Hacker News Reader

>Do certificates from Let's Encrypt provide any security benefits over a self-signed certificate?

Depends. The encryption is the same and only dependent on your client/server. Could have been solved by DNS ... maybe.

Self signed certs don't validate that you at least own the domain.

Ah yes, that makes sense. Let's Encrypt requires proof of domain ownership, which at least ensures that the entity you're connecting to is the entity that owns the domain. Encryption without authentication wouldn't be very helpful, since a man-in-the-middle could just present their own self-signed certificate during the handshake...

You'd be protected from a passive attack and thus you could always (with enough effort) detect an attack. Someone who is snooping (e.g. fibre taps) is potentially undetectable (yes in theory there are quantum physics tricks you could do to detect this, but nobody much is really doing that) whereas an active attack is always potentially detectable.

So it's not nothing, but it isn't very much without the Certificate Authority role.

Reply on news.ycombinator.com