Skip to main content
Clarify that this question is not "What's the difference between DV and EV?"
Source Link
jornane
  • 425
  • 2
  • 14

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs)

I like that Let's Encrypt has made it very easy for everyone to secure their servers with HTTPS and it Just Works™. On the other hand, I dislike that the only thing that's required for Let's Encrypt is a DNS entry or a file on a webserver.

What I'd like is for Firefox to show me that I'm on a site that's secured with Let's Encrypt. It should still validate certificates signed by the CA, because it is a bona fide CA, but I'd like it to show a warning sign in the address bar anyway. The reason I want this, is that I feel a site with a Let's Encrypt certificate is only moderately trustworthy, and I'd think twice before entering personal information on such a site.

So far I haven't found a setting in Firefox for selecting trust for a CA, other than distrusting it entirely, which is not what I want to do.


Answers suggest only trusting EV-certificates and not DV-certificates. This is already a distinction I use; I won't enter payment information on a site with a DV-certificate. My purpose of this question is to have a more fine-grained distrinction between DV-CA's. Not every DV-CA has the same validation procedure, and I trust some validation procedures more than others.

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs)

I like that Let's Encrypt has made it very easy for everyone to secure their servers with HTTPS and it Just Works™. On the other hand, I dislike that the only thing that's required for Let's Encrypt is a DNS entry or a file on a webserver.

What I'd like is for Firefox to show me that I'm on a site that's secured with Let's Encrypt. It should still validate certificates signed by the CA, because it is a bona fide CA, but I'd like it to show a warning sign in the address bar anyway. The reason I want this, is that I feel a site with a Let's Encrypt certificate is only moderately trustworthy, and I'd think twice before entering personal information on such a site.

So far I haven't found a setting in Firefox for selecting trust for a CA, other than distrusting it entirely, which is not what I want to do.

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs)

I like that Let's Encrypt has made it very easy for everyone to secure their servers with HTTPS and it Just Works™. On the other hand, I dislike that the only thing that's required for Let's Encrypt is a DNS entry or a file on a webserver.

What I'd like is for Firefox to show me that I'm on a site that's secured with Let's Encrypt. It should still validate certificates signed by the CA, because it is a bona fide CA, but I'd like it to show a warning sign in the address bar anyway. The reason I want this, is that I feel a site with a Let's Encrypt certificate is only moderately trustworthy, and I'd think twice before entering personal information on such a site.

So far I haven't found a setting in Firefox for selecting trust for a CA, other than distrusting it entirely, which is not what I want to do.


Answers suggest only trusting EV-certificates and not DV-certificates. This is already a distinction I use; I won't enter payment information on a site with a DV-certificate. My purpose of this question is to have a more fine-grained distrinction between DV-CA's. Not every DV-CA has the same validation procedure, and I trust some validation procedures more than others.

Source Link
jornane
  • 425
  • 2
  • 14

How can I set a lower trust level for Let's Encrypt in Firefox?

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs)

I like that Let's Encrypt has made it very easy for everyone to secure their servers with HTTPS and it Just Works™. On the other hand, I dislike that the only thing that's required for Let's Encrypt is a DNS entry or a file on a webserver.

What I'd like is for Firefox to show me that I'm on a site that's secured with Let's Encrypt. It should still validate certificates signed by the CA, because it is a bona fide CA, but I'd like it to show a warning sign in the address bar anyway. The reason I want this, is that I feel a site with a Let's Encrypt certificate is only moderately trustworthy, and I'd think twice before entering personal information on such a site.

So far I haven't found a setting in Firefox for selecting trust for a CA, other than distrusting it entirely, which is not what I want to do.