Hacker News Reader

Comment by giancarlostoro | Hacker News Reader

I figure there should exist alternatives to LE, otherwise they're a pretty big target. If anything too harmful happened to LE what would it's users do? I don't know enough about it, but right now they're going to be the only player in the free SSL certs market which puts them in a scary enough location.

View on HN

Agreed – Also, Let's Encrypt goes against the mission of a lot of very advanced bad actors (governments who lose out by the increased "going dark" issue) – so they're a juicy target for all these governments.

Hopefully there are a few other alternatives that just make their money on EV certs instead.

The good news is that part of Let's Encrypt's mission is to make it easier for all CA's to offer similar services through things like the ACME protocol. The ISRG's ultimate goal (right now) is for https to be the default, not the exception. I don't get the impression they care much which CA has the biggest piece of the pie.

StartSSL and CAcert have existed long before Let's Encrypt was even started.

If CAcert isn't usually trusted and StartSSL is not free for commercial use, are they really alternatives?

StartSSL is a b* to use, the free tier. I can't renew a cert before it expires.

That's not exactly true. You can renew it before it expires. You just can't renew it until it is nearly expired. I think it's like a 2 week window or something like that.

The bigger complaint about StartSSL should be that if you need to revoke the certificate you have to pay for it.

For a free service though I don't think their requirements are too terrible.

That wouldn't be such a problem given that most SSL stacks (correctly, IMO) ignore revocation checking... except that you can't get a new cert without revoking the old one. It would otherwise be reasonable to determine you don't care about getting it revoked (and therefore don't want to fund the revocation infrastructure, like a highly-available OCSP responder) but you just want a new cert.

And WoSign.

Right, and CNNIC.

Reply on news.ycombinator.com