Let's Encrypt Has Issued a Billion Certificates

Re:Let's Encrypt Has Issued a Billion Certificates by schoen on Thursday February 27, 2020 @03:51PM (#22437702)

> a session key which was itself encrypted using Public Key cryptography based on the public key in the certificate

This all depends on the ciphersuite used by the client and server. In TLS 1.2 some ciphersuites use forward-secret methods (typically "DHE" and "ECDHE"), and some don't.

In TLS 1.3 you always get the benefits that you mention, but in TLS 1.2 and earlier you sometimes get them. :-)

[ Parent | on HN ]

Re:Let's Encrypt Has Issued a Billion Certificates by wolf550e on Thursday February 27, 2020 @04:49PM (#22438319)

ECDHE or DHE with TLSv1.2 is in practice not "sometimes" but "almost all the time". See https://www.ssllabs.com/ssl-pulse/ "Forward Secrecy" is not supported on 2.1% of sites.

[ Parent | on HN ]