130
I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against.
A standard certificate only certify that the owner of the certificate actually controls the domain in question. So a certificate for g00dbank.com only certifies that the owner controls the g00dbank.com domain. It does not certify that the ...
126
Let's Encrypt can only issue certificates for valid DNS names. So if your intranet uses a made-up domain name like intranet.mycompany.local then it won't work.
If you have a real DNS name like intranet.mycompany.com (even if it doesn't resolve externally to your intranet), then you can use Let's Encrypt to issue certificates for it. If the domain does ...
104
This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved.
Cost
To you: the effort of revoking the cert. If you have to do this manually, that's annoying, but if you can script it up in 10 mins and add it to your CloudFormation plays, then why not? As @Hildred points out, this also advertises that ...
91
Let's Encrypt is a Certificate Authority, and they have more or less the same privileges and power of any other existing (and larger) certificate authority in the market.
As of today, the main objective downside of using a Let's Encrypt certificate is compatibility. This is an issue that any new CA faces when approaching the market.
In order for a ...
69
Same security as other DV certs
What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of AwesomeBank without being detected (because I have a valid certificate)?
Nothing. If you own the network, then you own the network. And DV type certs (see below) ...
47
Yes, you should activate HSTS.
HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect to your website over SSL after their very first visit (trust-on-first-use) and until the specified timeout is reached.
The choice whether to activate HSTS or ...
38
TL;DR: It does not matter much.
The only security "risk" here really is the CA being "Too big to fail", where the browsers cannot distrust the CA quickly. But this is happening to all big CAs, not just the biggest one.
Other than that, the only problem may be the CA being a more tempting target, though all CAs are already very tempting. Having all the eggs ...
35
If you are looking for a internal CA-like service for an Intranet, then a public CA like Lets Encrypt may not work, as it want to connect back to its servers to manage the cert request and signing. This assumes you do not have internet access out from your intranet web server; you need to install a client on the webserver for it to communicate with the Lets ...
25
Revocation is not necessary, from a security point of view, if the private key is not compromised.
Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: https://community.letsencrypt.org/t/does-revocation-cause-additional-load/25203
22
Why does your browser trust certificates from the Let's Encrypt initiative?
Just to make this part clear: Your browser/computer trusts these certificates, because it acknowledged the root CA "DST Root CA X3" and stored it in a list with trusted certificates. The CA "DST Root CA X3" again trusts Let's Encrypt and has signed their certificate.
Are free/cheap/...
21
The reason to use Let's Encrypt can be the price. Those certificates will be for free.
But I see one possible disadvantage for nonsmall web sites. Big CA offer wildcard certificates, Extended Validation certificates which have some advantages (from my point of view). Moreover this program is directed to web servers, but what if you have some application ...
18
Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)
To see if your certificate is a CA, open it and look at the Basic Constraints field; a CA will look like this
while an End Entity will look like this:
End Entities are not allowed to issue certs,...
17
Let's Encrypt just announced that they will offer wildcard certificates in 2018:
Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only support base domain validation via DNS for wildcard certificates, but may explore additional validation options over time. We encourage people to ask any ...
17
One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation available if needed.
16
UPDATE 2019-03-30: Somebody actually found a large scale way of doing LE for internal servers: https://blog.heckel.xyz/2018/08/05/issuing-lets-encrypt-certificates-for-65000-internal-servers/
——————-
How can they generate a CERT for their HTTPS website using Let's Encrypt?
Not at all. This is for publicly reachable sites only.
(Update 2016-04-22: Maybe ...
16
If you follow the links from the first Wikipedia link you provided, you'll find the spec for the ACME protocol that Let's Encrypt will use. And what it says is:
Because there are many different ways to validate possession of
different types of identifiers, the server will choose from an
extensible set of challenges that are appropriate for the ...
15
For websites which dynamically generate subdomains (for example, if users can create their own subdomain for some service), installing a certificate for each new subdomain is far from ideal, because you need to verify the ownership of the domain for each subdomain, followed by the installing of the certificate for each subdomain (which typically also ...
14
Yes, the protocol you describe only ensures that "the person who picks up the phone at awesome bank" when you call them, is the same person who picked up the phone at awesome bank when the Let's Encrypt server called them. If I have the ability to intercept calls to awesome bank both from Let's Encrypt and from you, then I can fool you.
Ideally what you'd ...
14
TL;DR: Yes, checking for that domain in any public CT Log viewer and finding only certs that you bought will give you pretty high confidence that no malicious certs were issued to that domain.
Yup, I totally agree with you that an attacker could have gotten a VM at that IP and that would have been sufficient to get through the automated domain validation ...
12
Try "acme-tiny"
There is an alternative "Let's encrypt"-client project called "acme-tiny".
It is less automated, but smaller. In their own words:
This is a tiny, auditable script that you can throw on your server to issue and renew Let's Encrypt certificates. Since it has to be run on your server and have access to your private ...
12
Good questions all. I can't speak too much to other things they could do, but here's some comment on the ones your brought up:
Yes, they could revoke a certificate. But while this could cause some availability issues for your users, it wouldn't compromise confidentiality or integrity.
Let's Encrypt could issue a counterfeit certificate, but that's why all ...
11
The ACME spec lists a number different challenges:
Identifier Validation Challenges
7.1. Simple HTTP
7.2. Domain Validation with Server Name Indication (DVSNI)
7.3. Proof of Possession of a Prior Key
7.4. DNS
If I had to summarize the detailed process (about two screens full) given in section 7.1. Simple HTTP, then I'd say it goes a ...
11
One disadvantage that makes big companies not consider Let's Encrypt is that visitors that connect to the site can't be sure that it is the actual company that hosts the site.
This is because Let's Encrypt issues certificates for a domain free of charge without identity validation (personal or corporate) (Let's Encrypt only offers domain validation).
...
11
Certificate do not provide any more guarantee that what is in the certificate itself. In the case of Let's encrypt certificates, all that is guaranteed is that the server you are connected to belongs to the same entity that own the domain name you used to connect to it.
There is another class of certificate called "extended validation certificate" where the ...
11
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to authenticate the same domain.
Browsers actually only care that a specific certificate is valid for the specific domain it is used on and don't care if the same ...
9
Very short answer:
Would NSA have any cryptographic advantage because of that,
Yes. And that applies to any certificate authority: Whomever your users trust to authenticate your website is able to forge a valid certificate. Verisign, Let's Encrypt, doesn't matter. They have everything they need to make your user complacently be subject to a man-in-the-...
8
Let's Encrypt is designed to help against a range of attacks and to push the generalization of TLS usage to have a globally safer and more private internet. It is aimed more precisely to remove technical and financial constraints which may prevent some webmaster to use TLS certificates more broadly.
However, as any security measure, this will not be a ...
8
As Matthew says, the difference isn't between Let's Encrypt and other CAs, it is between Domain Validated (DV) and Extended Validation (EV) certificates. That's what you want to distinguish, since the vast majority of CAs do automated DNS or file existence checks for Domain Validated certificates, while Extended Validation certificates require much more ...
7
Additional point to consider is that all certificates issued by Let's Encrypt (and by other issuers) can be viewed in Certificate Transparency logs, so if you issue certificates without using wildcards, all your subdomains can be easily enumerated by anyone.
It isn't always a problem, but in some cases it can make attacker's life easier. For example, it can ...
Only top voted, non community-wiki answers of a minimum length are eligible