LE SSL certificate

Currently reading
LE SSL certificate

That’s an interesting take. Thank you for sharing.
However, one can argue the same about many things in life.

Might not be a good idea if your site is a commercial one. I tend to agree. But for us (me) running a DS that no one should really care about, I believe it’s a very good and convenient option for now.
 
Don’t take it as kind of panic from me. Just as a source of information. I don’t have LE cert. I have few paid certs and long time evaluated. But in these days no one know, everything is possible.
 
I thought the article was completely unconvincing. Like, COMPLETELY. The author's arguments against Let's Encrypt don't hold water. Argument #1 is that "The more sites secured by Let’s Encrypt certificates, the bigger the threat surface becomes because the compromise of Let’s Encrypt’s KMS could potentially affect a large number of sites." Fine, but that's true of EVERY certificate authority. If you get rid of Let's Encrypt, that's one FEWER CA, so that's more consolidation, not less, and more certs being handled by each of the other remaining providers. Argument #2 is that LE has "no skin in the game," because they're a nonprofit (ISRG) and their certificates are free. This is ridiculous; the EFF, Cisco, Mozilla, and Akamai, among others, are the members of ISRG, and all stand to sustain tremendous reputational damage if LE is compromised. Moreover, it's the FOR PROFIT certificate issuers (most notably Comodo and Symantec, but they have lots of company) that have historically been the problem, precisely BECAUSE they're for profit - they've been issuing all manner of dubious certificates, because they get paid by the certificate. You don't need to look very far to see that they've both been de-trusted. Google announces plan to distrust Symantec SSL certificates Bogus SSL certificate for Windows Live could allow man-in-the-middle hacks Argument #3, as best as I can even figure it out (it's really incoherent) is that "If a site certificate is revoked, and no one is paying attention to this possibility, traffic will drop precipitously and you as a business person may well be no the wiser for why your lead generation dried up. " But a certificate from LE is no more or less subject to revocation than a cert from any other issuer, and if your cert is revoked and you don't notice, you're a total moron (or an Equifax employee, or both): Everyone going to your site will get a message from their browser saying that the certificate is no good. Surely some of them will report this to you, if you don't figure it out yourself.

I get the feeling that the author is, whether he knows it or not, a tool of the paid certificate issuers.
 
I believe your points are valid. But to elaborate on why I said I wouldn't use it if I was running a business site (especially commercial and technical), it's not because it's insecure or I'm worried that it might get compromised, no. It's because it says I went cheap and opted for a free certificate :)

When all I have to present an image to my client is a website, I'd want to make sure it impresses. Most of the public wouldn't know. All they see is a lock, but for those who know it says something about you (whether you know it or not, whether you like it or not).

It's like when I go to a site and I get the lock plus the green color (EV certificate). It's expected if it's a financial institution or a big company, but if it's not, it tells me that these guys walked the extra mile for this. It impresses me.

Just an opinion that is very debatable :)
 
Last edited:
On rare occasions, I pass by a big, shiny Louis Vuitton store and most of the time they have two people wearing suits at the door inside. They open the door if you approach and greet you with a snobbish node :)

Do they need that. Do they need two people or even one in a full suite. I don't think so. It's part of the image they sell you with their brand, and their customers pay for it :)
 
A bit late to comment on this but I will anyway.

Just because an organisation is Not For Profit does not mean that the people don't get paid and nor does it mean that they are any less likely to be diligent or ethical (may even mean they are more, working for a 'cause' and all that).

The main argument in the article (forgive me if I missed something, it's been a long week travelling) seems to be the same as levelled at MS PC's and virus attacks: there's more of them out there and so more interesting to bad guys. To do the Man-in-the-Middle attack will require that there is something inline with the communications to the end web server. That would mean nearer the server so as to capture more traffic. The sniffer would then most likely be at the ISP or onsite (unless it's at the country level and there's a full backbone extraction).

For home users or testers then the LE certificate is more convenient when needing less techie people to connect. But for businesses then it would be better to have a certificate that wasn't rotating every three months, and can be more thoroughly validated before issue.

Security is a risk business: how much security (cost) vs the impact of not enough (cost). LE is adding security and so reducing risk, it's not removing risk.
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

thanks a lot my friend, I will ask their costumer service on Monday /hug
Replies
4
Views
934
Tremendous stuff thank you fredbert.
Replies
4
Views
1,838
  • Question
Question ssl certificate
in /var/log/messages you will find more details for sure and there issues like this are stated. Still, I...
Replies
17
Views
3,532
This is a simple and yet effective solution for my lan (photo station, dsm administration). Thanks.
Replies
16
Views
32,081
OK. This is a remote location that I’m barely at. I’ll try that next time I’m there.
Replies
21
Views
25,251
Ok, that is reassuring. I didn't know if it was required should the NAS need to be reset at a future...
Replies
2
Views
3,480
  • Question
I want to thank everyone for their replies. I've learned quite a bit. Ultimately, the client pivoted and...
Replies
6
Views
2,815

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Back
Top