Questions tagged [letsencrypt]

An initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every domain owner with a recognized certificate that can be used for TLS.

Filter by
Sorted by
Tagged with
2
votes
2answers
94 views

What is Multi-Perspective Validation?

The Let's Encrypt upcoming features page lists the following: Multi-Perspective Validation Currently Let’s Encrypt validates from a single network perspective. We are planning to start ...
2
votes
1answer
55 views

Should the Strict-Transport-Security max-age be tied to the duration of the certificate?

I understand the principle of HSTS, and the fact that the choice of max-age limits how long a visitor could potentially be locked out if the site somehow lost its certificate and had to go back to ...
0
votes
1answer
42 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
5
votes
4answers
812 views

Let's Encrypt and EV certificates for different hosts in the same domain

I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it. But I use a cookieless static content served from another host name (static....
-3
votes
1answer
83 views

what is the maximum life-time for Let's Encrypt certificates

Let's Encrypt is one of the most popular TLS Certificate Authorities. I have conflicting information about its certificates life-time. In this link it says 90-days. In one research paper I read 1 ...
13
votes
2answers
462 views

Let's Encrypt is based in the US and subject to US laws

Let's Encrypt is based in the United States and subject to the laws of the United States, including National Security Letters. What are the implications for foreign sites that use Let's Encrypt? Here'...
1
vote
1answer
141 views

Workaround for no www.subdomain.domain coverage on wildcard cert [closed]

Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it? I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had ...
1
vote
0answers
190 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
3
votes
2answers
120 views

Are Let’s Encrypt wrapper services secure?

There are a number of web based portals that purport to make installation of free SSL certificates user friendly for non-technical users (ZeroSsl, SSLforFree). For lack of a better term I am calling ...
3
votes
1answer
201 views

How does selection between multiple available certificate chains work?

I am trying to understand the practical mechanisms of cross-signing (intermediate) certificates. As an example, I am looking at the Let's Encrypt Chain of Trust. That page mentions: IdenTrust has ...
9
votes
1answer
3k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
1
vote
1answer
332 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
6
votes
3answers
1k views

Setting up LetsEncrypt SSL for domains/subdomains on two servers

LetsEncrypt certificates have been created for example.com and www.example.com. This is a Linux server on IP 123.123.123.1. I would like to add foo.example.com and bar.example.com, but these ...
2
votes
1answer
268 views

Can I get a HTTPS certificate for mymachine.cs.superuniversity.ca from “Let's Encrypt” [duplicate]

I'm trying to set up a HTTPS certificate for mymachine.cs.superuniversity.ca (free or paid). Before I jump in, is it even possible to set up such a certificate using Let's Encrypt? The domain is for ...
37
votes
2answers
3k views

Is there any security risk when a certificate authority is used more than all others?

According to NetTrack, Let's Encrypt is now used on more than 50% of domains (51.21% as of April 2018). I know Let's Encrypt helped a lot of people to get free certificates for their websites, so I ...
0
votes
2answers
194 views

Are the letsencrypt clients audited?

When more and more webservers installs the letsencrypt client to have free letsencrypt certs, I was just thinking. Are the letsencrypt client(s) audited? Can they have malicious code in them?
2
votes
1answer
520 views

Could a state actor MITM Let’s Encrypt certificate issuance to provide a cert they could more easily crack

Let’s Encrypt issues certificates of which they are the CA. That cert is based on a private key generated in the server by LE's auto/certbot script. Could a state actor MITM that transaction ...
2
votes
2answers
379 views

Is it possible to have different machines for the same domain, with different certs?

We have two machines that serves a website via HTTP. The webiste/domain has two "A" records, that is how the load is round-robinly distributed. We want to have HTTPS for this website. The problem is ...
0
votes
2answers
1k views

Letsencrypt does not work on Android

I have a digitalocean server (ubuntu 16.4 nginx) + serverpilot I installed letsencrypt Following the site tutorial: https: //www.robertwent.com/blog/using-letsencrypt-serverpilot/ Everything worked ...
0
votes
3answers
257 views

Untrusted Connection after installing SSL Certificates from Let's Encrypt

I got 2 certificates issued from "Let's Encrypt", one for "crackerscreed.org" and the other for "www.crackerscreed.org". The cPanel on my hosting service says: When cPanel installs an SSL ...
89
votes
4answers
10k views

Should I revoke no longer used Let's Encrypt certificates before destroying them?

The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate. But should you do the same if there are no ...
5
votes
1answer
386 views

How can LetsEncrypt and other similar services verify ownership of a domain over insecure http? [duplicate]

LetsEncrypt allows you to verify ownership of your domain using the .well-known thing, but since the site is http before the first certificate is issued, couldn't somebody do an MITM attack to give ...
4
votes
3answers
743 views

Is it a security risk to allow index listing of the .well-known/acme-challenge directory?

To register an SSL certificate via the Let's Encrypt authority, one must serve a special file in /.well-known/acme-challenge/<token> with specific contents. Apologies if I missed it in the ...
15
votes
3answers
4k views

Why can't Let's Encrypt support wildcard certificates?

Let's Encrypt claims: We do not offer Organization Validation (OV), Extended Validation (EV), or wildcard certificates, primarily because we cannot automate issuance for those types of certificates....
4
votes
2answers
373 views

Is it the responsibility of a certificate authority to ensure an SSL is not used for nefarious purposes?

I read this in the news recently Let's Encrypt has issued 15,000 SSL certificates to PayPal phishing sites (Security experts call on firm to refuse certificates for domains containing popular ...
1
vote
2answers
927 views

Chrome doesn't see SSL certificate for main domain while sees for www

I have the following issue: Chrome browser (both desktop and mobile) shows me "Not Secure" label for my main domain "https://astrakhan.ru/" while it works OK for "https://www.astrakhan.ru/". Firefox ...
1
vote
1answer
299 views

LetsEncrypt and GAE ssl error in chain even though certificates are valid?

So I am using Google App Engine(GAE) and installed a certificate from letsencrypt but whenever I get the webpage I get this error. NET::ERR_CERT_INVALIDand I don't know what to do. Here is my entire ...
3
votes
3answers
120 views

Have there been any proposals for automation of EV certificate granting and renewal?

With Let's Encrypt being the first CA to roll out ACME, setting up TLS on domains has become inexpensive, easy, and above all, automated. Let's Encrypt has made it clear that EV is far from being an ...
2
votes
1answer
158 views

Invalid CSR when using Let's Encrypt web tools

I've created a CSR using IIS. When I paste the text here... https://www.sslshopper.com/csr-decoder.html ... it validates correctly. But when I use the Let's Encrypt tools here... https://zerossl....
22
votes
3answers
5k views

Should I activate HSTS with Let’s Encrypt Certificates?

I recently set up a web server that—among others—serves ownCloud to some of my users. I got a Let’s Encrypt SSL Certificate because I didn’t want to use a self-signed certificate like the one ownCloud ...
1
vote
1answer
197 views

How can I set a lower trust level for Let's Encrypt in Firefox?

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs) I like that Let's ...
34
votes
3answers
8k views

Why are Let's Encrypt certificates accepted by default by browsers? [duplicate]

I recently almost got caught by a phishing attempt, due to the use of a relatively convincing domain name and valid SSL certificate (specifically this website). When checking the certificate it turns ...
1
vote
2answers
460 views

How to get a certificate from Let's Encrypt for the server which doesn't allows file creation

I am using SSL certificate signed by Verisign for my VPN Server which is hosted on the public network and my company employees use to connect to company network through this server. The system use to ...
3
votes
1answer
88 views

Does Letsencrypt support any challenges that don't require control over HTTP or DNS?

I control a machine where I can't control DNS or open HTTP port. Is there a way I could pass a LetsEncrypt challenge when I can only accept connections over HTTPS and/or a few other ports? I found ...
1
vote
2answers
428 views

Replacing a TLS cert when the old one is pinned (HPKP)

Suppose my Public-Key-Pins max-age is 60 days. When can I deploy a new cert? 60 days from now? But what about browsers who first connect to my site between now and 60 days from now? This site says: ...
5
votes
3answers
1k views

Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?

Let's imagine for a while that Let's Encrypt is an NSA project, and let's imagine that soon, almost everyone will be using it. Would the NSA have any cryptographic advantage because of that, when ...
0
votes
1answer
862 views

Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified?

Our website using Let's Encrypt through Nginx is all green on SSLLabs test (A- score). But on one Android phone it accepts the certificate and sees the trust chain up to the root certifying authority,...
-1
votes
1answer
378 views

How to create SSL cetificate from Synology from Letsencrypt?

There is option in New Synology to create SSL for local or remote host. But when define a subdomain it's give back can't verify to Host/ connect. My question is, is that only possible when Synology ...
6
votes
2answers
4k views

Why does ACME / Let's Encrypt require A records not CNAME?

I'm using ngrok to demonstrate the ACME protocol on IIS/Windows. However, this service prefers CNAMEs over A records. In debugging the interaction it seems that ACME only allows for A records. What ...
0
votes
1answer
769 views

Does letsencrypt.org support non-default ports, i.e. ports other than 443 for SSL certificates? [closed]

I would like to get a letsencrypt.org SSL certificate for a service which runs on a non-default root-reserved port, i.e. port other than 443 and < 1024, e.g. 446. I'm uncertain whether letsencrypt....
1
vote
1answer
2k views

How to create a server certificate from a letsencrypt.org certificate?

I have created a letscrypt.org certificate using letsencrypt run which works fine as a SSL certificate on apache2. How can I create another server certificate signed (and thus trusted) by the ...
1
vote
2answers
140 views

Should each service running on a domain have a separate certificate?

I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g....
3
votes
1answer
291 views

How does Let's Encrypt prevent imposters?

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?
3
votes
1answer
761 views

What is the expiration time threshold below which LetsEncrypt certificates will auto-renew?

I have a few domains on some server, all certified by LetsEncrypt certificates. The certificate is due to expire in 11 days, on July 9th. However, when I try to renew using /opt/letsencrypt/...
1
vote
1answer
873 views

LetsEncrypt / Exim4 / GnuTLS / cert chaining: “The provided X.509 certificate list is not sorted” error

From what I can determine, you generate a LetsEncrypt certificate that includes the full cert chain thus: # run lets-enc the usual way # then ..: wget -O intermediate.pem https://letsencrypt.org/...
2
votes
1answer
1k views

Letsencrypt not valid in Firefox or PHP, but valid in Chromium

I just moved one of my websites to https, using Letsencrypt. I am using Linux, and my Chromium correctly verifies website certificate, but Firefox shows it as invalid. I also have an API on the ...
10
votes
2answers
7k views

Benefits of a wildcard vs per-subdomain certificates

As you might know, Let's Encrypt doesn't offer wildcard certificates and it won't in a short-term because you can just order as many certificates as you want for the sub-domains. This make me wonder.....
-3
votes
2answers
172 views

HTTP: weaknesses analysis & attitude [closed]

Many questions on this topic around here, but didn't find this particular angle Background: Sending any information of value with HTTP and through HTTPS is a bad idea (in the rare case a respected ...
3
votes
1answer
202 views

Can I get SSL certificates for my OpenPGP key?

How can I use letsencrypt to get a signed public key for use with OpenPGP? So I can prove in court the key is mine etc., and not have to rely on the OpenPGP web of trust.
4
votes
1answer
1k views

How does LetsEncrypt.org's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's Encrypt's Domain Validation works. From what I already know, verification can be performed ...