Letsencrypt is under US jurisdiction. Is there a free-er alternative?

Comments

• possiblylinux127@lemmy.zip ⁨37⁩ ⁨minutes⁩ ago

  Let’s encrypt is very transparent and has been designed to be auditable. What are you worried about exactly?

  original
• yesman@lemmy.world ⁨3⁩ ⁨hours⁩ ago

  Simi-related fun fact.

  The biggest contributor to TOR is the CIA. They funded it’s creation and are primarily responsible for maintaining it to this day.

  The CIA maintains TOR as a way for spies to pass information over the internet. They make it public because if only spies used TOR it would be trivial to catch them. So it’s in their interest that it be public and secure. It’s open source and security experts agree you can trust it.

  original

  • possiblylinux127@lemmy.zip ⁨58⁩ ⁨minutes⁩ ago

    Lost Lemmings?

    original
  • plyth@feddit.org ⁨2⁩ ⁨hours⁩ ago

    The CIA, not navy intelligence?

    The core principle of Tor, known as onion routing, was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, to protect American intelligence communications online.

    en.wikipedia.org/wiki/Tor_(network)

    original
• diecknet@discuss.tchncs.de ⁨7⁩ ⁨hours⁩ ago

  There are some commercial Certificate Authorities that offer free certificates. But in contrast Let’s Encrypt is a non-profit.

  • ZeroSSL (Austria)
  • Actalis (Italy)

  original

  • possiblylinux127@lemmy.zip ⁨31⁩ ⁨minutes⁩ ago

    ZeroSSL is probably what OP is looking for

    original
  • victorz@lemmy.world ⁨2⁩ ⁨hours⁩ ago

    commercial

    free certificates

    How do they make money?

    original

    • bjoern_tantau@swg-empire.de ⁨2⁩ ⁨hours⁩ ago

      Usually they make money with extended certificates where they not only offer a certificate for example.com but also certify that it belongs to Example Ltd.

      Those extended certificates used to show the company name next to address bars, but I don’t think browsers do that anymore.

      original

      • -> View More Comments
• talkingpumpkin@lemmy.world ⁨3⁩ ⁨hours⁩ ago

  What risk are you trying to mitigate, specifically?

  If it’s the CA taking over your site, control over your CA specifically doesn’t really give any advantage to an attacker (they would have to hijack traffic and provide a new certificate - nobody will notice if the certificate is from a different CA).

  Note that your CA cannot decrypt the exchanges between your server and its clients.

  original

  • IpsumLauren@lemmy.world ⁨1⁩ ⁨hour⁩ ago

    It opens the possibility of a man-in-the-middle attack.

    original

    • WhyJiffie@sh.itjust.works ⁨1⁩ ⁨hour⁩ ago

      which is still there if you are not using lets encrypt, because they can strongarm them to make a fake cert for your domain, and install a proxy repackaging HTTPS traffic with the fake certificate. all browsers trust the lets encrypt root certificate, so they won’t see anything suspicious.

      the only thing there today to detect this (but not avoid) is certificate transparency logs. all modern certificates are required to be added to this log, for the CA to remain compliant. but browsers are not checking the logs, that would be a lot of additional traffic and how do they decide if a certificate was created maliciously? also, lets encrypt could afford being noncompliant, browser vendors can’t realistically just distrust their root certificate, many sites would become inaccessible.

      original

      • -> View More Comments
    • moonpiedumplings@programming.dev ⁨45⁩ ⁨minutes⁩ ago

      The problem is that if that is your threat model, then the VPS provider, ISP, and literally everything between you and letsencrypt can pull a conpromised key fro letsencrypt.

      This actually happened btw, an xmpp server was attacked this way, they compromised not the server itself, but the VPS provider MITMed their traffic: www.devever.net/~hl/xmpp-incident

      If your threat model involves this, then the only solution is Tor, which eliminates these requirements of trust.

      original
    • talkingpumpkin@lemmy.world ⁨46⁩ ⁨minutes⁩ ago

      Yep, that’s what I described and any CA accepted by the client can do it

      original
  • Mihies@programming.dev ⁨2⁩ ⁨hours⁩ ago

    Are you sure they can’t decrypt? They have your certificate after all. Besides, if the Orange has a bad day, he can ban certificates export or just for a single company or individual.

    original

    • possiblylinux127@lemmy.zip ⁨34⁩ ⁨minutes⁩ ago

      The certificate is only used for authentication. The actual data is encrypted with a temporary symmetric key that is generated via a diffie-hellman exchange

      original
    • KyuubiNoKitsune@lemmy.blahaj.zone ⁨2⁩ ⁨hours⁩ ago

      Yes, the private key never leaves your machine.

      You send them a certificate signing request with your public key, they put their verification stamp on it and send it to you.

      The only part they have to play is verifying that your certificate is trusted by a root certificate.

      original
    • talkingpumpkin@lemmy.world ⁨47⁩ ⁨minutes⁩ ago

      They don’t have your private key

      original

      • -> View More Comments
    • litchralee@sh.itjust.works ⁨1⁩ ⁨hour⁩ ago

      The CA cannot decypt: they don’t have the secret key which only the server has. When requesting a new certificate from the CA, the server generated a secret key (aka private key) and then generated a derived value that goes into a Certificate Signing Request (CSR). The CSR is what the CA receives, not the secret key, and then the CA returns the certificate file to the server, which has been endorsed by the CA and thus trusted by the user base.

      original
• pHr34kY@lemmy.world ⁨7⁩ ⁨hours⁩ ago

  I don’t think anyone is gonna solve that problem until it’s actually a problem.

  original

  • A_norny_mousse@piefed.zip ⁨7⁩ ⁨hours⁩ ago

    It is a problem, and there are solutions.

    original
  • Pika@sh.itjust.works ⁨3⁩ ⁨hours⁩ ago

    I don’t think anyone’s going to solve the problem in general, to be honest.

    Like, Let’s Encrypts goal is super novel, but also expensive as shit to actually run, and requires a lot of coordination because it needs to be a trust authority. If this ever happened, it would probably be at the backing of some government structure, because I don’t see many people wanting to jump at that at an expense.

    original
• IpsumLauren@lemmy.world ⁨4⁩ ⁨hours⁩ ago

  First let’s identify what parts of the world are free-er than the US (for a certificate).

  original

  • KyuubiNoKitsune@lemmy.blahaj.zone ⁨2⁩ ⁨hours⁩ ago

    Malta or Cyprus maybe? My first thought is places where dodgy people do dodgy shit, like gambling.

    original
• A_norny_mousse@piefed.zip ⁨7⁩ ⁨hours⁩ ago

  This is why I never even started using Letsencrypt; looking at the fine print, you actually enter into some kind of contract with some US entity, which I don’t want even if it’s the coolest of all FOSS foundations.

  Here’s a site that has some info:
  https://www.eurotoolkit.eu/categories/certificate-authority-ca
  I have used certum.pl for years and it looks like I might go back to them soon because my VPS provider doesn’t offer bundled certs anymore.

  I used to pay €40/year iirc. I suspect it’s gotten more expensive though.

  original

  • state_electrician@discuss.tchncs.de ⁨5⁩ ⁨hours⁩ ago

    ZeroSSL costs 180 per year for unlimited 90 day certs. I get the independence from US-based services, but I don’t want to drop that kind of money on my toy domains.

    original

    • A_norny_mousse@piefed.zip ⁨1⁩ ⁨hour⁩ ago

      I think you misunderstood something there; they’re very explicitely offering free certs.

      original

      • -> View More Comments
• pdl@social.tchncs.de ⁨6⁩ ⁨hours⁩ ago

  @Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server's IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.

  original

  • WhyJiffie@sh.itjust.works ⁨57⁩ ⁨minutes⁩ ago

    Actually the problem is that they are too widespread. if something happened, and they started creating fake certificates, for outside force or otherwise, they can’t just be blocked because literally half of the internet or more breaks. what’s worse, if browser vendors trued that, people would be downgrading their browser to the last version accepting it, and become exposed to publicly revealed security vulnerabilities. not all because its a bit complicated, but enough would do to have it cause an even greater problem.

    original

    • possiblylinux127@lemmy.zip ⁨29⁩ ⁨minutes⁩ ago

      You do make a good point. However, Let’s encrypt is run by the IRSG which is a non profit focused on improving internet security. They are the ones who are pushing for shorter certificate lifetimes among other things.

      original
  • Sibbo@sopuli.xyz ⁨6⁩ ⁨hours⁩ ago

    Letsencrypt can be directly forced to revoke certificates by the US. Organisations outside of the US are less vulnerable against that.

    original

    • slazer2au@lemmy.world ⁨5⁩ ⁨hours⁩ ago

      And ICAAN can hand your domain over to US law enforcement regardless of the TLD and your register.

      Is that also part of your decision tree?

      original

      • -> View More Comments
    • IpsumLauren@lemmy.world ⁨1⁩ ⁨hour⁩ ago

      That would be just a nuisance until a new certificate is generated with another vendor (possibly not for free, but cheap enough).

      original
    • pdl@social.tchncs.de ⁨5⁩ ⁨hours⁩ ago

      @Sibbo Of course. Actually, there are 200 million active certificates issued by Letsencrypt. Revoking them, 200 million websites would be down. 200 million websites all over the world, including US. I don't think this is a realistic scenario.
      If you are worried about that, you should avoid any software developed in US. You should avoid any software which itself or its sources are hosted in US. Mastodon is available on Github, this is Microsoft. US authorities may force Github to shutdown or infiltrate the hosted sources with spyware.

      original
• Decronym@lemmy.decronym.xyz ⁨3⁩ ⁨hours⁩ ago

  Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

  Fewer Letters	More Letters
  CA	(SSL) Certificate Authority
  DNS	Domain Name Service/System
  VPS	Virtual Private Server (opposed to shared hosting)

  ---

  [Thread #107 for this comm, first seen 19th Sep 2026, 15:40] [FAQ] [Full list] [Contact] [Source code]

  original
• cupcakezealot@piefed.blahaj.zone ⁨4⁩ ⁨hours⁩ ago

  is it possible to get the eff to move elsewhere?

  original

  • BartyDeCanter@piefed.social ⁨4⁩ ⁨hours⁩ ago

    And give up the best weather and access to 5 star restaurants in the world? Surely you jest!

    original
• heartSagan5@lemmy.zip ⁨1⁩ ⁨hour⁩ ago

  I just self-host Bitwarden.

  original

  • WhyJiffie@sh.itjust.works ⁨1⁩ ⁨hour⁩ ago

    you don’t know how bitwarden works, do you?

    original
• maiuz@mastodon.uno ⁨5⁩ ⁨hours⁩ ago

  @Sibbo
  I use Italian Actalis (https://www.actalis.com/) with Caddy even if I do not think that is free-er

  Attachment: www.actalis.com ↗

  original