posted in Selfhosted
Letsencrypt is under US jurisdiction. Is there a free-er alternative?
I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
Replying to @Sibbo@sopuli.xyz
@Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server's IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.
Replying to @pdl@social.tchncs.de
Actually the problem is that they are too widespread. if something happened, and they started creating fake certificates, for outside force or otherwise, they can’t just be blocked because literally half of the internet or more breaks. what’s worse, if browser vendors trued that, people would be downgrading their browser to the last version accepting it, and become exposed to publicly revealed security vulnerabilities. not all because its a bit complicated, but enough would do to have it cause an even greater problem.
Replying to @WhyJiffie@sh.itjust.works
You do make a good point. However, Let’s encrypt is run by the IRSG which is a non profit focused on improving internet security. They are the ones who are pushing for shorter certificate lifetimes among other things.