All, In 2024 Q1, Let's Encrypt plans to issue new intermediate keys and certificates. The exact date and time is to be determined. Most ACME clients will automatically configure new intermediate certificates, so no subscriber action should be needed. Motivation Previously in 2020 , Let’s Encrypt is…

[image] aarongable: You're suggesting that the CN be Int E5? At the time first posted, having int in the filename and even CN was interesting and appealing for development reasons. A day later, and recalling many of the end-consumer concerns, it's not.

What about using three char naming?: char one: "R|I" [Root or Intermediate] char two: "R|E" [RSA or ECDSA] char three: "0-9A-Z" [unique identifier] Some possibilities: RRR RED IE7 IRC

[image] petercooperjr: Some people might want an ECDSA chain that only uses P-256 signatures And just to tack onto this a bit, besides the weird broken Android version, some people might want P-256 purely for the performance benefits, along the lines of @Nummer378 's analysis that most platfor…

[image] rg305: What about using three char naming?: This stuff is really useful and helpful to the .0001% of users (developers) doing a lot of work with Certificates and Chains or managing the Trust Stores. To everyone else, it's a few extra bytes of unnecessary bandwidth on every request. T…

[image] petercooperjr: the weird broken Android version That actually seem like a good reason for P-384, so as to get those broken Androids replaced.

[image] aarongable: Because the hash is being used for a non-cryptographic purpose here, really it's just a compression algorithm: take big key and make it small (but still statistically unique). Using SHA-1 for this purpose would be truly fine and good, except for the externality that doing so …

[image] rg305: The periodic table of elements! [Tom Lehrer - The Elements - LIVE FILM From Copenhagen in 1967]

Skipping root X3 seems reasonable to me. Intermediates should ideally have incrementing numbers and shouldn’t have another 3, at least for a long time.

We can solve that "number 3" issue by using another base and starting from 100 (decimal), maybe. Be it base16 or 64. Base twelve, maybe? I mean, does it really need to be human readable? If that's a concern then I like actual names, not numbers.

iirc it need to be descriptive enough to know who owns it, so it doesn't add up we removed those certs from out store: "root certificate"(publickey:long hex)

Let's Encrypt New Intermediate Certificates

Issuance Tech

Bruce5051 December 6, 2023, 7:27pm 34

Even if it were for a cryptographic purpose there is the advantage as a defense against Length extension attack - Wikipedia.

Like Length extension attack: SHA-384 has a minor advantage over SHA-512

Topic		Replies	Views
Let's Encrypt new hierarchy plans Issuance Tech	29	10509	August 13, 2020
Detailed 2020 hierarchy Issuance Tech	22	8301	September 8, 2020
Preview of our upcoming Root Ceremony Issuance Tech	28	1862	July 22, 2025
ECDSA intermediate issuance Help	14	5322	May 19, 2021
ECDSA Root and Intermediates ISRG/Organizational	28	8353	June 11, 2020

Let's Encrypt New Intermediate Certificates

Related topics