Why "Let's Encrypt" free SSL certs are worse than useless -- actually dangerous -- to many sites
https://plus.google.com/+LaurenWeinstein/posts/iprFnhPwaYF You may have heard about the "Let's Encrypt" project that is ostensibly pushing for widespread adoption of SSL on websites by offering free SSL certificates on demand. What you may not have heard is that despite widespread objections (their discussion/comments threads on this are long indeed) they have apparently refused to make any certs available with expiration periods longer than 90 days, for a variety of mostly highly questionable reasons. They argue that if you run their full system you won't care, because all your certs will automatically be renewed. But in practice, many environments cannot (for policy and/or technical reasons) deploy automatic certificate management systems, and manually updating certs -- especially for multiple machines -- is often entirely impractical on such a frequent basis. Worse, it's exactly the sites with limited time and person resources, especially on legacy systems, who could have most benefited from these certificates, but have the least ability to participate in their automated environment or roll their own automated systems. And when a cert expires, given the heavy-handed, often unnecessarily panic-inducing, hard to bypass warnings of some browsers these days, it effectively can cut users off from important resources. In some situations, that's downright dangerous. It is a real shame that Let's Encrypt is being -- frankly -- so half-assed about what could have been a great program. --Lauren-- Lauren Weinstein ([email protected]): http://www.vortex.com/lauren Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com I have consulted to Google, but I am not currently doing so -- my opinions expressed here are mine alone. _______________________________________________ pfir mailing list http://lists.pfir.org/mailman/listinfo/pfir
