-5

If I disagree with Let's Encrypt's cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal activities, how can I automatically disable all of my organization's web browsers and other software that uses internally stored lists of certificate authorities, from accepting their certificates and preventing end-user exposure to the threat of phishing sites using Let's Encrypt SSL?

Let's Encrypt has abdicated all responsibility for HTTPS / SSL to be used to validate the authenticity of a website and its content as valid.

Although it is possible to abuse certificates from standard authorities, there is a revocation process in place to deal with that. When a bad actor has been identified and they lose their certificate, it is an expensive and time-consuming process for the bad actor to obtain a new replacement to begin scamming again. The bad actor will of course be banned from using the previous CA, which will tell other CA's what happened, and so the criminal has to find another unrelated CA... and then another... etc.

But Let's Encrypt has thrown all this out the window, stating that the potential for criminal abuse of their easily auto-distributed free SSL certificates are just Not Their Problem, and they're not going to bother with trying to prevent it.

Due to the fact that certificate authorities are authorized via a process that involves individual web browsers without any other local infrastructure, it would seem that revoking Let's Encrypt across all devices in my organization may require manual intervention on every web browser or operating system that uses an internally stored list of trusted global certificate authorities.

10
  • 7
    If you're trying to train people that valid SSL certificate=safe website then you'll have bigger issues to deal with than Let's Encrypt giving someone bad a valid certificate. I can go to any one of dozens of pay-for certificate authorities and get a malicious site "trusted" by web browsers.
    – user
    Sep 23 '19 at 18:30
  • 6
    90% of your question is ranting. Please keep the question down to what you want to know - how to remove trust in the specific CA on all your systems. Unfortunately, nothing is known about your infrastructure, the systems you use and the software running on these but in the worst case you have to disable the CA as trusted from all these systems and there might be multiple trust stores involved (system, Firefox, Java, Python ...). Sep 23 '19 at 18:42
  • 3
    And I fully agree with the comment of user - if you assume that a valid certificate should mean that a site can be trusted then you are having the wrong idea of what HTTPS provides in the first place. It only protects data in transit and nothing more. It does not protect against sites being hacked and serving malware and being used for phishing as common with insecure CRM installations. It does not protect against creating new sites serving malware or setup for phishing either. Sep 23 '19 at 18:48
  • 1
    This is what I would call "carpet bombing." You will distrust the certificate of about 170M domains, or about half the internet.
    – ThoriumBR
    Sep 23 '19 at 19:30
  • 2
    @DaleMahalko Do whatever you want for yourself, but forcing this decision on others is frankly irresponsible. Let's Encrypt now issues certificates for over 1/5th of the Alexa top 1 million sites (including this site). Your warning fatigue is going to go through the roof, and no one is going to pay attention when there actually is a problem. Sep 24 '19 at 21:24
7

Frame challenge!

The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important for), and have focused on one of the less important purposes. You're not the only one with this confusion though because (truth be told), user's have been taught the wrong thing for many years.

You are approaching this from the perspective of "SSL == Safe". However, this is not true. The only thing that is really true is "SSL == privacy". From that perspective Let's Encrypt is not just very important but extremely valuable to the internet. SSL encryption is now readily available to any site administrator, which means that you can communicate privately with any website. This is a great thing! It also happens to mean that hackers and phishers can communicate privately with the people they are trying to steal from. That might seem like a downside, but really it's just a side effect that is neither better or worse.

However, people have often been trained that "SSL == Safe". This goes all the way back to the green bar that browsers used to display when connected to a site with SSL. It inadvertently taught people that SSL meant you were safe, and that was partially true because 15 years ago it was usually only legitimate sites that had an SSL certificate. However, times began to change even before Let's Encrypt came along, and the reality is that users never should have been taught "SSL == safe" in the first place. SSL is about privacy, not safety. Browsers have begun to reflect this fact by taking away that green icon when connected over SSL, and only announcing when things are NOT secured with SSL.

Removing Let's Encrypt would be very dangerous

Unfortunately for you, even if you did have a good way to remove the CA for Let's Encrypt from every device in your organization (which would be very hard to do anyway), it would be a really bad choice. The issue is that, right now, Let's Encrypt secures about 200 million sites. 1-2 million more sites are issued a Let's Encrypt certificate every day. As a result, if you did manage to remove the Let's Encrypt CA from all your devices, then all of those devices would end up throwing certificate errors very regularly - probably at least once per day. Especially as their market share continues to grow, your users will inevitably run into a certificate error for a site they really want to visit, and so they will get into the habit of ignoring it and continuing anyway.

This has a very dangerous unintended side effect: you will be training your users to ignore certificate warnings. As a result, the one time there is actually a MitM attack going on, your users will just think "Ah, just another Let's Encrypt site: ignore warning!" and then they will end up really owned. It's really just a bad idea.

The answer is simple: stop thinking about SSL certificates as a sign of safety and just think of it as a sign of privacy. If you can look at it from that perspective then you'll realize that the success of Let's Encrypt is a very good thing.

2
  • Someone is apostrophe happy today! :P "Let's Encrypt secures about 200 million sites per day. 1-2 million more sites ... every day." - Is that supposed to just be "200 million sites" and not "per day" for the first sentence there? Sep 23 '19 at 19:08
  • @AndrolGenhald you can never have enough "punctuation". Also, good catch! According to them they have issued certificates for 200 million sites, and add 1-2 million more per day. I updated my language. Sep 23 '19 at 19:14
2

Set up a proxy in your organization that handles TLS traffic. (You will need to add your proxy's certificate to all computers in your organization.)

You will then be able to filter traffic at your proxy based on various rules, including the Certificate Authority.

Of course, if you are blocking Let's Encrypt on the principle that they don't do Extended Validation (EV), then you should stand by your principle and block all Domain Validation (DV) certificates; but beware, this will break TLS for nearly every site including Google, Facebook, Wikipedia, StackExchange, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.