It's much easier than the linked tutorial

Story: How to setup a intermediate compatible SSL website with LetsEncrypt certificateTotal Replies: 0
Author Content
dotmatrix

Jan 19, 2016
7:33 PM EDT 		Just download the installer script and run it as root on your server:

https://github.com/letsencrypt/letsencrypt

However, at this point there are several problems with DV certificates. The identity verification rules changed somewhere between 2012 and 2014. In 2012 you needed to control at least two pieces of information to obtain and use a legitimate 'trusted' certificate. These were usually:
  1. The email address of the registered domain owner or a 'standard' domain email address.
  2. Root access on a domain web server listed as an A or AAAA record.
However, in the newest CA guidelines, there is no requirement to check an email address to verify a domain. This means that a certificate can be both verified and used simply by demonstrating control over one small area of a domain. Of course, the removal of an interactive requirement makes the issuance of certs significantly less demanding on a domain owner... However, it also breaks the 'trust' within the DV certificate system.

In essence, as of the newest CA rules, a DV certificate has the same level of inherent trust as a self-signed certificate. This should be easy to see, because a self-signed certificate is generated and signed on the same server. Thus demonstrating control over the server at the A or AAAA record. It really doesn't matter if that certificate is then cross signed later, the chain of trust is still broken because the CA has been fooled into signing a fraudulent certificate. This 'tricking of CAs to issue certs' was a problem, but now it's actually written into the rules.

I really don't know why anyone would seek to muddy the 'trust' waters so much, but a fact's a fact, and the newest CA guidelines completely remove even the tiny bit of trust value in a DV certificate.

So, the next time you logon to your favorite on-line store and see the little green lock without the full green bar -- be sure to check the certificate... because if it's issued by "Let's Encrypt" or by Wosign or any CA that now issues DV certs to servers rather than domains, you really will have no ability to make sure that the certificate has not been issued to an intruder on the domain with unauthorized root access on that web server or maybe even a law enforcement office with unwarranted access.

EDIT***

Oh, I see now... the author of the article is setting up specific rewrite rules for specific user agents. That's a valid point, and I don't think the "Lets Encrypt" install script handles inserting those specific kinds of rewrite rules. However, most newly issued certs regardless of the vendor are going to have compatibility issues with older browsers due to newer browsers marking SHA1 certs as unsafe.

Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]

Becoming a member of LXer is easy and free. Join Us!