News for hackers. Stuff that matters.

A comment on OVH automatically migrates expiring paid SSL to Let's Encrypt certificates. Parent comment

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by iancarroll on Sunday November 13, 2016 @03:28PM (#12945459)
If Let's Encrypt's chain is compromised, everyone is screwed, not just your site. If _any_ trusted CA is compromised, everyone is screwed, even if they haven't issued a certificate for your site.

There is no way to induce a vulnerability by using an incompetent or malicious CA, provided you generate your own, strong private key. Even issuing an MD5 or SHA-1 certificate cannot actively harm your visitors unless a second preimage attack is developed against the algorithm (in which case, again, everyone is screwed, not just you).

[ Parent | on HN ]
Re:OVH automatically migrates expiring paid SSL to Let's Enc... by ivraatiems on Sunday November 13, 2016 @04:51PM (#12945865)
> There is no way to induce a vulnerability by using an incompetent or malicious CA, provided you generate your own, strong private key.

If OVH is doing this automatically, they're the ones generating the keys, right?

[ Parent | on HN ]
Re:OVH automatically migrates expiring paid SSL to Let's Enc... by Faaak on Sunday November 13, 2016 @05:00PM (#12945922)
They already have the keys either way: its a shared-hosting environment.
[ Parent | on HN ]