. It's the standard in the legal world for this sort of thing. ---
**Author:** ![SarahGran](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sarahgran/32/11646_2.png) [@SarahGran](https://community.letsencrypt.org/u/SarahGran)\ **Post date:** [July 15, 2022, 6:59pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/13 "2022-07-15T18:59:28Z")
I updated those sections per the previous comments. Thanks for the reminder - and catching the typo! 🫣 We have published documents with the differences for every version update. Here's an example: [https://letsencrypt.org/documents/LE-SA-v1.1.1-v1.2-diff.docx](https://letsencrypt.org/documents/LE-SA-v1.1.1-v1.2-diff.docx) They're in the Legal & Policy repo; you have to click on "View History" to actually see them. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 15, 2022, 7:45pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/14 "2022-07-15T19:45:13Z")
> [@SarahGran](#): > > I updated those sections per the previous comments. Thanks for the reminder - and catching the typo! 🫣 👌🏻 > [@SarahGran](#): > > They're in the Legal & Policy repo; you have to click on "View History" to actually see them. Aaah, I see. Wouldn't have thought about that.. Is that also the place where the new diff will be? Maybe mentioning that (if that's the case) in the email might be a good idea. ---
**Author:** ![linkp](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/linkp/32/60089_2.png) [@linkp](https://community.letsencrypt.org/u/linkp)\ **Post date:** [July 16, 2022, 3:47am UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/15 "2022-07-16T03:47:45Z")
> [@SarahGran](#): > > but we are publishing a document that shows the differences between versions As a "subscriber" to many services that send notifications about changes to the agreement, I need to emphatically endorse @Osiris's recommendation of providing a change summary in the email. Linking to a "diff" or "redline" is nice, but most of us don't want to be burdened with reviewing a document, especially if the changes are inconsequential. We just want to know if there is any critical action we need to take to remain compliant. If the changes amount to what is effectively a great big nothing burger, don't ask us to go view a website to see the changes. The informative statement about the organization's status and funding is important. It probably wouldn't hurt to create a minimal version to use as a tagline or footer in certificate notification emails, if there isn't one there already. Something like the classic PBS tagline of "and viewers like you" that followed their sponsor acknowledgement seems grateful and not needy or pushy. Regardless of how the final version is written, thanks for sharing the feedback request in the community. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 16, 2022, 7:19am UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/16 "2022-07-16T07:19:25Z")
> [@SarahGran](#): > > You don’t need to take any action to continue to use the Let’s Encrypt service (…) Perhaps only partly related, but shouldn't ACME clients ask for renewed permission? When looking at my Certbot account info, I see that I've agreed to the 1.0.1 version of the SA from July 2015. One would _think_ one should explicitely agree to the newest version of the SA, right? Or is there a clause in the SA that says something like "agree once, agree forever"? > [@linkp](#): > > especially if the changes are inconsequential If the changes are inconsequential, one can also argue a email isn't necessary. I have not found any email from Let's Encrypt regarding previous SA updates in my inbox. Now, I may have deleted them, so that's not 100 % reliable, but _if_ this is the first of these kind of emails, one might think: why now? What's so important to send an email _now_ and not the previous updates? Perhaps that's due to a change of policy. I.e. "from now on, we're sending subscriber updates". Which is fine of course! It might also be a one time email related to the fundraising issue with the SA update as an excuse to send the sponsoring plug, I don't know. In any case, I think the _reason_ why this email is being send is also important for the _contents_ with a few scenario's, summarised: - If I deleted all my previous SA update email notices and this is just part of a regular thing, sure, no problem. - If this is the first of many to come, it might be a good idea to note that. - If this is a one-time thing only, then the changes in the SA are probably VERY important for the subscribers so it should be highlighted in the email contents too. - Or it's a one time thing used as a plug for the fundraising. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [July 16, 2022, 7:55am UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/17 "2022-07-16T07:55:33Z")
isn't there something like you agree updated tos by keep using or something? i some sone websites do that ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 16, 2022, 8:11am UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/18 "2022-07-16T08:11:53Z")
I believe this article from the 2015 SA is applicable: > **5.6 Amendment** > ISRG may modify this Agreement from time to time. Each modified version of this Agreement will be > posted to ISRG’s Let’s Encrypt website ([letsencrypt.org](http://letsencrypt.org)) at least fourteen (14) days before it becomes effective. If such new version contains material changes and You have provided ISRG with an email address, ISRG will send an email to such address notifying You of such new version at least fourteen (14) days before it becomes effective. In addition, major changes will be flagged with a new Subscriber Agreement version number in the ACME protocol, so You may be able to configure Your ACME Client Software to notify You of such changes. Legally speaking, I _think_ (I'm not a legal person) this enables LE to just modify the SA and have the subscriber check the repository for changes without requiring an explicit agreement from the subscriber. That said, it also says LE only emails the subscribers if "material changes" are made to the SA. Is that also the case for this 1.2 to 1.3 change? If so, I would go back to my previous recommendation as mentioned by @linkp too to address these material changes in the email contents itself. ---
**Author:** ![SarahGran](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sarahgran/32/11646_2.png) [@SarahGran](https://community.letsencrypt.org/u/SarahGran)\ **Post date:** [July 19, 2022, 2:22pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/19 "2022-07-19T14:22:18Z")
I updated the text to include a summary of the changes. Thanks for the feedback! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 19, 2022, 3:17pm UTC](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231/20 "2022-07-19T15:17:14Z")
I think it's perfect! The flow now goes from least details to most details, which will benefit all readers. Ones that don't care can just delete the email after the first paragraph. More curious readers will also read the second paragraph. There they'll have the most important information. And if they're reaaaally interested, they are provided with a reference to _all_ the info on the LE site. I'd say it's good to go, but hey, who am I 😛 [Next page](https://community.letsencrypt.org/t/email-feedback-let-s-encrypt-subscriber-agreement-update/181231.md?page=2)