# It must be a milestone - Let's Encrypt secures the bulk of US administration ... with one certificate

**URL:** <https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339>\
**Category:** Help\
**Created:** [November 27, 2019, 3:59pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339 "2019-11-27T15:59:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanCvrcek](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dancvrcek/32/35672_2.png) [@DanCvrcek](https://community.letsencrypt.org/u/DanCvrcek)\
**Post date:** [November 27, 2019, 3:59pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339/1 "2019-11-27T15:59:22Z")

</div>

If you’ve ever wondered what could be the value of a single Let’s Encrypt certificate.

Needed an screenshot for a demo … and picked [whitehouse.gov](http://whitehouse.gov) It could be the first LE cert as the issuer has changed recently.

(my laptop is too small to show all the domain names - and the screenshot looks best)

 ![02](https://global.discourse-cdn.com/letsencrypt/original/3X/3/a/3a4cf7ef28a8b4f80187590dd47e02362f315cb3.png)

---

<div class="post-metadata">

**Author:** ![iwmmxix](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/iwmmxix/32/36146_2.png) [@iwmmxix](https://community.letsencrypt.org/u/iwmmxix)\
**Post date:** [December 26, 2019, 4:44pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339/2 "2019-12-26T16:44:25Z")

</div>

I think [whitehose.gov](http://whitehose.gov) uses DigiCert not let’s encrypt based on the certificate path root

---

<div class="post-metadata">

**Author:** ![DanCvrcek](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dancvrcek/32/35672_2.png) [@DanCvrcek](https://community.letsencrypt.org/u/DanCvrcek)\
**Post date:** [January 2, 2020, 10:16pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339/3 "2020-01-02T22:16:07Z")

</div>

> [@iwmmxix](#):
>
> uses DigiCert

that's true for the main web domain. But there are some pretty chunky gateways for subdomains using Let's Encrypt.

What struck me was the risk of compromising a single private key. Just in a narrow sense of phishing, it would allow you to launch phishing attacks targeting users of many US gov departments.

... but I was told that that is a common network configuration. So nothing to worry about, really, I'm just imagining things. 🙂

---

<div class="post-metadata">

**Author:** ![tdelmas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tdelmas/32/1866_2.png) [@tdelmas](https://community.letsencrypt.org/u/tdelmas)\
**Post date:** [January 3, 2020, 5:08pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339/4 "2020-01-03T17:08:27Z")

</div>

> [@DanCvrcek](#):
>
> … but I was told that that is a common network configuration. So nothing to worry about, really, I’m just imagining things.

It's true it's usually a bad practice to use the same private key on different server, but, it that specific case, you notice that all domains are about "search", so they most probably all points to the same server with the search software installed 🙂

---

<div class="post-metadata">

**Author:** ![DanCvrcek](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dancvrcek/32/35672_2.png) [@DanCvrcek](https://community.letsencrypt.org/u/DanCvrcek)\
**Post date:** [January 3, 2020, 5:58pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339/5 "2020-01-03T17:58:24Z")

</div>

> [@tdelmas](#):
>
> they most probably all points to the same

they don't but hey, IP addresses can change within seconds/minutes. But you have scores of domains that can all be compromised in one strike. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 2, 2020, 5:58pm UTC](https://community.letsencrypt.org/t/it-must-be-a-milestone-lets-encrypt-secures-the-bulk-of-us-administration-with-one-certificate/107339/6 "2020-02-02T17:58:26Z")

</div>

Closed on February 2, 2020, 5:58pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.