Re:Ca-certificates: removal of SPI CA
by JoshTriplett on Wednesday November 25, 2015 @07:38PM
(#10630689)
> I don't want any script, no matter how open or free or vetted, to have the ability to alter the certificate on the server.
You don't have to run it in an automated fashion if you don't want to. You could run it unprivileged, generate a certificate manually, vet it however you wish, and install it.
Also, given that you can generate the certificate yourself, you can generate one that keeps the same private key, and keep that key unaccessible to anything but the web server (or other server software). You could have the unprivileged script only update the public side of the certificate chain.
> nor should Google be being informed every time I obtain or renew a certificate.
Unless Let's Encrypt has implemented the Safe Browsing protocol very badly, they won't ask Google about every URL. The Safe Browsing protocol involves downloading blocks of hashes to check a host against, not asking the server about every individual URL. (Otherwise, it would be completely unacceptable for use in browsers, too.)
> If I have decided to get a certificate from Let's Encrypt (or any other CA) that should be between me and them, Google, or any other third-party, shouldn't have anything to do with it.
The entire CA system works via collective trust (and a great deal of duct tape and bailing wire). Obtaining a certificate that every browser trusts shouldn't occur in a vacuum.
You don't have to run it in an automated fashion if you don't want to. You could run it unprivileged, generate a certificate manually, vet it however you wish, and install it.
Also, given that you can generate the certificate yourself, you can generate one that keeps the same private key, and keep that key unaccessible to anything but the web server (or other server software). You could have the unprivileged script only update the public side of the certificate chain.
> nor should Google be being informed every time I obtain or renew a certificate.
Unless Let's Encrypt has implemented the Safe Browsing protocol very badly, they won't ask Google about every URL. The Safe Browsing protocol involves downloading blocks of hashes to check a host against, not asking the server about every individual URL. (Otherwise, it would be completely unacceptable for use in browsers, too.)
> If I have decided to get a certificate from Let's Encrypt (or any other CA) that should be between me and them, Google, or any other third-party, shouldn't have anything to do with it.
The entire CA system works via collective trust (and a great deal of duct tape and bailing wire). Obtaining a certificate that every browser trusts shouldn't occur in a vacuum.