Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Anyone can generate a self-signed cert for any domain, LetsEncrypt only allows somebody who can demonstrate some level of control over the content in that domain.

Here's a concrete scenario: You host linuxbender.com and use a self-signed cert. You set your browser to trust self-signed certs. When you connect to your browser to linuxbender.com, I MITM you. I serve you a _different_ self-signed cert, which you then trust. I can read your traffic.

In this scenario, if the site was secured with LetsEncrypt, you wouldn't have to trust self-signed certs, and I wouldn't be able to MITM you.

Key-Pinning goes some way to combating this issue too, but doesn't solve every case.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: