Let's Encrypt
letsencrypt.org
Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report.

Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

  • treadful@lemmy.zipEnglish
    3·
    3 hours ago

    They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it’s so difficult and expensive.

    • xthexder@l.sw0.comEnglish
      2·
      55 minutes ago

      Well, it’s difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.

      • treadful@lemmy.zipEnglish
        1·
        33 minutes ago

        Correct me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.

        The impact is serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.

        It doesn’t improve encryption compared to a self-signed cert though.