Are you sure they can’t decrypt? They have your certificate after all. Besides, if the Orange has a bad day, he can ban certificates export or just for a single company or individual.
Comment on Letsencrypt is under US jurisdiction. Is there a free-er alternative?
talkingpumpkin@lemmy.world 5 hours ago
What risk are you trying to mitigate, specifically?
If it’s the CA taking over your site, control over your CA specifically doesn’t really give any advantage to an attacker (they would have to hijack traffic and provide a new certificate - nobody will notice if the certificate is from a different CA).
Note that your CA cannot decrypt the exchanges between your server and its clients.
Mihies@programming.dev 3 hours ago
KyuubiNoKitsune@lemmy.blahaj.zone 3 hours ago
Yes, the private key never leaves your machine.
You send them a certificate signing request with your public key, they put their verification stamp on it and send it to you.
The only part they have to play is verifying that your certificate is trusted by a root certificate.
litchralee@sh.itjust.works 3 hours ago
The CA cannot decypt: they don’t have the secret key which only the server has. When requesting a new certificate from the CA, the server generated a secret key (aka private key) and then generated a derived value that goes into a Certificate Signing Request (CSR). The CSR is what the CA receives, not the secret key, and then the CA returns the certificate file to the server, which has been endorsed by the CA and thus trusted by the user base.
Mihies@programming.dev 1 hour ago
Yep, you guys are right.
possiblylinux127@lemmy.zip 2 hours ago
The certificate is only used for authentication. The actual data is encrypted with a temporary symmetric key that is generated via a diffie-hellman exchange
talkingpumpkin@lemmy.world 2 hours ago
They don’t have your private key
possiblylinux127@lemmy.zip 2 hours ago
The private key isn’t used for encryption
IpsumLauren@lemmy.world 3 hours ago
It opens the possibility of a man-in-the-middle attack.
WhyJiffie@sh.itjust.works 3 hours ago
which is still there if you are not using lets encrypt, because they can strongarm them to make a fake cert for your domain, and install a proxy repackaging HTTPS traffic with the fake certificate. all browsers trust the lets encrypt root certificate, so they won’t see anything suspicious.
the only thing there today to detect this (but not avoid) is certificate transparency logs. all modern certificates are required to be added to this log, for the CA to remain compliant. but browsers are not checking the logs, that would be a lot of additional traffic and how do they decide if a certificate was created maliciously? also, lets encrypt could afford being noncompliant, browser vendors can’t realistically just distrust their root certificate, many sites would become inaccessible.
IpsumLauren@lemmy.world 2 hours ago
Oh snap! That definitely sounds possible. Found more info about it.
tl;dr: Either the attack is ineffective against some browsers that check the certificate transparency logs (like Chrome), or the attack is visible and the CA will lose all its credibility (hopefully being removed from the browsers).
WhyJiffie@sh.itjust.works 1 hour ago
and details: wiki.mozilla.org/…/Certificate_Transparency
this sounds important:
this also means, it can’t truly verify SCT’s that were issued since the last browser update?
WhyJiffie@sh.itjust.works 1 hour ago
it seems Firefox started doing the CT validation too, without needing to contact the CT log service: developer.mozilla.org/…/Certificate_Transparency#…
possiblylinux127@lemmy.zip 2 hours ago
Maybe I’m mistaken but aren’t the logs cryptography verifiable? (As in you can’t create a rouge cert without it creating a trace)
WhyJiffie@sh.itjust.works 1 hour ago
apparently certs can have a cryptographic proof of having been included in the CT logs. but what do browsers do if the letsencrypt cert has no such proof?
moonpiedumplings@programming.dev 2 hours ago
The problem is that if that is your threat model, then the VPS provider, ISP, and literally everything between you and letsencrypt can pull a conpromised key fro letsencrypt.
This actually happened btw, an xmpp server was attacked this way, they compromised not the server itself, but the VPS provider MITMed their traffic: www.devever.net/~hl/xmpp-incident
If your threat model involves this, then the only solution is Tor, which eliminates these requirements of trust.
talkingpumpkin@lemmy.world 2 hours ago
Yep, that’s what I described and any CA accepted by the client can do it