Conversation

Wow.

has issued 62% of all active SSL certs in the wild. That’s awesome…but also worrisome? We obviously want all CAs to meet a high quality bar, but if any ecosystem needs healthy diversity, it's this one, right?

dbusiness.com

Report: Ann Arbor Area has 38% of State’s Venture-backed Companies - DBusiness Magazine

There are 55 active venture-backed startups in Washtenaw County, a 31 percent increase over the last six years, according to EntryPoint.

Replying to

and

Logically I agree with you 100% but emotionally I'm still angry about the cert ecosystem crappiness pre-ACME so I'm going to delay my fear and logic for a few years and let LE enjoy their dominance. It's a nice change.

Replying to

and

I don't really see the benefit of diversity when each CA is fully trusted for every domain. A bit of redundancy in case one goes down, but untrusting them isn't a realistic option. What we really need is removing these unnecessary additional trusted parties from the picture.

5:07 AM · Sep 16, 2021Twitter Web App

Replying to

DV certificates are based on validating domain control. It ultimately depends on the security of DNS but also adds insecure SMTP/HTTP authentication to the table. It'd be better not to have any of this at all and simply use TLSA records directly. Doesn't add new trusted parties.

Replying to

The only value WebPKI has to offer is Certificate Transparency and that can be implemented for DNSSEC and DANE. Beyond that, they're just an enormous amount of additional trusted parties for each domain doing insecure authentication of domain. Let's Encrypt is harm reduction.