Now we have letsencrypt.org
Let's Encrypt doesn't ever possess your private keys, doesn't know who connects to your site if you use OCSP stapling, and doesn't control what kind of cryptography you use when negotiating TLS sessions with your site visitors. Let's Encrypt also doesn't need any contact information from you when you obtain a certificate.
Let's Encrypt certificates aren't trusted by Chrome without a proof of inclusion in public Certificate Transparency logs, so all issued certificates have to be disclosed.
As I've said in a number of HN comments, the people working on Let's Encrypt generally still think that the CA system is too powerful, and are happy for your suggestions about how about it can made more transparent and less powerful.
Looking forward to it. I imagine, when SSL becomes mandatory by browsers, it can be used for censorship.
Can someone explain how that works? I thought SSL would make censorship less practical.
https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
Anything that gets into your bundle establishes incredible power over you.
If SSL is required, then whoever controls those agencies controls what's seen online.
I already cannot easily add a root CA for .onion addresses and then make my own certs there, without browsers screaming bloody murder.
I already cannot bypass cert errors for certain types of cert fails.
Tor onion sites, which are end to end encrypted, are considered "insecure" because we plebes cannot buy a "proper" EV ssl cert, like Facebook did.
Enforcement of SSL is just another way of controlling the user in name of "stupidity". Sure, the dumb click-anything users win, but anyone tech-savy loses freedoms.
How would you want this to work? What would you want to do, and what would you want browsers to do in response?
https://letsencrypt.org/2015/10/29/phishing-and-malware.html