Let's make Let's Encrypt easy and simple

[DarkSteve]

@david7364

Perhaps I should clarify (again) that my main complaint is the poor quality of our Start Here page, as compared to that of many other exciting projects.

I agree here. Although it does give some information, it lacks clarity regarding third party clients and it's actually hard to find documentation for the official client. I know certbot is being handled by the EFF, but we could better reference it's documentation (especially in a section called "Getting Started").

@david7364

[Caddy's] documentation is so simple and clear that it inspires one to click "Download" and try it out. LE does not currently do so, in my opinion.

I disagree here. Let's Encrypt is a CA, not a downloadable program. As part of it's beta testing and initial release, it had an (underdeveloped) client to give people a chance to use the service. Now that the client is actually developed by a third party (the EFF) I don't think LE is in the position to have a simple "download" link.

That said, LE should really update the Getting Started page to reflect the plethora of clients available and platforms supported, as well as a clear link to certbot that indicates it's the officially recommended client for *nix systems. It should also reference a user's first steps if they're using a hosting service and don't have command line access.

@david7364

I'm sure you know that spam and viruses are a major hazard for most users of the Internet, requiring specialized protective software that doesn't work perfectly. But you don't seem aware that people whose job is distributing viruses and spam use a large number of domain names. While some viruses are typically stored on an insecure WordPress page on a plumbing supply website, where they can be hidden easily from the owner of the site, others (especially when spam is involved) benefit from a dedicated website, parked under a very large number of domain names.

I'm aware of all of that, I'm just not sure why you think it matters.

First, Let's Encrypt's priority is securing websites, they've specifically said mail servers are not part of their mission statement. Secondly, although their certificates can be used for mail servers, it's irrelevant - mail servers don't need a CA signed cert to use encryption. They're happy enough using opportunistic encryption (I know, I run one).

Lastly, whether mail from domain "viagra4U" is transported from MTA to MTA via LE secured TLS or not has absolutely no bearing on whether spam filters detect it. None. In fact, by the time the spam filter sees the email, it's well past the MTA to MTA connection.

That's why I said "don't get distracted! Whether they use those certs for good or evil is irrelevant!"

@david7364

Spammers automatically allocate many IPs and domain names, sometimes supported by cooperative paid or bribed Registrars and other infrastructure in their countries.

And Let's Encrypt uses Google's blacklist to ensure they don't provide certificates for possible malware domains (such as windowsnotificationcentre.com or itunes.tk). This has previously been discussed at length.

@david7364

Spammers are very smart people

No, their opportunistic business people like any other. Low hanging fruit pays better than jumping through hoops for that extra 10c. To get around LE's limits requires effort and virtually no payoff. Why not send spam opportunistically encrypted rather than from some random domain secured by LE? It doesn't make sense. This really is nothing to lose sleep over, or even be mildly concerned about.

@david7364

This is the background information that I thought was obvious when I objected to making assumptions about hundreds of thousands of successful and apparently first-time certificate issuances.

And the background information I thought was obvious was how mail works

@david7364

we have no idea what percentage of LE certificates are obtained by highly skilled and motivated malicious users

Well, if they're spammers, I can guarantee you they're not highly skilled!

@david7364

It is not the fact that these people are motivated by greed that is the issue here at all. It is the simple possibility that the certificate statistics may not mean what everyone posting here thinks they mean.

Sorry to harp on this, but there is absolutely no reason to think there is any significant number of malicious sites in that 90%. I know you say we simply don't know unless research is done, but there is simply no gain to obtaining millions of LE certificates for use in spam. None. There's actually a loss to anybody that does it. That's time and effort with no real-world benefit.

Now, if you're talking about malicious websites, LE uses Google's blacklist to ensure they're not legitimising that kind of malware (as I linked above).

Seriously, relax. It's not just that there is no evidence of abuse either way, it's that there is no evidence of abuse and reason against it.

Failing that, you could do a little research yourself and go through the issued certificates. One of LE's key principles is transparency, so you can see every single certificate they've issued (as stated by the LE site).

It's all good, it really is!