343
Letsencrypt is under US jurisdiction. Is there a free-er alternative? (sopuli.xyz)
submitted 1 week ago by to c/selfhosted@lemmy.world
155 comments fedilink hide all child comments
 

I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 week ago (2 children)

Oh snap! That definitely sounds possible. Found more info about it.

tl;dr: Either the attack is ineffective against some browsers that check the certificate transparency logs (like Chrome), or the attack is visible and the CA will lose all its credibility (hopefully being removed from the browsers).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 1 week ago

    and details: https://wiki.mozilla.org/SecurityEngineering/Certificate_Transparency

    this sounds important:

    This information has a 10 week expiration time. That is, if 10 weeks have passed since the information has been updated (typically by updating Firefox itself), the implementation will no longer enforce certificate transparency.

    this also means, it can't truly verify SCT's that were issued since the last browser update?

  • permalink
  • fedilink
  • source
  • parent