Skip to main content
133 votes

Let's Encrypt for intranet websites?

Let's Encrypt can only issue certificates for valid DNS names. So if your intranet uses a made-up domain name like intranet.mycompany.local then it won't work. If you have a real DNS name like ...
John Morahan's user avatar
  • 2,001
133 votes

Why are Let's Encrypt certificates accepted by default by browsers?

I think you are misunderstanding what a SSL certificate actually certifies, and what it is designed to protect against. A standard certificate only certify that the owner of the certificate actually ...
Anders's user avatar
  • 65.6k
106 votes
Accepted

Should I revoke no longer used Let's Encrypt certificates before destroying them?

This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved. Cost To you: the effort of revoking the cert. If you have to do this manually, ...
Mike Ounsworth's user avatar
80 votes
Accepted

Reasons to distrust Let's Encrypt certificates

This is an old policy. Getting a certificate was difficult and expensive, which prevented malicious people from getting it, which made it an easy way to identify "trusted" sites. Because LE ...
schroeder's user avatar
  • 131k
47 votes
Accepted

Should I activate HSTS with Let’s Encrypt Certificates?

Yes, you should activate HSTS. HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect ...
Arminius's user avatar
  • 44.9k
38 votes
Accepted

Is there any security risk when a certificate authority is used more than all others?

TL;DR: It does not matter much. The only security "risk" here really is the CA being "Too big to fail", where the browsers cannot distrust the CA quickly. But this is happening to all big CAs, not ...
Peter Harmann's user avatar
26 votes

Should I revoke no longer used Let's Encrypt certificates before destroying them?

Revocation is not necessary, from a security point of view, if the private key is not compromised. Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: ...
Tom's user avatar
  • 2,105
22 votes

Why are Let's Encrypt certificates accepted by default by browsers?

Why does your browser trust certificates from the Let's Encrypt initiative? Just to make this part clear: Your browser/computer trusts these certificates, because it acknowledged the root CA "DST ...
Stefan Braun's user avatar
18 votes
Accepted

Why can't Let's Encrypt support wildcard certificates?

Let's Encrypt just announced that they will offer wildcard certificates in 2018: Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only ...
Emil Stenström's user avatar
18 votes

Should I revoke no longer used Let's Encrypt certificates before destroying them?

One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation ...
hildred's user avatar
  • 449
18 votes
Accepted

Creating sub CA signed with Let's Encrypt certificate

Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.) To see if your certificate is a CA, ...
Mike Ounsworth's user avatar
16 votes
Accepted

Benefits of a wildcard vs per-subdomain certificates

For websites which dynamically generate subdomains (for example, if users can create their own subdomain for some service), installing a certificate for each new subdomain is far from ideal, because ...
Jacco's user avatar
  • 7,712
14 votes
Accepted

Verifying that no malicious certificate has been issued while a DNS record was pointing to an uncontrolled IP

TL;DR: Yes, checking for that domain in any public CT Log viewer and finding only certs that you bought will give you pretty high confidence that no malicious certs were issued to that domain. Yup, I ...
Mike Ounsworth's user avatar
12 votes
Accepted

Let's Encrypt is based in the US and subject to US laws

Good questions all. I can't speak too much to other things they could do, but here's some comment on the ones your brought up: Yes, they could revoke a certificate. But while this could cause some ...
nbering's user avatar
  • 4,028
11 votes

Why are Let's Encrypt certificates accepted by default by browsers?

Certificate do not provide any more guarantee that what is in the certificate itself. In the case of Let's encrypt certificates, all that is guaranteed is that the server you are connected to belongs ...
Stephane's user avatar
  • 18.7k
11 votes
Accepted

Let's Encrypt and EV certificates for different hosts in the same domain

It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to ...
Steffen Ullrich's user avatar
10 votes
Accepted

Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?

Very short answer: Would NSA have any cryptographic advantage because of that, Yes. And that applies to any certificate authority: Whomever your users trust to authenticate your website is able to ...
Marcus Müller's user avatar
9 votes

How can I set a lower trust level for Let's Encrypt in Firefox?

As Matthew says, the difference isn't between Let's Encrypt and other CAs, it is between Domain Validated (DV) and Extended Validation (EV) certificates. That's what you want to distinguish, since ...
crovers's user avatar
  • 6,381
9 votes

Benefits of a wildcard vs per-subdomain certificates

Additional point to consider is that all certificates issued by Let's Encrypt (and by other issuers) can be viewed in Certificate Transparency logs, so if you issue certificates without using ...
WGH's user avatar
  • 190
8 votes
Accepted

what is the maximum life-time for Let's Encrypt certificates

What is the lifetime for Let’s Encrypt certificates? For how long are they valid? Our certificates are valid for 90 days. You can read about why here. There is no way to adjust this, there are no ...
vidarlo's user avatar
  • 16.6k
8 votes
Accepted

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

It seems that it's not possible obtain a certificate from Lets Encrypt for a public IP address, without a domain name. See https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-...
mti2935's user avatar
  • 23.6k
8 votes

Reasons to distrust Let's Encrypt certificates

There are three classes of certificates: Domain Validated (DV) Organization Validated (OV) Extended Validation (EV) Domain validated certs are just that: you simply need to demonstrate control over ...
JimmyJames's user avatar
  • 3,069
7 votes
Accepted

How does Let's Encrypt prevent imposters?

Although Let's Encrypt issues domain-validated certificates and these guarantee only that a certificate was requested by an entity owning the domain, it does have policies in place to prevent ...
techraf's user avatar
  • 9,139
7 votes

Revoke Let's Encrypt CA for all devices in my organization?

Frame challenge! The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important ...
Conor Mancone's user avatar
7 votes
Accepted

Let's Encrypt certificate lifetime incident: is there any security risk?

The related task that they've opened explains why they do not plan to revoke certificates, and offers the following reasons for not doing so: "we do not believe that revoking certificates ...
gowenfawr's user avatar
  • 72.9k
7 votes
Accepted

Can Namecheap get certificates issued for my domain without my knowledge?

Can Namecheap get certificates issued for my domain Yes. They control the nameservers, so they could change the records to allow issuing a certificate for your domain. And when not using their ...
Ángel's user avatar
  • 18.9k
6 votes

Can Let's Encrypt be used by someone like the NSA to effectively break SSL/TLS?

NO (but maybe yes). Short answer is sound no, because your web site private key is never sent to letsencypt, and thus encrypted communication between clients and server cannot be decrypted any ...
Matija Nalis's user avatar
  • 2,295
6 votes

Let's Encrypt is based in the US and subject to US laws

And They could refuse to issue new certificates. They could be forced to give your personal data (registration email, list of linked domains to your ACME account, IPs of your server, ...) to US ...
Tom's user avatar
  • 2,105
6 votes

Should the Strict-Transport-Security max-age be tied to the duration of the certificate?

It's two separate things. LetsEncrypt set their certificates to be short-lived because they expect their users to constantly renew them, short-lived certificates limit the exposure time of a lost ...
keithRozario's user avatar
  • 3,711

Only top scored, non community-wiki answers of a minimum length are eligible