I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
You must log in or register to comment.
- themurphy@lemmy.mlEnglish17 days
Is anyone wonders why it’s a problem it’s under US juristriction:
Look up the US Cloud Act. It’s everything the media told you China was, but in the hands of an orange dictator.
- philipp_@discuss.tchncs.deEnglish16 days
They have strong canaries in place, namely certificate transparency. They wisely designed themselves in a way to prevent themselves from tampering.
- themurphy@lemmy.mlEnglish16 days
Well, honestly?
Since these certificates are not banned nor up for debate, the NSA probably already have a way to get all the data through another loop hole.
Yes, it protects against “attacks” from outside, but it’s naive to expect they dont have another way in which goes beyond LetsEncrypt.
- 418_im_a_teapot@lemmy.worldEnglish16 days
That loophole is Google and probably cloudflare. Google has their own DNS service, a script tag on nearly every website, half the mobile phone market while being the default search engine on the other half, and provides email to the majority of people. Even if you try not to use their services, they still have an enormous amount of information about you.
- RabbitBBQ@lemmy.worldEnglish16 days
Any Govt agency with sufficient power can go to LetsEncrypt and have them either decrypt everything or issue specific certificates that can be decrypted and transparently allow man in the middle monitoring. That so much of the internet is using LetsEncrypt makes it highly likely this is all going on. It’s technically possible and the Govt wouldn’t allow LetsEncrypt to operate without being able to do this. Really this is true with all devices and encryption allowed to be sold. Unless you secretly meet all their demands they control all the required certifications and access to be able to sell your products, list them on the app stores, etc. It’s just a good rule of thumb to consider everything has this starting point unless you design and build the entire hardware and software stack to ensure nothing like this can be done. But you’ll never be able to sell it.
- 3abas@lemmy.worldEnglish16 days
Fortunately, that’s not how it works.
The private key is created on your server, not by Let’s encrypt, and it’s never transferred to them. Nobody can decrypt your data.
Certbot (the official ACME client) is open source, but you’re also welcome to use any other client of your choosing, or make your own. The secrets never leave your server.
Unless the NSA has working powerful quantum computers that can break public key encryption, that they are successfully hiding from the public, they wouldn’t be able to break let’s encrypt certificates backed public key encryption, the math just doesn’t math. It would still take the most powerful super computers millions of years to break RSA 2048.
There’s a reason they want to make encryption illegal, instead of just letting us trust it like sheep. Thankfully, we don’t have to trust anyone, it’s all verifiable math.
- diecknet@discuss.tchncs.deEnglish17 days
There are some commercial Certificate Authorities that offer free certificates. But in contrast Let’s Encrypt is a non-profit.
- ZeroSSL (Austria)
- Actalis (Italy)
- JustEnoughDucks@slrpnk.netEnglish16 days
Also the controlling party in Italy is practically neo-fascist and Austria is also sliding there again with their Nazi party like AfD in Germany and VB in Belgium getting a huge portion of votes.
I don’t see how it is that much better than a US non- profit.
I think the core thing is that you have to know of a bunch of different CA options and switch when necessary or on a compromised CA.
- philpo@feddit.orgEnglish16 days
Both Italy and Austria are EU member states , fall under the GDPR AND NIS2 and while both government(even under the FPÖ) have their downsides neither has legislation that is even remotely close to what the US even have today (and had for decades) and unlike the US both countries still have a very well working judical system and the ECJ.
So. Yes. While not perfect, their situation is massively better than a US non for profit. Total different league. Not even in the same ballpark.
17 daysUsually they make money with extended certificates where they not only offer a certificate for example.com but also certify that it belongs to Example Ltd.
Those extended certificates used to show the company name next to address bars, but I don’t think browsers do that anymore.
What risk are you trying to mitigate, specifically?
If it’s the CA taking over your site, control over your CA specifically doesn’t really give any advantage to an attacker (they would have to hijack traffic and provide a new certificate - nobody will notice if the certificate is from a different CA).
Note that your CA cannot decrypt the exchanges between your server and its clients.
- WhyJiffie@sh.itjust.worksEnglish17 days
which is still there if you are not using lets encrypt, because they can strongarm them to make a fake cert for your domain, and install a proxy repackaging HTTPS traffic with the fake certificate. all browsers trust the lets encrypt root certificate, so they won’t see anything suspicious.
the only thing there today to detect this (but not avoid) is certificate transparency logs. all modern certificates are required to be added to this log, for the CA to remain compliant. but browsers are not checking the logs, that would be a lot of additional traffic and how do they decide if a certificate was created maliciously? also, lets encrypt could afford being noncompliant, browser vendors can’t realistically just distrust their root certificate, many sites would become inaccessible.
Maybe I’m mistaken but aren’t the logs cryptography verifiable? (As in you can’t create a rouge cert without it creating a trace)
This is why I never even started using Letsencrypt; looking at the fine print, you actually enter into some kind of contract
with some US entityunder US law, which I don’t want even if it’s the coolest of all FOSS foundations.Here’s a site that has some info:
https://www.eurotoolkit.eu/categories/certificate-authority-ca
I have used certum.pl for years and it looks like I might go back to them soon because my VPS provider doesn’t offer bundled certs anymore.I used to pay €40/year iirc.
I suspect it’s gotten more expensive though.edit:
oh looks like ZeroSSL are doing it letsencrypt-style with Acme protocol for €0.edit2:
No, not more expensive. Some of the providers in the above link are labyrinthine and I couldn’t even find a Pricing section - usually a sign that it’s too expensive at least for a normal consumer - but others offer yearly certs for as little as €30 (taxes not included).edit3:
Yeah some people are going to have a hard time accepting that a contract with a for-profit company under EU jurisdiction might be preferable to a contract with a non-profit under US jurisdiction.I’ve been using ZeroSSL for over 5 years and can attest that they are friendly in that I have literally never seen or heard from them.
I’ve set up and cancelled multiple domains in this time, and have had one domain running for the entirety of my time with ZeroSSL.
I don’t think you (OP) are gonna find much better than a for-profit business with a good track record if you’re unwilling to use Letsencrypt.
- 17 days
@Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server’s IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.
- WhyJiffie@sh.itjust.worksEnglish17 days
Actually the problem is that they are too widespread. if something happened, and they started creating fake certificates, for outside force or otherwise, they can’t just be blocked because literally half of the internet or more breaks. what’s worse, if browser vendors trued that, people would be downgrading their browser to the last version accepting it, and become exposed to publicly revealed security vulnerabilities. not all because its a bit complicated, but enough would do to have it cause an even greater problem.
You do make a good point. However, Let’s encrypt is run by the IRSG which is a non profit focused on improving internet security. They are the ones who are pushing for shorter certificate lifetimes among other things.
- pHr34kY@lemmy.worldEnglish17 days
I don’t think anyone is gonna solve that problem until it’s actually a problem.
- Fmstrat@lemmy.worldEnglish16 days
It is surprisingly easy to add a custom CA to phones and laptops. When I migrated to services using one with names like
thisservice.lanI thought it would be a lot harder. I just have a generation script that makes a new cert and I throw it in NGINX.- rumba@lemmy.zipEnglish16 days
Just don’t get too close to TV’s or streaming boxes. Wildly different levels of hell
- Fmstrat@lemmy.worldEnglish15 days
Very true. I do have a let’s encrypt wildcard cert that I also use with internal IPs for instances like this. But most of my items don’t require that.
- rumba@lemmy.zipEnglish14 days
awesome, I just setup traefik / le on an old sort domain of mine and make everything inside support https.
Honestly, I was hoping to add client only certs on my jellyfin and open it to friends an family, but none of their streaming devices support it.
- Fmstrat@lemmy.worldEnglish13 days
Yea, I’ve recently learned LineageOS has an AndroidTV version that runs on a lot of devices, including the Pi. Been considering investigating that.
Let’s encrypt is very transparent and has been designed to be auditable. What are you worried about exactly?
- 16 days
Still American. de-Americanizing the tech stack is a good idea.
- Fedditor385@lemmy.worldEnglish16 days
Are you trying to solve a technica, or political/moral problem? Let’s Encrypt doesn’t create, see, store or log your private cerficates. So, even if they are in the US, I don’t see a risk, and otherwise, the other parts you use in general are probably vulnerable to the problem even if non-US.
For ex. the US could simply order browsers stop validating any certificates not issues by US companies in browsers. And whoosh. Having a non-US certificate won’t help much there either.
- 13 days
This is nonsense. Firefox is open source, you can just fork it.
- 17 days
That the U.S. government can arbitrarily take down websites by revoking certificates issued by let’s encrypt? How obvious can it be? I wondered the same thing as OP months ago. We need european alternatives. I think there are some, have some bookmarked somewhere.
- Passerby6497@lemmy.worldEnglish17 days
Certificate revocation is a joke and has been for over a decade
If the certificate only lasts two months revocation isn’t necessary, just deny recertification.
- 13 days
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority DNS Domain Name Service/System ISP Internet Service Provider VPS Virtual Private Server (opposed to shared hosting)
[Thread #107 for this comm, first seen 19th Sep 2026, 15:40] [FAQ] [Full list] [Contact] [Source code]
- IpsumLauren@lemmy.worldEnglish17 days
First let’s identify what parts of the world are free-er than the US (for a certificate).
- yesman@lemmy.worldEnglish17 days
Simi-related fun fact.
The biggest contributor to TOR is the CIA. They funded it’s creation and are primarily responsible for maintaining it to this day.
The CIA maintains TOR as a way for spies to pass information over the internet. They make it public because if only spies used TOR it would be trivial to catch them. So it’s in their interest that it be public and secure. It’s open source and security experts agree you can trust it.
- Phoenixz@lemmy.caEnglish16 days
So since this, according yo you, is a fact, I do suppose you have evidence to this claim? And I’m talking evidence that can be corroborated, not a Facebook post or something from a conspiracy sub, and not “oh man, everybody knows this!” because everybody doesn’t know this.
