logoalt Hacker News

pibakertoday at 4:36 AM6 repliesview on HN

What are the viable alternatives to LE? And in case none exists, what does it take to build one?

Requirements: free, available to everyone, automation friendly, issues certificates that are actually considered trustworthy by other parties.


Replies

treeskneestoday at 4:48 AM

ZeroSSL – free 90-day certs via ACME, also has a web UI for cert management

Google Trust Services – free ACME certs, requires a Google account for registration

SSL.com Free DV SSL – offers free 90-day certs through ACME

show 1 reply
JumpCrisscrosstoday at 5:42 AM

Have the EU or Canada pushed to launch an analog of their own?

It seems a bit silly that a service that could be forced by EO to revoke foreign certificates is the backbone of so much of the internet.

dlcarriertoday at 5:11 AM

This video explores a little on how certificate authorities were given their authority and a lot on how it can fail: https://www.youtube.com/watch?v=M1si1y5lvkk

It's a bit mathy, but if you can make it through that, I highly recommend watching the whole video, especially if you like dad jokes.

evboguetoday at 4:38 AM

Like peers could sign sites?

ksimukkatoday at 4:52 AM

[dead]

otabdeveloper4today at 4:58 AM

> What are the viable alternatives to LE?

None. Big tech intentionally made Let's Encrypt a single point of giant failure.

> And in case none exists, what does it take to build one?

A new Internet and Web standards stack. The whole problem is self-imposed -- we could have published self-signed Ed25519 keys on the DNS instead, and the result would be more secure than whatever it is we have now.