Comment by regecks | Hacker News Reader

Comment by regecks | Hacker News Reader

> relatively long duration certificates are one area where they have something that Let's Encrypt doesn't.

For some time recently, AlwaysOnSSL[1] was issuing automated, free and trusted certificates with 12 months validity via HTTP or DNS DV. They've since disabled new registrations (who knows why), but I'm still able to get these on my existing account.

Comodo is issuing 12 months certificates for cPanel servers, and 3 month certificates for all domains on any licensed cPanel server (without the rate limits imposed by Let's Encrypt). In fact, the cPanel Comodo CA is currently the second largest CA with some ~13-14% of all currently trusted certificates, in front of Comodo with 8% and behind Let's Encrypt with ~66% [2].

So, I'm not sure that it's strictly true that commercial CAs will refuse to do anything that cannibalizes their own sales. I think there are some mixed models that can work (RIP StartCom), and I hope we see more of them for the sake of the WebPKI. Overwhelming reliance on a free CA that is funded purely by donations doesn't seem like a good thing to me.

--

1. https://alwaysonssl.com/issue.php

2. https://censys.io/certificates/report?q=tags%3Atrusted&field...

> So, I'm not sure that it's strictly true that commercial CAs will refuse to do anything that cannibalizes their own sales.

Someone (ie. some CA) had to cross-sign Letsencrypt root certificate (or its direct derivative). Turns out that CA is IdenTrust, a bank consortium. [1]

I'm not disagreeing its a good rule of thumb though.

[1] https://en.wikipedia.org/wiki/Let's_Encrypt#Technology

Alternatively they could have tried to get the browser vendors to include them as an authority. That may have been hard but now that they are so large they would probably succeed.

Well, they are directly included in most root programs now (ISRG Root X1). The cross-signing was a bootstrapping and compatibility solution (e.g. Windows XP).

It seems likely at some point that they will drop the cross-signing.

But still not Microsoft's programme. It would be interesting to know (but we'll probably never be told) if there's any particular reason for it taking so long...

https://crt.sh/?caid=7394

The top row of "Valid¹" items with one "No" and one "Defer to OS" is the trust you care about, whether ISRG is trusted for the Web PKI. "Defer to OS" is what Chrome says by default about almost everything - basically Google prefers to let your OS vendor pick what's trusted unless they feel the need to step in and override.

I have no idea why Apple trusts ISRG for things ISRG doesn't do and has no intent of starting to do, my instinct is to label it "incompetence" but I've never been an Apple fan, I'm sure they have some excuse.

On the other hand, at least Microsoft has a comprehensive and reliable update process, so there's a good chance most of their population of systems can be upgraded in months rather than years once they do make a decision.

All but one of the programmes listed is a closed door operation, we have no idea how they decide what to do, and only a cynic like me would suggest that it's because they mostly react to events after the fact...

The exception is Mozilla, which makes all these decisions in public in the newsgroup m.d.s.policy

But that only works for new browser releases.

This way, LE works on ancient Android devices as well as on god knows which strange Internet-enabled devices.

The strategy is/was to do both. We started getting our root into browsers immediately and we sought out a cross-sign to let us operate while the ~7-10 year root inclusion and propagation process happens.

IdenTrust was initially part of a bank consortium, but by the time we (Let's Encrypt) started talking to them they were just an independent company. Now IdenTrust is a division of HID Global via acquisition.

Reply on news.ycombinator.com