LetsEncrypt sucked all the oxygen out of the movement to replace the CA system.
Let's all remember, CA usage is a choice, and not a good one. There are other better tools.
0 Boosts
0 Likes
the alternative was, and still is, admitting that self-signed certs are fine and delegating authentication to the line-encryption layer is idiotic.
CC: @silverwizard@convenient.email
@khm @silverwizard Self-signed certs are not fine except for accessing your own resources you know the key fingerprint for.
that's only true if you cling to pki-as-authentication. if you're just using certs for line encryption, you can rotate them every day (or even every connection) and it is fine.
use something else for authentication.
CC: @silverwizard@convenient.email
@khm @dalias @silverwizard "use something else for authentication" is doing all the heavy lifting here...
@silverwizard if I can't use LetsEncrypt, are there really other alternatives to CA?
@silverwizard It was better than the alternative, leaving everyone stuck paying protection rackets or using cleartext. There was no viable movement to replace the CA system until TLS was established as mandatory; the default was just "oh, well CAs suck so don't use TLS".