130 votes

Let's Encrypt for intranet websites?

Let's Encrypt can only issue certificates for valid DNS names. So if your intranet uses a made-up domain name like intranet.mycompany.local then it won't work. If you have a real DNS name like ...
user avatar
  • 1,961
130 votes

Why are Let's Encrypt certificates accepted by default by browsers?

I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against. A standard certificate only certify that the owner of the certificate actually ...
user avatar
  • 64.2k
106 votes
Accepted

Should I revoke no longer used Let's Encrypt certificates before destroying them?

This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved. Cost To you: the effort of revoking the cert. If you have to do this manually, ...
user avatar
94 votes
Accepted

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

Let's Encrypt is a Certificate Authority, and they have more or less the same privileges and power of any other existing (and larger) certificate authority in the market. As of today, the main ...
user avatar
69 votes

What makes Let's Encrypt secure?

Same security as other DV certs What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of ...
user avatar
47 votes
Accepted

Should I activate HSTS with Let’s Encrypt Certificates?

Yes, you should activate HSTS. HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect ...
user avatar
  • 43.8k
38 votes
Accepted

Is there any security risk when a certificate authority is used more than all others?

TL;DR: It does not matter much. The only security "risk" here really is the CA being "Too big to fail", where the browsers cannot distrust the CA quickly. But this is happening to all big CAs, not ...
user avatar
35 votes

Let's Encrypt for intranet websites?

If you are looking for a internal CA-like service for an Intranet, then a public CA like Lets Encrypt may not work, as it want to connect back to its servers to manage the cert request and signing. ...
user avatar
26 votes

Should I revoke no longer used Let's Encrypt certificates before destroying them?

Revocation is not necessary, from a security point of view, if the private key is not compromised. Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: ...
user avatar
  • 2,053
22 votes

Why are Let's Encrypt certificates accepted by default by browsers?

Why does your browser trust certificates from the Let's Encrypt initiative? Just to make this part clear: Your browser/computer trusts these certificates, because it acknowledged the root CA "DST ...
user avatar
21 votes

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

The reason to use Let's Encrypt can be the price. Those certificates will be for free. But I see one possible disadvantage for nonsmall web sites. Big CA offer wildcard certificates, Extended ...
user avatar
18 votes
Accepted

Why can't Let's Encrypt support wildcard certificates?

Let's Encrypt just announced that they will offer wildcard certificates in 2018: Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only ...
user avatar
18 votes

Should I revoke no longer used Let's Encrypt certificates before destroying them?

One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation ...
user avatar
  • 449
18 votes
Accepted

Creating sub CA signed with Let's Encrypt certificate

Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.) To see if your certificate is a CA, ...
user avatar
16 votes

Let's Encrypt for intranet websites?

UPDATE 2019-03-30: Somebody actually found a large scale way of doing LE for internal servers: https://blog.heckel.xyz/2018/08/05/issuing-lets-encrypt-certificates-for-65000-internal-servers/ ——————- ...
user avatar
16 votes

How does "Let's Encrypt" provide authenticity?

If you follow the links from the first Wikipedia link you provided, you'll find the spec for the ACME protocol that Let's Encrypt will use. And what it says is: Because there are many different ...
user avatar
  • 10.1k
15 votes
Accepted

Benefits of a wildcard vs per-subdomain certificates

For websites which dynamically generate subdomains (for example, if users can create their own subdomain for some service), installing a certificate for each new subdomain is far from ideal, because ...
user avatar
  • 7,372
14 votes

What makes Let's Encrypt secure?

Yes, the protocol you describe only ensures that "the person who picks up the phone at awesome bank" when you call them, is the same person who picked up the phone at awesome bank when the Let's ...
user avatar
  • 2,008
14 votes
Accepted

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

TL;DR: Yes, checking for that domain in any public CT Log viewer and finding only certs that you bought will give you pretty high confidence that no malicious certs were issued to that domain. Yup, I ...
user avatar
12 votes
Accepted

How secure is "Let's Encrypt"?

Try "acme-tiny" There is an alternative "Let's encrypt"-client project called "acme-tiny". It is less automated, but smaller. In their own words: This is a tiny, ...
user avatar
12 votes
Accepted

Let's Encrypt is based in the US and subject to US laws

Good questions all. I can't speak too much to other things they could do, but here's some comment on the ones your brought up: Yes, they could revoke a certificate. But while this could cause some ...
user avatar
  • 3,978
11 votes

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

One disadvantage that makes big companies not consider Let's Encrypt is that visitors that connect to the site can't be sure that it is the actual company that hosts the site. This is because Let's ...
user avatar
  • 973
11 votes

How does LetsEncrypt.org's ACME work?

The ACME spec lists a number different challenges: Identifier Validation Challenges 7.1. Simple HTTP 7.2. Domain Validation with Server Name Indication (DVSNI) 7.3. Proof of Possession of ...
user avatar
11 votes

Why are Let's Encrypt certificates accepted by default by browsers?

Certificate do not provide any more guarantee that what is in the certificate itself. In the case of Let's encrypt certificates, all that is guaranteed is that the server you are connected to belongs ...
user avatar
  • 18.5k
11 votes
Accepted

Let's Encrypt and EV certificates for different hosts in the same domain

It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to ...
user avatar
9 votes
Accepted

Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?

Very short answer: Would NSA have any cryptographic advantage because of that, Yes. And that applies to any certificate authority: Whomever your users trust to authenticate your website is able to ...
user avatar
8 votes

Benefits of a wildcard vs per-subdomain certificates

Additional point to consider is that all certificates issued by Let's Encrypt (and by other issuers) can be viewed in Certificate Transparency logs, so if you issue certificates without using ...
user avatar
  • 180
8 votes

What makes Let's Encrypt secure?

Let's Encrypt is designed to help against a range of attacks and to push the generalization of TLS usage to have a globally safer and more private internet. It is aimed more precisely to remove ...
user avatar
8 votes

How can I set a lower trust level for Let's Encrypt in Firefox?

As Matthew says, the difference isn't between Let's Encrypt and other CAs, it is between Domain Validated (DV) and Extended Validation (EV) certificates. That's what you want to distinguish, since ...
user avatar
  • 6,311

Only top scored, non community-wiki answers of a minimum length are eligible