Slashdot Mirror
"Let's Encrypt" Project To Issue First Free Digital Certificates Next Month
An anonymous reader writes: Let's Encrypt, the project that hopes to increase the use of encryption across websites by issuing free digital certificates, is planning to issue the first ones next month. Backed by the EFF, the Mozilla Foundation, the Linux Foundation, Akamai, IdenTrust, Automattic, and Cisco, Let's Encrypt will provide free-of-charge SSL and TSL certificates to any webmaster interested in implementing HTTPS for their products. The Stack reports: "Let's Encrypt's root certificate will be cross-signed by IdenTrust, a public key CA owned by smartphone government ID card provider HID Global. Website operators are generally hesitant to use SSL/TLS certificates due to their cost. An extended validation (EV) SSL certificates can cost up to $1,000. It is also a complication for operators to set up encryption for larger web services. Let's Encrypt aims to remove these obstacles by eliminating the related costs and automating the entire process."
When you submit a CSR (Cert Signing Request), you generate the private key and keep it private; all you submit to the CA is the public key, which they sign. They never see the private key.
If this were really run by the NSA, they could quite easily create their own signed certificate and install it on a SSL decryption proxy, and then they can SSL man-in-the-middle your website to see what your website is doing. Since the "fake" signed certificate is signed by the same CA that the real one is, nobody would know the difference unless you look at the cert's serial number and fingerprint.
WTB [sig], PST!!!
StartSSL are free for commercial use. The don't charge to revoke their paid EV certs. The revocation thing really is a bad policy but to be fair you can get around it by just applying for a new cert for a different subdomain - and they encourage you do this in their documentation. The certs are valid for the domain itself and the subdomain need not exist. Non-EV certs are typically only employed for encryption rather than validation purposes so this is a fine solution as long as you host your site on the domain itself.