SoylentNews is people
SoylentNews
Professor J. Alex Halderman, the noted election security researcher, along with his co-authors, have published a summary of Let's Encrypt, its components, and what it does. (Warning for PDF.) The service Let's Encrypt is a free, automated, open certificate authority (CA) to provide TLS certificates. These are usually for web sites, enabling them to provide HTTPS connections.
Since its launch in late 2015, Let's Encrypt has grown to become the world's largest HTTPS CA, accounting for more currently valid certificates than all other browser-trusted CAs combined. By January 2019, it had issued over 538 million certificates for 223 million domain names. We describe how we built Let's Encrypt, including the architecture of the CA software system (Boulder) and the structure of the organization that operates it (ISRG), and we discuss lessons learned from the experience. We also describe the design of ACME, the IETF-standard protocol we created to automate CA–server interactions and certificate issuance, and survey the diverse ecosystem of ACME clients, including Certbot, a software agent we created to automate HTTPS deployment. Finally, we measure Let's Encrypt's impact on the Web and the CA ecosystem. We hope that the success of Let's Encrypt can provide a model for further enhancements to the Web PKI and for future Internet security infrastructure.
[...] Prior to our work, a major barrier to wider HTTPS adoption was that deploying it was complicated, expensive, and error-prone for server operators. Let's Encrypt overcomes these through a strategy of automation: identity validation, certificate issuance, and server configuration are fully robotic, which also results in low marginal costs and enables the CA to provide certificates at no charge. We designed Let's Encrypt to scale to the size of the entire Web. In just over three years of operation, it is well on its way: it has issued over 538 million certificates and accounts for more valid browser-trusted certificates than all other CAs combined. We hope that in the near future, clients will start using HTTPS as the default Web transport. Eventually, we may marvel that there was ever a time when Web traffic traveled over the Internet as plaintext.
Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web, Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, Pages 2473-2487 (DOI: 10.1145/3319535.3363192
Earlier on SN:
Let's Encrypt to Transition to ISRG Root (2019)
Three Years Later, Let's Encrypt Has Issued Over 380 Million HTTPS Certificates (2018)
Let's Encrypt is Now Officially Trusted by All Major Root Programs (2018)
Let's Encrypt Takes Free "Wildcard" Certificates Live (2018)
Free Certs Come With a Cost (2017)
Let's Encrypt Issues 100 Millionth Certificate (2017)
Let's Encrypt Won its Comodo Trademark Battle - but Now Fan Tools Must Rename (2016)
Let's Encrypt Gets Automation (2015)
(Score: 3, Interesting) by Thexalon on Tuesday November 19 2019, @08:15PM
Here's why that doesn't matter: What existed before Let's Encrypt was a system where if you had an identical level of control of a webserver (you need to be able to write to the webroot, and alter the configuration of the webserver, e.g. /etc/nginx or /etc/httpd), you could replace any existing SSL certificate with one of your own, and MITM the server for up to 2 years before anybody noticed.
I think you made the mistake of thinking that the lowest-grade SSL certificates did anything more than take your money and determine that you were capable of putting files in the webroot directory of a server they reached by DNS. And of course admins with a large set of servers to manage would semi-automate this process as much as possible. The only people who really benefited from that system were schlock certificate signers, who basically got to charge every year to run an extremely simple service that most Soylentils could code up easily. And the only security benefit to doing SSL that way versus Let's Encrypt was to increase the cost of pwning you that way by the cost of paying for a certificate.
And in most practical terms, all of this is moot, because most people have their webserver configuration root-writeable only, and if a black hat who has the slightest clue what they're doing has root temporarily, they have root permanently.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.