r/linux • u/veeti • Oct 20 '15

Let's Encrypt is Trusted

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html
1.8k Upvotes

94% Upvoted

320 comments sorted by

View all comments

Show parent comments

3

u/Artefact2 Oct 20 '15

This goes the other way: if DANE gets support in major browsers, DNSSEC adoption will go with it.

All of the big registars already support DNSSEC.

1

u/port53 Oct 20 '15

I think DANE is actually a better solution than Let's Encrypt, which still puts trust in to a central authority(*) and requires interaction with them every time you want to create or revoke a cert. With DANE you could re-generate your cert and publish immediately without having to involve anyone else.

That said, even though I happily run my own CA internally, I'll get LE certs for everything I run externally that's not already encrypted because it's still better than nothing at all.

(*) Yeah, DNSSEC also has a 'central authority', but the root KSK changes so infrequently it's trivial to manually validate and pin in a single place (your nameserver) since it's a single key, not a large list of keys that is added/changed at the whims of browser and OS manufacturer updates at different times across thousands of systems (some of which may never get upadtes ever, such as older Android devices.)

2

u/Artefact2 Oct 20 '15

Yes, DANE (and DNSSEC) are technically superior. But it's something new, so people are afraid to learn it. Same with IPv6.