Let's Encrypt

Ten people are on the byline, including Nicholas Carlini, Paul Crowley, and Amir Omidi.

The code to reproduce the recovery is Python released under CC0, and Filippo Valsorda's $36,864 in bounty money goes to ISRG, the non-profit behind Let's Encrypt, per the post.

What I'd look for next is an outside verifier.

The post cites none, it hands you CC0 code, which means anyone who knows lattices can check the 1-97 timestamps in an afternoon, and I'd want a couple of well-known cryptographers to say they did before I call the 5' curve results settled.

They also plan to offer post-quantum certificates.

It does sound like Cloudflare intends to provide certificates for free along similar lines to Let's Encrypt, which has been doing it for a while.

Cloudflare says it will support the widely used ACME protocol for automating issuance and renewal.

The company says it's going to be a longish process to establish itself as a CA, so we'll keep an eye on milestones and updates as they work through the system.

We are a huge consumer.

They support SSL for lots of websites without charging people for it.

I think it's, I guess they feel like Most of the free certs come from Let's Encrypt, and that's great, but it's also, they said, potentially a problem if something happens to Let's Encrypt, where else are people going to go? So I think they're trying to build maybe a little bit of redundancy into the system, which I guess is fine.

It also just sort of continues to anchor Cloudflare as an immovable presence in web and internet infrastructure.

They also plan to offer post-quantum certificates.

Uh, it does sound like Cloudflare intends to provide certificates for free, uh, along similar lines to Let's Encrypt, which has been doing it for a while.

Cloudflare says it will support the widely used ACME protocol for automating issuance and renewal.

Uh, the company says it's gonna be a longish process to establish itself as a CA, so we'll keep an eye on milestones and updates as they work through the system.

I mean, the blog was like, "W- we deal with billions of certificates as part of our daily work.

We are a huge consumer." Um, they support SSL for lots of websites without charging people for it.

Um, I think it's-- I guess they feel like most of the free certs come from Let's Encrypt, and that's great, but it's also, they said, potentially a problem if something happens to Let's Encrypt, where else are people gonna go? So I think they're trying to build maybe a little bit of redundancy into the system, which I guess is fine.

It also just sort of continues to anchor Cloudflare as an immovable presence in, you know, web and internet infrastructure.

Huh? And not just, not just any certificate authority.

It's, um, they're going to be a competitor to let's encrypt.

I think they're naming it.

Let's in cloud flare.

You got to get the approval of all of these companies that all happen to live in the U S we'll get back to that.

But,

but now you're going to, I guess, steal some let's encrypt thunder maybe.

Yeah.

It provides no assurance that the entity operating the website is legitimate.

Cybercriminals routinely obtain valid domain validation, DV, TLS, SSL certificates for fraudulent domains, often through free certificate authorities such as Let's Encrypt.

The padlock tells you that a third party cannot eavesdrop on your data in transit.

It does not tell you who is receiving it on the other side.