Is Let's Encrypt going from savior to single point of failure (SPOF)?

ISRG/Organizational
6

Let’s Encrypt can’t use the Let’s Encrypt Authority X3 intermediate to sign other intermediates.

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0

Let’s Encrypt could use the ISRG Root X1 certificate to sign other intermediates, but if that root continues to be valid, Let’s Encrypt could also use it to sign new Let’s Encrypt intermediates in case there is a problem with the old ones. So, there might not be a lot of marginal benefit from this course of action.

I’m sure Let’s Encrypt staff would be happy to talk to anyone who wants to set up a new ACME-based CA on the Let’s Encrypt model.

4 Likes