133
votes
Why are Let's Encrypt certificates accepted by default by browsers?
I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against.
A standard certificate only certify that the owner of the certificate actually ...
- 65.7k
106
votes
Accepted
Should I revoke no longer used Let's Encrypt certificates before destroying them?
This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved.
Cost
To you: the effort of revoking the cert. If you have to do this manually, ...
- 59.2k
80
votes
Accepted
Reasons to distrust Let's Encrypt certificates
This is an old policy.
Getting a certificate was difficult and expensive, which prevented malicious people from getting it, which made it an easy way to identify "trusted" sites.
Because LE ...
- 132k
47
votes
Accepted
Should I activate HSTS with Let’s Encrypt Certificates?
Yes, you should activate HSTS.
HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect ...
- 45k
38
votes
Accepted
Is there any security risk when a certificate authority is used more than all others?
TL;DR: It does not matter much.
The only security "risk" here really is the CA being "Too big to fail", where the browsers cannot distrust the CA quickly. But this is happening to all big CAs, not ...
- 7,858
26
votes
Should I revoke no longer used Let's Encrypt certificates before destroying them?
Revocation is not necessary, from a security point of view, if the private key is not compromised.
Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: ...
- 2,105
22
votes
Why are Let's Encrypt certificates accepted by default by browsers?
Why does your browser trust certificates from the Let's Encrypt initiative?
Just to make this part clear: Your browser/computer trusts these certificates, because it acknowledged the root CA "DST ...
- 806
18
votes
Accepted
Why can't Let's Encrypt support wildcard certificates?
Let's Encrypt just announced that they will offer wildcard certificates in 2018:
Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only ...
- 296
18
votes
Should I revoke no longer used Let's Encrypt certificates before destroying them?
One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation ...
- 449
18
votes
Accepted
Creating sub CA signed with Let's Encrypt certificate
Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)
To see if your certificate is a CA, ...
- 59.2k
14
votes
Accepted
Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP
TL;DR: Yes, checking for that domain in any public CT Log viewer and finding only certs that you bought will give you pretty high confidence that no malicious certs were issued to that domain.
Yup, I ...
- 59.2k
12
votes
Accepted
Let's Encrypt is based in the US and subject to US laws
Good questions all. I can't speak too much to other things they could do, but here's some comment on the ones your brought up:
Yes, they could revoke a certificate. But while this could cause some ...
- 4,028
11
votes
Why are Let's Encrypt certificates accepted by default by browsers?
Certificate do not provide any more guarantee that what is in the certificate itself. In the case of Let's encrypt certificates, all that is guaranteed is that the server you are connected to belongs ...
- 18.7k
11
votes
Accepted
Let's Encrypt and EV certificates for different hosts in the same domain
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to ...
- 205k
10
votes
Accepted
Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?
Very short answer:
Would NSA have any cryptographic advantage because of that,
Yes. And that applies to any certificate authority: Whomever your users trust to authenticate your website is able to ...
- 6,274
9
votes
How can I set a lower trust level for Let's Encrypt in Firefox?
As Matthew says, the difference isn't between Let's Encrypt and other CAs, it is between Domain Validated (DV) and Extended Validation (EV) certificates. That's what you want to distinguish, since ...
- 6,381
9
votes
Benefits of a wildcard vs per-subdomain certificates
Additional point to consider is that all certificates issued by Let's Encrypt (and by other issuers) can be viewed in Certificate Transparency logs, so if you issue certificates without using ...
- 190
9
votes
Reasons to distrust Let's Encrypt certificates
There are three classes of certificates:
Domain Validated (DV)
Organization Validated (OV)
Extended Validation (EV)
Domain validated certs are just that: you simply need to demonstrate control over ...
- 3,089
8
votes
Accepted
what is the maximum life-time for Let's Encrypt certificates
What is the lifetime for Let’s Encrypt certificates? For how long are they valid?
Our certificates are valid for 90 days. You can read about why here.
There is no way to adjust this, there are no ...
- 16.9k
8
votes
Accepted
Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?
It seems that it's not possible obtain a certificate from Lets Encrypt for a public IP address, without a domain name. See https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-...
- 23.9k
7
votes
Accepted
How does Let's Encrypt prevent imposters?
Although Let's Encrypt issues domain-validated certificates and these guarantee only that a certificate was requested by an entity owning the domain, it does have policies in place to prevent ...
- 9,149
7
votes
Revoke Let's Encrypt CA for all devices in my organization?
Frame challenge!
The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important ...
- 31.5k
7
votes
Accepted
Let's Encrypt certificate lifetime incident: is there any security risk?
The related task that they've opened explains why they do not plan to revoke certificates, and offers the following reasons for not doing so:
"we do not believe that revoking certificates ...
- 73.1k
7
votes
Accepted
Can Namecheap get certificates issued for my domain without my knowledge?
Can Namecheap get certificates issued for my domain
Yes. They control the nameservers, so they could change the records to allow issuing a certificate for your domain. And when not using their ...
- 19k
6
votes
Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?
NO (but maybe yes).
Short answer is sound no, because your web site private key is never sent to letsencypt, and thus encrypted communication between clients and server cannot be decrypted any ...
- 2,305
6
votes
Let's Encrypt is based in the US and subject to US laws
And
They could refuse to issue new certificates.
They could be forced to give your personal data (registration email, list of linked domains to your ACME account, IPs of your server, ...) to US ...
- 2,105
6
votes
Should the Strict-Transport-Security max-age be tied to the duration of the certificate?
It's two separate things. LetsEncrypt set their certificates to be short-lived because they expect their users to constantly renew them, short-lived certificates limit the exposure time of a lost ...
- 3,721
5
votes
Should I activate HSTS with Let’s Encrypt Certificates?
You can use HSTS as long as you're going to keep using HTTPS on your site. The specific certificate can change, but that is acceptable for HSTS.
If you use HTTP key pinning, you can require that the ...
- 27.4k
5
votes
Accepted
Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified?
I don't think you can do anything about it but to upgrade your Android.
The problem here is a generic top-level domain .vip and older Android versions do not recognise them as public (hence the "a ...
- 9,149
Only top scored, non community-wiki answers of a minimum length are eligible