This letter was originally published in our 2024 Annual Report.
The past year at ISRG has been a great one and I couldn’t be more proud of our staff, community, funders, and other partners that made it happen. Let’s Encrypt continues to thrive, serving more websites around the world than ever before with excellent security and stability. Our understanding of what it will take to make more privacy-preserving metrics more mainstream via our Divvi Up project is evolving in important ways.
Okay, but (if the big ones didn’t enforce it) a home made cert would also stop a man in the middle attack.
And if I figure it’s compromised, I just deal with it through my hoster or on my home-lab server.
I just don’t see why it should be a “trusted” entity in there at all. I know today it is how it works but I feel we could and should do away with it (in magic wonderland I guess :-)
Okay, but (if the big ones didn’t enforce it) a home made cert would also stop a man in the middle attack.
It would not, because the “man in the middle” would simply provide their own, also self-signed certificate, to the client and the client would have no way of verifying that that certificate is not to be trusted. The client is unable to distinguish between your self-signed cert and the attacker’s. That’s why the CA is needed, to verify that the certificate is actually issued by whoever you think it is.
This is why browsers do not trust self-signed certificates. They can’t verify who that “self” is. Doing away with it is a massive security vulnerability.
Okay, but (if the big ones didn’t enforce it) a home made cert would also stop a man in the middle attack.
And if I figure it’s compromised, I just deal with it through my hoster or on my home-lab server.
I just don’t see why it should be a “trusted” entity in there at all. I know today it is how it works but I feel we could and should do away with it (in magic wonderland I guess :-)
It would not, because the “man in the middle” would simply provide their own, also self-signed certificate, to the client and the client would have no way of verifying that that certificate is not to be trusted. The client is unable to distinguish between your self-signed cert and the attacker’s. That’s why the CA is needed, to verify that the certificate is actually issued by whoever you think it is.
This is why browsers do not trust self-signed certificates. They can’t verify who that “self” is. Doing away with it is a massive security vulnerability.
Thanks for the explanation it does make sense.