Stories
Slash Boxes
Comments

SoylentNews is people

The "Let's Encrypt" Project Generates Root and Intermediate Certificates

posted by n1 on Wednesday June 10 2015, @01:59AM   Printer-friendly
from the safety-in-numbers dept.

Yog-Yogguth writes:

Let's Encrypt has announced the generation of root and intermediate certificates, share the public keys, and show the layout of their operational structure. The keys are RSA (the Rivest, Shamir, and Adleman algorithm) for now with ECDSA (Elliptic Curve Digital Signature Algorithm) versions coming later this year.

The root certificates are for the Internet Security Research Group (ISRG) and separately for the Online Certificate Status Protocol (OCSP) for the ISRG. OCSP is described in RFC 6960 and used for revocation of certificates.

The intermediate certificates are for two different intermediate Let's Encrypt CA (Certificate Authority) servers named/numbered X1 and X2. These are cross-signed by the IdenTrust root CA for ease of deployment and use by existing browsers without the need for any modifications until the browsers add the ISRG root CA through updates. The Let's Encrypt intermediate CA X2 is only intended for disaster recovery in case of a non-functional X1. The Let's Encrypt announcement has a schematic of the structure.

The target is (or was) to launch the Let's Encrypt service in the second quarter of 2015 (which ends this month) and they plan on further announcements during the next few weeks.

Original Submission

 
This discussion has been archived. No new comments can be posted.
The "Let's Encrypt" Project Generates Root and Intermediate Certificates | Log In/Create an Account | Top | 28 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Wednesday June 10 2015, @06:53AM

    by Anonymous Coward on Wednesday June 10 2015, @06:53AM (#194418)

    The main problem with PKI is that there's no way to limit the authority of a CA. You either trust it implicitly, or you don't. It would be nice if a CA could be restricted to just a section of the DNS namespace (for instance, why should a Chinese CA be allowed to issue certificates to .gov domains?) or prevent a CA from issuing certificates to domains which already have valid certificates from another CA, but sadly this just isn't possible under the current system.

    I think most of us around here know this already, and I run Perspectives (not that it seems to help since their servers crash all the time and several sites like Google use so many certs as to not be trackable). There was that one project (Convergence? something like that) but it seemed to die from lack of interest.

    Sooooo...the billion dollar question (literally, I think): what do we replace PKI with?