Questions tagged [letsencrypt]

An initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every domain owner with a recognized certificate that can be used for TLS.

Filter by
Sorted by
Tagged with
0
votes
1answer
34 views

mTLS Client Authentication by Signing Arbitrary Message using Browser

this is my first post here in the area of ​​security and encryption. I will try to be succinct, and let you know that I am not an expert in security. Context: My client (visitor) has an X509 ...
1
vote
1answer
83 views

What does it mean to create a Let's Encrypt certificate "automatically" rather than manually?

I am getting the error below in trying to renew my certificate from the command line (and thus too from cron). From searching similar error reports, I understand that it means that I initially ...
0
votes
0answers
71 views

Certbot installation from cloudfront.net epel-release mirror

I'm setting up a website on a Centos7 VPS with certbot and let's encrypt. I am no expert on network security. I checked to see if my epel-release was pulling certbot from a legit mirror. I ran yum ...
0
votes
1answer
45 views

pfsense subdomain timeout with error 522

I want to attach a valid ssl subdomain to my pfsense. I would check it (with warnings) via my the pfsense's IP 192.168.11.1 . I used multiple tutorials to come up with the following: Bought a domain ...
-1
votes
2answers
119 views

How does DNS-01 validation for LetsEncrypt know what the right IP address is?

For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for ...
5
votes
1answer
218 views

Let's Encrypt certificate lifetime incident: is there any security risk?

A few days ago, Let's Encrypt discovered that they misinterpreted RFC 5280, thus making every certificate they issued valid for one second longer than expected. The associated issue on Mozilla bug ...
7
votes
1answer
804 views

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

Given the scenario that: Victim rents VM1 from a cloud provider, and points his/her DNS record to that VM1's IP address Victim deletes VM1 and switches to a different cloud provider, and creates VM2 ...
-1
votes
1answer
131 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0
votes
1answer
79 views

Is it possible to additionally sign a Let's Encrypt certificate with another self-signed root certificate? [duplicate]

I have a certificate for my web service issued with Let's Encrypt. Another service that communicates with my web service requires that my certificate must be signed with theirs, otherwise their client ...
0
votes
1answer
3k views

Where is ISRG Root X1 certificate on Windows 10?

Have a look here: https://letsencrypt.org/2018/08/06/trusted-by-all-major-root-programs.html First paragraph says: "As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly ...
2
votes
1answer
798 views

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

I have developed my DRF back-end API locally, deployed it on an AWS Lightsail instance (with a public static IP) and I now want to secure it with HTTPS. I understand that in order to use Let's Encrypt ...
2
votes
0answers
84 views

Public key stored in server is different from what is shown in OpenSSL

I obtained an SSL certificate from LetsEncrypt for my web application using Apache web server. LetsEncrypt generated these 4 files: cert.pem chain.pem fullchain.pem privkey.pem As I understand, ...
1
vote
2answers
145 views

What stops a malicious DNS subdomain provider from impersonating my website?

First, some background: The DNS-01 verification method of Let's Encrypt requires you to add a TXT record to a special subdomain your domain name to prove your identity. With ACMEv2, this can allow you ...
0
votes
0answers
55 views

Domain Joined computer doesn't browser properly with any website with Let's Encrypt CA cert

Navigating to any website with Let's Encrypt CA cert and even after enabling the HTTPS Everywhere addon, I'm getting "Your connection is not private". Getting this error from all the browser except ...
1
vote
1answer
196 views

Is the _acme-challenge subdomain protected?

I was looking into the DNS-01 challenge of Let's Encrypt, and I had a question about the subdomain process [1]. Let's say, the website example.com gives away free subdomains; what stops me to request ...
1
vote
2answers
329 views

Can I use Let's Encrypt to verify my signing key?

I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
3
votes
2answers
604 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
-5
votes
2answers
263 views

Revoke Let's Encrypt CA for all devices in my organization?

If I disagree with Let's Encrypt's cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal ...
0
votes
1answer
4k views

Using LetsEncrypt certificates for WiFi network authentication

I am helping my school IT set up a RADIUS authentication system using PEAP/EAP-TTLS. We are able to achieve successful connection with the user devices, but the users need to accept a "Not trusted" ...
3
votes
2answers
221 views

What is Multi-Perspective Validation?

The Let's Encrypt upcoming features page lists the following: Multi-Perspective Validation Currently Let’s Encrypt validates from a single network perspective. We are planning to start ...
5
votes
1answer
215 views

Should the Strict-Transport-Security max-age be tied to the duration of the certificate?

I understand the principle of HSTS, and the fact that the choice of max-age limits how long a visitor could potentially be locked out if the site somehow lost its certificate and had to go back to ...
0
votes
1answer
159 views

Update letsencrypt certificates without changing the private key

I want to renew the letsencrypt certificate on my webserver but want to keep the private key same. I've installed the certificate using certbot 0.35.1 How can I update the certificate (preferably ...
5
votes
4answers
970 views

Let's Encrypt and EV certificates for different hosts in the same domain

I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it. But I use a cookieless static content served from another host name (static....
-3
votes
1answer
206 views

what is the maximum life-time for Let's Encrypt certificates

Let's Encrypt is one of the most popular TLS Certificate Authorities. I have conflicting information about its certificates life-time. In this link it says 90-days. In one research paper I read 1 ...
15
votes
2answers
571 views

Let's Encrypt is based in the US and subject to US laws

Let's Encrypt is based in the United States and subject to the laws of the United States, including National Security Letters. What are the implications for foreign sites that use Let's Encrypt? Here'...
1
vote
1answer
365 views

Workaround for no www.subdomain.domain coverage on wildcard cert [closed]

Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it? I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had ...
1
vote
0answers
320 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
3
votes
2answers
136 views

Are Let’s Encrypt wrapper services secure?

There are a number of web based portals that purport to make installation of free SSL certificates user friendly for non-technical users (ZeroSsl, SSLforFree). For lack of a better term I am calling ...
6
votes
1answer
959 views

How does selection between multiple available certificate chains work?

I am trying to understand the practical mechanisms of cross-signing (intermediate) certificates. As an example, I am looking at the Let's Encrypt Chain of Trust. That page mentions: IdenTrust has ...
11
votes
1answer
5k views

Creating sub CA signed with Let's Encrypt certificate

I have a certificate issued from Let's Encrypt. Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the ...
1
vote
1answer
682 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
6
votes
3answers
2k views

Setting up LetsEncrypt SSL for domains/subdomains on two servers

LetsEncrypt certificates have been created for example.com and www.example.com. This is a Linux server on IP 123.123.123.1. I would like to add foo.example.com and bar.example.com, but these ...
2
votes
1answer
415 views

Can I get a HTTPS certificate for mymachine.cs.superuniversity.ca from "Let's Encrypt" [duplicate]

I'm trying to set up a HTTPS certificate for mymachine.cs.superuniversity.ca (free or paid). Before I jump in, is it even possible to set up such a certificate using Let's Encrypt? The domain is for ...
37
votes
2answers
3k views

Is there any security risk when a certificate authority is used more than all others?

According to NetTrack, Let's Encrypt is now used on more than 50% of domains (51.21% as of April 2018). I know Let's Encrypt helped a lot of people to get free certificates for their websites, so I ...
0
votes
2answers
247 views

Are the letsencrypt clients audited?

When more and more webservers installs the letsencrypt client to have free letsencrypt certs, I was just thinking. Are the letsencrypt client(s) audited? Can they have malicious code in them?
2
votes
1answer
760 views

Could a state actor MITM Let’s Encrypt certificate issuance to provide a cert they could more easily crack

Let’s Encrypt issues certificates of which they are the CA. That cert is based on a private key generated in the server by LE's auto/certbot script. Could a state actor MITM that transaction ...
2
votes
2answers
869 views

Is it possible to have different machines for the same domain, with different certs?

We have two machines that serves a website via HTTP. The webiste/domain has two "A" records, that is how the load is round-robinly distributed. We want to have HTTPS for this website. The problem is ...
0
votes
2answers
1k views

Letsencrypt does not work on Android

I have a digitalocean server (ubuntu 16.4 nginx) + serverpilot I installed letsencrypt Following the site tutorial: https: //www.robertwent.com/blog/using-letsencrypt-serverpilot/ Everything worked ...
0
votes
3answers
374 views

Untrusted Connection after installing SSL Certificates from Let's Encrypt

I got 2 certificates issued from "Let's Encrypt", one for "crackerscreed.org" and the other for "www.crackerscreed.org". The cPanel on my hosting service says: When cPanel installs an SSL ...
90
votes
4answers
10k views

Should I revoke no longer used Let's Encrypt certificates before destroying them?

The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate. But should you do the same if there are no ...
5
votes
1answer
486 views

How can LetsEncrypt and other similar services verify ownership of a domain over insecure http? [duplicate]

LetsEncrypt allows you to verify ownership of your domain using the .well-known thing, but since the site is http before the first certificate is issued, couldn't somebody do an MITM attack to give ...
4
votes
3answers
2k views

Is it a security risk to allow index listing of the .well-known/acme-challenge directory?

To register an SSL certificate via the Let's Encrypt authority, one must serve a special file in /.well-known/acme-challenge/<token> with specific contents. Apologies if I missed it in the ...
14
votes
3answers
4k views

Why can't Let's Encrypt support wildcard certificates?

Let's Encrypt claims: We do not offer Organization Validation (OV), Extended Validation (EV), or wildcard certificates, primarily because we cannot automate issuance for those types of certificates....
4
votes
2answers
576 views

Is it the responsibility of a certificate authority to ensure an SSL is not used for nefarious purposes?

I read this in the news recently Let's Encrypt has issued 15,000 SSL certificates to PayPal phishing sites (Security experts call on firm to refuse certificates for domains containing popular ...
1
vote
2answers
2k views

Chrome doesn't see SSL certificate for main domain while sees for www

I have the following issue: Chrome browser (both desktop and mobile) shows me "Not Secure" label for my main domain "https://astrakhan.ru/" while it works OK for "https://www.astrakhan.ru/". Firefox ...
1
vote
1answer
329 views

LetsEncrypt and GAE ssl error in chain even though certificates are valid?

So I am using Google App Engine(GAE) and installed a certificate from letsencrypt but whenever I get the webpage I get this error. NET::ERR_CERT_INVALIDand I don't know what to do. Here is my entire ...
3
votes
3answers
179 views

Have there been any proposals for automation of EV certificate granting and renewal?

With Let's Encrypt being the first CA to roll out ACME, setting up TLS on domains has become inexpensive, easy, and above all, automated. Let's Encrypt has made it clear that EV is far from being an ...
2
votes
1answer
196 views

Invalid CSR when using Let's Encrypt web tools

I've created a CSR using IIS. When I paste the text here... https://www.sslshopper.com/csr-decoder.html ... it validates correctly. But when I use the Let's Encrypt tools here... https://zerossl....
23
votes
3answers
6k views

Should I activate HSTS with Let’s Encrypt Certificates?

I recently set up a web server that—among others—serves ownCloud to some of my users. I got a Let’s Encrypt SSL Certificate because I didn’t want to use a self-signed certificate like the one ownCloud ...
1
vote
1answer
221 views

How can I set a lower trust level for Let's Encrypt in Firefox?

(In this question I ask about Let's Encrypt because it's a hot topic, but the same question could also be asked for CloudFlare's Universal SSL solution or other automated CAs) I like that Let's ...