Hacker News Reader

Comment by londons_explore | Hacker News Reader

I assume the reasoning for the policy change is that allowing a single certificate to be used for many different uses puts a greater risk of the certificate private key being leaked.

They don't want your insecure mail server software to put your secure web server at risk.

View on HN

If you can't secure your mail server, you certainly can't secure your web server. Letsencrypt, please rethink your decision!

They don't have a choice - the decision comes from Chrome's root program and if they don't comply, LetsEncrypt would be distrusted by Chrome.

Is it really that clear that Google has more power here? Whom would users blame if suddenly half their pages are falsely accused of being "untrusted"? Probably the browser, not LE, right?

That's not leverage that a CA can use. If half the internet suddenly displays TLS warning interstitials, it doesn't make people mad at the CA, and it doesn't make people mad at their browser: it just _trains them to ignore such warnings_. That's a bad outcome all around, and one that a CA whose core purpose is improving security for end-users cannot condone.

most smtp servers don't use client certs, there's almost nothing that requires their clients to use client cert auth.

mail servers will continue working along just fine.

That's not whats happening, its the root certificates that the change applies to, e.g. lets encrypt, regardless of their views, can no longer use the same infrastructure to sign certs for anything other than TLS Server Authentication, lest they wish to see google's ire.

Reply on news.ycombinator.com