Linked Questions

20 votes
2 answers
12k views

How secure is "Let's Encrypt"? [duplicate]

I just configured and installed a free SSL certificate from Let's Encrypt. It's great, and very easy to set up. However in this post-Snowden era, I was wondering how secure this really is. For ...
geert3's user avatar
  • 311
0 votes
1 answer
3k views

Trustworthiness of Let’s Encrypt and ZeroSSL within browsers and OS [duplicate]

With regard to Are there technical disadvantages in using free ssl certificates? it has been highlighted by some that StartSSL is not a trustworthy CA, and I was wondering if Let’s Encrypt is the same....
Chris Rogers's user avatar
5 votes
1 answer
714 views

How can LetsEncrypt and other similar services verify ownership of a domain over insecure http? [duplicate]

LetsEncrypt allows you to verify ownership of your domain using the .well-known thing, but since the site is http before the first certificate is issued, couldn't somebody do an MITM attack to give ...
markasoftware's user avatar
28 votes
7 answers
5k views

How to replace SSL/TLS?

I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS) The data that ...
Tloz's user avatar
  • 391
13 votes
2 answers
3k views

Is StartSSL.com a trustworthy site? [closed]

I just got the following email: Dear StartCom customers, This electronic mail message was created by StartCom's Administration Personnel: StartCom, a leading global Certificate ...
Wayne Werner's user avatar
  • 1,835
9 votes
2 answers
2k views

Can a powerful adversary trick ACME to generate a certificate?

As per the recent jabber.ru MITM attack: The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using ...
anon2328's user avatar
  • 121
1 vote
1 answer
315 views

How can I set a lower trust level for Let's Encrypt in Firefox?

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs) I like that Let's ...
jornane's user avatar
  • 425
3 votes
1 answer
403 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
dnang's user avatar
  • 655
2 votes
3 answers
355 views

Which SSL certificate should I purchase for a website with one sub-domain?

I want to purchase an SSL/TLS certificate for my website, for three reasons: To be able to display web-push notifications Improve website rankings on Google Obtain more trust from visitors I have a ...
rockyraw's user avatar
  • 121
2 votes
1 answer
193 views

What does a Let's Encrypt (or other DV) certificate prove?

This is a follow-up to other questions like "What makes Let's Encrypt secure?". When I first run the Let's Encrypt (certbot) client on my server, it obtains a certificate by publishing a certain file ...
bobtato's user avatar
  • 186