130
votes
Let's Encrypt for intranet websites?
Let's Encrypt can only issue certificates for valid DNS names. So if your intranet uses a made-up domain name like intranet.mycompany.local then it won't work.
If you have a real DNS name like ...
- 1,961
130
votes
Why are Let's Encrypt certificates accepted by default by browsers?
I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against.
A standard certificate only certify that the owner of the certificate actually ...
- 64.2k
106
votes
Accepted
Should I revoke no longer used Let's Encrypt certificates before destroying them?
This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved.
Cost
To you: the effort of revoking the cert. If you have to do this manually, ...
- 57.5k
94
votes
Accepted
Are there any downsides to using Let's Encrypt for a website's SSL certificates?
Let's Encrypt is a Certificate Authority, and they have more or less the same privileges and power of any other existing (and larger) certificate authority in the market.
As of today, the main ...
- 1,198
69
votes
What makes Let's Encrypt secure?
Same security as other DV certs
What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of ...
- 17.7k
47
votes
Accepted
Should I activate HSTS with Let’s Encrypt Certificates?
Yes, you should activate HSTS.
HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect ...
- 43.8k
38
votes
Accepted
Is there any security risk when a certificate authority is used more than all others?
TL;DR: It does not matter much.
The only security "risk" here really is the CA being "Too big to fail", where the browsers cannot distrust the CA quickly. But this is happening to all big CAs, not ...
- 7,708
35
votes
Let's Encrypt for intranet websites?
If you are looking for a internal CA-like service for an Intranet, then a public CA like Lets Encrypt may not work, as it want to connect back to its servers to manage the cert request and signing. ...
- 1,927
26
votes
Should I revoke no longer used Let's Encrypt certificates before destroying them?
Revocation is not necessary, from a security point of view, if the private key is not compromised.
Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: ...
- 2,053
22
votes
Why are Let's Encrypt certificates accepted by default by browsers?
Why does your browser trust certificates from the Let's Encrypt initiative?
Just to make this part clear: Your browser/computer trusts these certificates, because it acknowledged the root CA "DST ...
- 796
21
votes
Are there any downsides to using Let's Encrypt for a website's SSL certificates?
The reason to use Let's Encrypt can be the price. Those certificates will be for free.
But I see one possible disadvantage for nonsmall web sites. Big CA offer wildcard certificates, Extended ...
- 638
18
votes
Accepted
Why can't Let's Encrypt support wildcard certificates?
Let's Encrypt just announced that they will offer wildcard certificates in 2018:
Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only ...
- 296
18
votes
Should I revoke no longer used Let's Encrypt certificates before destroying them?
One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation ...
- 449
18
votes
Accepted
Creating sub CA signed with Let's Encrypt certificate
Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)
To see if your certificate is a CA, ...
- 57.5k
16
votes
Let's Encrypt for intranet websites?
UPDATE 2019-03-30: Somebody actually found a large scale way of doing LE for internal servers: https://blog.heckel.xyz/2018/08/05/issuing-lets-encrypt-certificates-for-65000-internal-servers/
——————-
...
- 17.7k
16
votes
How does "Let's Encrypt" provide authenticity?
If you follow the links from the first Wikipedia link you provided, you'll find the spec for the ACME protocol that Let's Encrypt will use. And what it says is:
Because there are many different ...
- 10.1k
15
votes
Accepted
Benefits of a wildcard vs per-subdomain certificates
For websites which dynamically generate subdomains (for example, if users can create their own subdomain for some service), installing a certificate for each new subdomain is far from ideal, because ...
- 7,372
14
votes
What makes Let's Encrypt secure?
Yes, the protocol you describe only ensures that "the person who picks up the phone at awesome bank" when you call them, is the same person who picked up the phone at awesome bank when the Let's ...
- 2,008
14
votes
Accepted
Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP
TL;DR: Yes, checking for that domain in any public CT Log viewer and finding only certs that you bought will give you pretty high confidence that no malicious certs were issued to that domain.
Yup, I ...
- 57.5k
12
votes
Accepted
How secure is "Let's Encrypt"?
Try "acme-tiny"
There is an alternative "Let's encrypt"-client project called "acme-tiny".
It is less automated, but smaller. In their own words:
This is a tiny, ...
- 17.7k
12
votes
Accepted
Let's Encrypt is based in the US and subject to US laws
Good questions all. I can't speak too much to other things they could do, but here's some comment on the ones your brought up:
Yes, they could revoke a certificate. But while this could cause some ...
- 3,978
11
votes
Are there any downsides to using Let's Encrypt for a website's SSL certificates?
One disadvantage that makes big companies not consider Let's Encrypt is that visitors that connect to the site can't be sure that it is the actual company that hosts the site.
This is because Let's ...
- 973
11
votes
How does LetsEncrypt.org's ACME work?
The ACME spec lists a number different challenges:
Identifier Validation Challenges
7.1. Simple HTTP
7.2. Domain Validation with Server Name Indication (DVSNI)
7.3. Proof of Possession of ...
- 17.7k
11
votes
Why are Let's Encrypt certificates accepted by default by browsers?
Certificate do not provide any more guarantee that what is in the certificate itself. In the case of Let's encrypt certificates, all that is guaranteed is that the server you are connected to belongs ...
- 18.5k
11
votes
Accepted
Let's Encrypt and EV certificates for different hosts in the same domain
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to ...
- 183k
9
votes
Accepted
Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?
Very short answer:
Would NSA have any cryptographic advantage because of that,
Yes. And that applies to any certificate authority: Whomever your users trust to authenticate your website is able to ...
- 5,843
8
votes
Benefits of a wildcard vs per-subdomain certificates
Additional point to consider is that all certificates issued by Let's Encrypt (and by other issuers) can be viewed in Certificate Transparency logs, so if you issue certificates without using ...
- 180
8
votes
What makes Let's Encrypt secure?
Let's Encrypt is designed to help against a range of attacks and to push the generalization of TLS usage to have a globally safer and more private internet. It is aimed more precisely to remove ...
- 19.1k
8
votes
How can I set a lower trust level for Let's Encrypt in Firefox?
As Matthew says, the difference isn't between Let's Encrypt and other CAs, it is between Domain Validated (DV) and Extended Validation (EV) certificates. That's what you want to distinguish, since ...
- 6,311
Only top scored, non community-wiki answers of a minimum length are eligible