Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I agree, for two reasons:

1) Let's Encrypt are based in the United States and are already forbidden from issuing domains to certain people[0] due to US law.

2) Having a separate production implementation of an ACME-compliant system would help make sure that the protocol is as robust as it can be

[0] Notably Iran and Syria - several certificates issued for gov.[ir|sy] had to be revoked after they slipped past their blocklist: https://community.letsencrypt.org/t/blocklist-incident-novem...



Just to be clear, Let's Encrypt does issue for non-governmental entities in U.S.-sanctioned countries (which some other U.S.-based CAs don't do).

https://crt.sh/?Identity=%25.sy&iCAID=16418 https://crt.sh/?Identity=%25.cu&iCAID=16418 https://crt.sh/?Identity=%25.sd&iCAID=16418 https://crt.sh/?Identity=%25.ir&iCAID=16418




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: