On 15/04/2016 4:15 PM, Rick Moen via luv-main wrote: letsencrypt perhaps? It works very well. Cheers A.

On 15/04/2016 4:51 PM, Rick Moen via luv-main wrote: So many wise words, Marian flu or not. Still, I've used self-signed certs too over the years and only occasionally tried out other options .... for me, right now, letsencrypt is better due to how the main browsers are setting up users to distrust anything that doesn't come from a CA (however untrustworthy CAs might be). GPG signed certs, not likely; there are plenty of other considerations, but GPG signing /may/ be part of a greater solution. How about having fingerprints saved in DNS records, self-signed or "official" CA signed certs ? I wish trust in computers (not just CAs) wasn't so broken. :( Cheers AndrewM

On 16/04/2016 3:22 AM, Robin Humble via luv-main wrote: Good question, don't know the answer. But I've just thought of another solution. Every single domain has a registrar. Each registrar should be required to offer proof of ownership of the domain so that we can get certificates easily. You have a "proof" of ownership in the form of signed data only accessible from the login for the domain management. You sign this data with a GPG key for an email that is set up on one or more of the domain's contact names (every contact type should be able sign the request). The public key identifier for that email resides on record at the registrar (not the private key of course). Now, you don't need to farts around with stopping / starting servers or use manual processes to attain certs that require you to jump through lots of hoops. Your CSR can include your proof from the registrar (signed by them), then counter signed by you. Then Let's Encrypt can provide the required certificate(s) and chain files. Automation of letsencrypt can be problematic, you need too much extra rubbish installed for that. The manual process (for use via servers that don't host the website(s) or mail services for instance) is still labour intensive; having to create files in well known areas and populate them with specific data and repeat that every time you renew the certificate. Whilst we continue to have a CA system, then it may as well be made less painful than even letsencrypt has managed thus far. The latest thoughts also lessens the chance that anyone with access to a web server for a domain name may create certificates without proper authority. Perhaps the registrar can also be expected to keep certificate fingerprints available on line (for each and all certificates relating to the domain names), but this might be a step too far. More thoughts? Cheers AndrewM