I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
Let’s encrypt is very transparent and has been designed to be auditable. What are you worried about exactly?
That the U.S. government can arbitrarily take down websites by revoking certificates issued by let’s encrypt? How obvious can it be? I wondered the same thing as OP months ago. We need european alternatives. I think there are some, have some bookmarked somewhere.
Certificate revocation is a joke and has been for over a decade
Huh, FF on Android doesn’t care.
Most browsers don’t, hence my calling revocation a joke.
So many in this thread are up in arms about something the majority of browsers don’t care about and have actively ignored for as long as I can recall
Yeah, I was just surprised bc the page explicitly lauds FF for checking revocation.
It may only be the desktop version, most mobile browsers aren’t as feature complete as their desktop counterparts.
But, given Google ripped revocation checking out of chromium, I wouldn’t be surprised if they nerfed it in Android too…
If the certificate only lasts two months revocation isn’t necessary, just deny recertification.
And what if you need to get a new certificate?
You go to a different CA
Aren’t we back at OP’s question?
That’s the question of this thread. Yes.
Still American. de-Americanizing the tech stack is a good idea.
Are you trying to solve a technica, or political/moral problem? Let’s Encrypt doesn’t create, see, store or log your private cerficates. So, even if they are in the US, I don’t see a risk, and otherwise, the other parts you use in general are probably vulnerable to the problem even if non-US.
For ex. the US could simply order browsers stop validating any certificates not issues by US companies in browsers. And whoosh. Having a non-US certificate won’t help much there either.
This is nonsense. Firefox is open source, you can just fork it.
uncle sam. audit away. until sam says “give me the keys” and then sam has the keys
The transparency logs would mean that any rouge certificates created would leave a paper trail not to mention there is nothing stopping them from issuing a certificate for any domain of their choosing
I think Let’s Encrypt will stay safe for quite a while, but unfortunately because of the political climate we’re in right now, it may not stay safe in the future.