Let’s Encrypt Receives the Levchin Prize for Real-World Cryptography (opens in new tab)

The major cloud providers have options for free certs: Amazon and Google run CAs, and Azure has an option for free certs from Digicert. Amazon and Azure both work with their services. Google just announced they’re supporting the same ACME protocol that Lets Encrypt uses too!

It is somewhat important for Let’s Encrypt to have competition: For reliability it is good to have alternatives with no shared infrastructure. If Let’s Encrypt ever becomes untrustworthy (and as a LE employee, I hope that never happens!) there must be alternatives so the root programs have the option to remove the Let’s Encrypt root. And there’s many geopolitical concerns too.

It’s not even a competition. Every customer increases costs to provide the service. More people handling the load of signing keys means less cost for a public service. It’s a shared ecosystem of trust. Yes, you can make the argument that too many CAs is untrustworthy, I would agree. But there is a reliability and availability argument, both security objectives, to having alternatives. There is probably an optimal point between redundancy and too many cooks.

ZeroSSL appears to have the advantage of fewer rate limitations if that's an issue. Haven't used it a ton myself though.

> Let's Encrypt has no competition because Let's Encrypt needs no competition

I love Let's Encrypt! Truly good work for the benefit of humanity.

Still. Everything needs competition. Any single organization amassing too much influence is always a bad thing, no matter how benevolent the organization.

I'm really pleased to see someone else framing this as a national security issue. It's a point of view rarely heard.

It's frustrating because certificate revocation doesn't even really work, since most browsers don't check for it due to the various performance/privacy issues it causes. (OCSP stapling doesn't help here, because a scammer just won't use it.)

At best Let's Encrypt could revoke the cert and block them from getting a new one, but then the scam site is still good to go for 90 days. I doubt most phishing sites even last that long.

What does work, and relatively quickly, is having the web host shut down the site (basically instant), having the registrar revoke the domain (takes effect as soon as DNS caches start expiring) or adding it to the various phishing site lists used by browsers. (Not sure how often those update, I assume at least daily.)

I hope that the misguided people asking LE to shut down the domain are at least trying to contact the web host, registrar, and the safe browsing list people before hassling the (mostly volunteer) folks on the LE forums.

There are plenty of good reasons to require it. Proving a trustworthy counter-party for the request is just not one of them.

I wish this statement to be true "... scams still being a thing over mostly unencrypted traffic any day." Sadly this falls in a similar category of domain validation.

I guess, take comfort where you can?