[Script Info] Title: [Events] Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text Dialogue: 0,0:00:00.29,0:00:48.03,Default,,0000,0000,0000,,{\i1}music still playing,\Nno audio available for speaker{\i0} Dialogue: 0,0:00:48.03,0:00:51.94,Default,,0000,0000,0000,,provide both confidentiality,\Nintegrity, and authenticity Dialogue: 0,0:00:51.94,0:00:55.47,Default,,0000,0000,0000,,so this means that nobody can see\Nwhat you're looking at Dialogue: 0,0:00:55.47,0:00:58.44,Default,,0000,0000,0000,,nobody can change what you're looking at Dialogue: 0,0:00:58.44,0:01:02.49,Default,,0000,0000,0000,,and you know that the person\Nwho is sending you this Dialogue: 0,0:01:02.49,0:01:04.46,Default,,0000,0000,0000,,is a specific person. Dialogue: 0,0:01:04.46,0:01:08.83,Default,,0000,0000,0000,,They use signed digital certificates. Dialogue: 0,0:01:08.83,0:01:12.63,Default,,0000,0000,0000,,Each one of these certificates must\Nbe signed by another certificate Dialogue: 0,0:01:12.63,0:01:16.22,Default,,0000,0000,0000,,and if you want to be trusted,\Nthey have to chain up Dialogue: 0,0:01:16.22,0:01:21.72,Default,,0000,0000,0000,,to a certificate issued by\Na publicly trusted certificate authority. Dialogue: 0,0:01:21.72,0:01:26.57,Default,,0000,0000,0000,,Who decides, who gets a certificate\Nand who doesn't? Dialogue: 0,0:01:26.57,0:01:29.01,Default,,0000,0000,0000,,Why do we have to launch another one? Dialogue: 0,0:01:29.01,0:01:34.19,Default,,0000,0000,0000,,Well, the Internet is a bad place. Dialogue: 0,0:01:34.19,0:01:41.08,Default,,0000,0000,0000,,It's extremely easy to modify or to observe\NHTTP communication. Dialogue: 0,0:01:41.08,0:01:44.70,Default,,0000,0000,0000,,There've been a number of attacks\Nthat have demonstrated this over the years Dialogue: 0,0:01:44.70,0:01:49.96,Default,,0000,0000,0000,,including cookie session re-use and others. Dialogue: 0,0:01:49.96,0:01:52.82,Default,,0000,0000,0000,,Based on telemetry from the Firefox browser, Dialogue: 0,0:01:52.82,0:01:59.90,Default,,0000,0000,0000,,we know that only 40% of\Ninitial HTTP requests go over HTTPS. Dialogue: 0,0:01:59.90,0:02:04.55,Default,,0000,0000,0000,,This is probably because both\Ngetting and installing a certificate Dialogue: 0,0:02:04.55,0:02:08.04,Default,,0000,0000,0000,,as well as setting up\Nall the correct TLS parameters Dialogue: 0,0:02:08.04,0:02:11.22,Default,,0000,0000,0000,,is extremely confusing. Dialogue: 0,0:02:11.22,0:02:14.39,Default,,0000,0000,0000,,And in part this is because every CA decides, Dialogue: 0,0:02:14.39,0:02:19.10,Default,,0000,0000,0000,,how it will issue a certificate on its own. Dialogue: 0,0:02:19.10,0:02:22.03,Default,,0000,0000,0000,,So our solution is\Nto create another Certificate Authority. Dialogue: 0,0:02:22.03,0:02:26.42,Default,,0000,0000,0000,,I mean, what can go wrong? Dialogue: 0,0:02:26.42,0:02:30.100,Default,,0000,0000,0000,,So, because we're the EFF and Mozilla, Dialogue: 0,0:02:30.100,0:02:34.66,Default,,0000,0000,0000,,we've decided that\Nit should be completely free. Dialogue: 0,0:02:34.66,0:02:39.12,Default,,0000,0000,0000,,Cryptography shouldn't be something that\Nyou have to pay for on the Internet. Dialogue: 0,0:02:39.12,0:02:40.99,Default,,0000,0000,0000,,And unfortunately, right now … Dialogue: 0,0:02:40.99,0:02:48.64,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:02:48.64,0:02:51.19,Default,,0000,0000,0000,,So unfortunately right know there are only Dialogue: 0,0:02:51.19,0:02:54.83,Default,,0000,0000,0000,,two certificate authorities that are willing\Nto issue free certificates Dialogue: 0,0:02:54.83,0:02:56.63,Default,,0000,0000,0000,,except for Let's Encrypt. Dialogue: 0,0:02:56.63,0:02:59.51,Default,,0000,0000,0000,,And unfortunately, both of them make it Dialogue: 0,0:02:59.51,0:03:01.44,Default,,0000,0000,0000,,a quite complicated process and Dialogue: 0,0:03:01.44,0:03:03.71,Default,,0000,0000,0000,,will exclude you from getting a certificate Dialogue: 0,0:03:03.71,0:03:07.33,Default,,0000,0000,0000,,if you fall into certain groups. Dialogue: 0,0:03:07.33,0:03:08.42,Default,,0000,0000,0000,,So we decided to make it free Dialogue: 0,0:03:08.42,0:03:11.15,Default,,0000,0000,0000,,and we also decided to make it open-source. Dialogue: 0,0:03:11.15,0:03:13.76,Default,,0000,0000,0000,,We did this because it's extremely hard Dialogue: 0,0:03:13.76,0:03:16.39,Default,,0000,0000,0000,,to tell, what Certificate Authorities\Nare actually doing Dialogue: 0,0:03:16.39,0:03:20.51,Default,,0000,0000,0000,,and how they decide\Nwhether or not to issue a certificate. Dialogue: 0,0:03:20.52,0:03:22.59,Default,,0000,0000,0000,,So we decided\Nit'd be best to come up Dialogue: 0,0:03:22.59,0:03:27.40,Default,,0000,0000,0000,,with a standardised protocol\Nwhich we've called ACME Dialogue: 0,0:03:27.40,0:03:31.84,Default,,0000,0000,0000,,so that we can get everybody's input Dialogue: 0,0:03:31.84,0:03:35.98,Default,,0000,0000,0000,,on what is the most secure way\Nthat we can do this. Dialogue: 0,0:03:35.98,0:03:37.98,Default,,0000,0000,0000,,Let's Encrypt has already launched Dialogue: 0,0:03:37.98,0:03:40.08,Default,,0000,0000,0000,,and you can—right now—go and get Dialogue: 0,0:03:40.08,0:03:43.99,Default,,0000,0000,0000,,a publicly trusted,\Nfree certificate from us. Dialogue: 0,0:03:43.99,0:03:48.30,Default,,0000,0000,0000,,Unfortunately, this isn't a\Ncheap thing to do. Dialogue: 0,0:03:48.30,0:03:50.72,Default,,0000,0000,0000,,So we've been sponsored by a large number Dialogue: 0,0:03:50.72,0:03:53.93,Default,,0000,0000,0000,,of industry people including Dialogue: 0,0:03:53.93,0:03:55.95,Default,,0000,0000,0000,,a bunch of hosting providers Dialogue: 0,0:03:55.95,0:04:00.17,Default,,0000,0000,0000,,Mozilla, Cisco, Akamai,\Nwho is a Content Distribution Network Dialogue: 0,0:04:00.17,0:04:05.26,Default,,0000,0000,0000,,and the EFF, among others. {\i1}chuckles{\i0} Dialogue: 0,0:04:05.26,0:04:11.01,Default,,0000,0000,0000,,So, the CA and TLS ecosystem is\Na pretty strange place. Dialogue: 0,0:04:11.01,0:04:15.71,Default,,0000,0000,0000,,Before we got there, this is a map of Dialogue: 0,0:04:15.71,0:04:20.24,Default,,0000,0000,0000,,every single trusted Certificate Authority\Nthat currently exists. Dialogue: 0,0:04:20.24,0:04:22.54,Default,,0000,0000,0000,,Every single one of these nodes can issue Dialogue: 0,0:04:22.54,0:04:27.96,Default,,0000,0000,0000,,a certificate that your browser\Nwill completely trust. Dialogue: 0,0:04:27.96,0:04:29.42,Default,,0000,0000,0000,,And this is ridiculous! Dialogue: 0,0:04:29.42,0:04:34.70,Default,,0000,0000,0000,,The fact that there are\Nover 1'600 Certificate Authorities Dialogue: 0,0:04:34.70,0:04:37.79,Default,,0000,0000,0000,,is very silly. Dialogue: 0,0:04:37.79,0:04:42.16,Default,,0000,0000,0000,,You can actually see Let's Encrypt is\None of the small magenta nodes Dialogue: 0,0:04:42.16,0:04:44.71,Default,,0000,0000,0000,,in the bottom left-hand corner. Dialogue: 0,0:04:44.71,0:04:47.08,Default,,0000,0000,0000,,Unfortunately, we haven't surpassed Dialogue: 0,0:04:47.08,0:04:49.52,Default,,0000,0000,0000,,some of the other\NCertificate Authorities yet, Dialogue: 0,0:04:49.52,0:04:53.72,Default,,0000,0000,0000,,but that's soon to happen. Dialogue: 0,0:04:53.72,0:04:57.10,Default,,0000,0000,0000,,There's a group called "The CA Browser Forum" Dialogue: 0,0:04:57.10,0:05:04.06,Default,,0000,0000,0000,,and these are the people who decide\Nhow the CA and TLS ecosystem works. Dialogue: 0,0:05:04.06,0:05:07.82,Default,,0000,0000,0000,,Because CAs have a slightly vested interest Dialogue: 0,0:05:07.82,0:05:11.69,Default,,0000,0000,0000,,in making money over protecting users, Dialogue: 0,0:05:11.69,0:05:14.97,Default,,0000,0000,0000,,there's often a rift between them\Nand the browsers Dialogue: 0,0:05:14.97,0:05:18.20,Default,,0000,0000,0000,,and how rules should be made Dialogue: 0,0:05:18.20,0:05:23.00,Default,,0000,0000,0000,,that affect publicly trusted certificates\Nand Certificate Authorities. Dialogue: 0,0:05:23.00,0:05:25.16,Default,,0000,0000,0000,,Because of this, they decided\Nto come together Dialogue: 0,0:05:25.16,0:05:29.52,Default,,0000,0000,0000,,and self-govern themselves in order to have\N… Dialogue: 0,0:05:29.52,0:05:32.34,Default,,0000,0000,0000,,bring order about … Dialogue: 0,0:05:32.34,0:05:36.70,Default,,0000,0000,0000,,The Browsers generally yield\Nslightly more power Dialogue: 0,0:05:36.70,0:05:38.86,Default,,0000,0000,0000,,than the Certificate Authorities. Dialogue: 0,0:05:38.86,0:05:41.00,Default,,0000,0000,0000,,They require a larger number of … Dialogue: 0,0:05:41.00,0:05:44.56,Default,,0000,0000,0000,,a larger majority in order to pass a rule. Dialogue: 0,0:05:44.56,0:05:48.42,Default,,0000,0000,0000,,And this is because, like I said previously, Dialogue: 0,0:05:48.42,0:05:52.42,Default,,0000,0000,0000,,Certificate Authorities are generally\Nguided by making money Dialogue: 0,0:05:52.42,0:05:56.97,Default,,0000,0000,0000,,whereas the browsers are generally\Nguided by trying to keep users safe. Dialogue: 0,0:05:56.97,0:06:01.66,Default,,0000,0000,0000,,Unfortunately, Let's Encrypt is\Nnot yet a member of this group Dialogue: 0,0:06:01.66,0:06:04.14,Default,,0000,0000,0000,,because they have very stringent requirements Dialogue: 0,0:06:04.14,0:06:05.83,Default,,0000,0000,0000,,for membership, which include Dialogue: 0,0:06:05.83,0:06:08.63,Default,,0000,0000,0000,,a number of audits we haven't yet completed, Dialogue: 0,0:06:08.63,0:06:12.69,Default,,0000,0000,0000,,although we're very close to doing so. Dialogue: 0,0:06:12.69,0:06:14.17,Default,,0000,0000,0000,,Like I said … Dialogue: 0,0:06:14.17,0:06:16.62,Default,,0000,0000,0000,,The CA/B Forum creates rules Dialogue: 0,0:06:16.62,0:06:18.91,Default,,0000,0000,0000,,called the "Baseline requirements" Dialogue: 0,0:06:18.91,0:06:22.43,Default,,0000,0000,0000,,which every Certificate Authority\Nmust comply with Dialogue: 0,0:06:22.43,0:06:26.79,Default,,0000,0000,0000,,if they wish to be trusted by browsers. Dialogue: 0,0:06:26.79,0:06:30.77,Default,,0000,0000,0000,,This includes basically documenting\Nevery process that's involved Dialogue: 0,0:06:30.77,0:06:32.84,Default,,0000,0000,0000,,with issuance of a certificate Dialogue: 0,0:06:32.84,0:06:36.26,Default,,0000,0000,0000,,and takes a very long time. Dialogue: 0,0:06:36.26,0:06:40.29,Default,,0000,0000,0000,,So the CA/B also chooses the different Dialogue: 0,0:06:40.29,0:06:42.45,Default,,0000,0000,0000,,security levels of a certificate Dialogue: 0,0:06:42.45,0:06:44.77,Default,,0000,0000,0000,,—these are called "validation levels". Dialogue: 0,0:06:44.77,0:06:47.58,Default,,0000,0000,0000,,There are currently three and\Nit should be noted that Dialogue: 0,0:06:47.58,0:06:50.17,Default,,0000,0000,0000,,cryptographically, there is no difference Dialogue: 0,0:06:50.17,0:06:53.80,Default,,0000,0000,0000,,between each of these "levels of validation". Dialogue: 0,0:06:53.80,0:06:59.80,Default,,0000,0000,0000,,What they mean is how thoroughly a CA Dialogue: 0,0:06:59.80,0:07:04.18,Default,,0000,0000,0000,,has validated a person\Nwho is requesting a certificate. Dialogue: 0,0:07:04.18,0:07:06.23,Default,,0000,0000,0000,,Domain validation is what we're interested\Nin. Dialogue: 0,0:07:06.23,0:07:09.43,Default,,0000,0000,0000,,It basically just means that—as a CA— Dialogue: 0,0:07:09.43,0:07:14.78,Default,,0000,0000,0000,,we can verify that you control\Na certain DNS name. Dialogue: 0,0:07:14.78,0:07:21.31,Default,,0000,0000,0000,,Now there are a few extra steps for\Norganizational validation. Dialogue: 0,0:07:21.31,0:07:24.55,Default,,0000,0000,0000,,This means that a CA would have to validate Dialogue: 0,0:07:24.55,0:07:29.06,Default,,0000,0000,0000,,that you're an owner of a certain business\Nin a certain country. Dialogue: 0,0:07:29.06,0:07:31.62,Default,,0000,0000,0000,,And Extended Validation goes even further Dialogue: 0,0:07:31.62,0:07:35.55,Default,,0000,0000,0000,,and checks other governmental records. Dialogue: 0,0:07:35.55,0:07:40.39,Default,,0000,0000,0000,,Both OV and EV certificates don't provide\Nany more security. Dialogue: 0,0:07:40.39,0:07:44.30,Default,,0000,0000,0000,,All they provide is UI hints in the browser. Dialogue: 0,0:07:44.30,0:07:50.22,Default,,0000,0000,0000,,So with an EV certificate you'll see\Na green box in your URL bar Dialogue: 0,0:07:50.22,0:07:52.74,Default,,0000,0000,0000,,that says the name of a company. Dialogue: 0,0:07:52.74,0:07:57.13,Default,,0000,0000,0000,,But cryptographically, these certificates\Nare exactly the same. Dialogue: 0,0:07:57.13,0:08:00.15,Default,,0000,0000,0000,,So where does Let's Encrypt fit into this? Dialogue: 0,0:08:00.15,0:08:03.65,Default,,0000,0000,0000,,Like I said, we're doing\Neverything completely for free. Dialogue: 0,0:08:03.65,0:08:07.40,Default,,0000,0000,0000,,This includes issuance, renewal, and revocation Dialogue: 0,0:08:07.40,0:08:12.62,Default,,0000,0000,0000,,—and any other action you'd do with us\Nis entirely free. Dialogue: 0,0:08:12.62,0:08:15.47,Default,,0000,0000,0000,,We're not charging anyone anything. Dialogue: 0,0:08:15.47,0:08:22.18,Default,,0000,0000,0000,,We're also only going to be issuing\NDomain validated certificates. Dialogue: 0,0:08:22.18,0:08:27.87,Default,,0000,0000,0000,,This is because we don't intend on\Nhiring a bunch of people to deal with issuance. Dialogue: 0,0:08:27.87,0:08:30.12,Default,,0000,0000,0000,,Our system is entirely automated. Dialogue: 0,0:08:30.12,0:08:37.06,Default,,0000,0000,0000,,The only people that we hire are\Noperations and maintenance people. Dialogue: 0,0:08:37.06,0:08:38.93,Default,,0000,0000,0000,,We're also only issuing certificates\Nthat are Dialogue: 0,0:08:38.93,0:08:43.93,Default,,0000,0000,0000,,valid for a maximum of 90 days. Dialogue: 0,0:08:43.93,0:08:45.24,Default,,0000,0000,0000,,We originally decided on doing this Dialogue: 0,0:08:45.24,0:08:49.30,Default,,0000,0000,0000,,because in the previous world where certificates Dialogue: 0,0:08:49.30,0:08:54.48,Default,,0000,0000,0000,,were valid for anywhere from 1–3 years, Dialogue: 0,0:08:54.48,0:08:59.96,Default,,0000,0000,0000,,it made it really hard to figure out\Nhow to automate renewal of a certificate. Dialogue: 0,0:08:59.96,0:09:04.25,Default,,0000,0000,0000,,You'd, every once a year,\Ngo to your Certificate Authority Dialogue: 0,0:09:04.25,0:09:06.14,Default,,0000,0000,0000,,and ask for a new certificate Dialogue: 0,0:09:06.14,0:09:07.59,Default,,0000,0000,0000,,and then spend the next few hours Dialogue: 0,0:09:07.59,0:09:10.48,Default,,0000,0000,0000,,trying to figure out\Nwhat you had to tell them Dialogue: 0,0:09:10.48,0:09:14.52,Default,,0000,0000,0000,,and how you'd install it in your server. Dialogue: 0,0:09:14.52,0:09:19.61,Default,,0000,0000,0000,,By limiting the validity period to 90 days, Dialogue: 0,0:09:19.61,0:09:24.41,Default,,0000,0000,0000,,we're ensuring that people are forced\Nto renew often. Dialogue: 0,0:09:24.41,0:09:26.89,Default,,0000,0000,0000,,And this also comes with a good side-effect Dialogue: 0,0:09:26.89,0:09:29.37,Default,,0000,0000,0000,,that if their certificate becomes compromised, Dialogue: 0,0:09:29.37,0:09:34.87,Default,,0000,0000,0000,,it is only compromised for\Na maximum of 90 days. Dialogue: 0,0:09:34.87,0:09:38.04,Default,,0000,0000,0000,,Which makes it slightly safer. Dialogue: 0,0:09:38.04,0:09:43.36,Default,,0000,0000,0000,,So we're also issuing multiple domain certificates\Ninstead of wildcard certificates. Dialogue: 0,0:09:43.36,0:09:46.25,Default,,0000,0000,0000,,These use Subject Alternative Names (SAN) Dialogue: 0,0:09:46.25,0:09:48.97,Default,,0000,0000,0000,,with multiple DNS names inside of a certificate Dialogue: 0,0:09:48.97,0:09:51.43,Default,,0000,0000,0000,,meaning that a single certificate can be used Dialogue: 0,0:09:51.43,0:09:56.98,Default,,0000,0000,0000,,to validate up to a hundred domains. Dialogue: 0,0:09:56.98,0:10:01.73,Default,,0000,0000,0000,,In order to make our certificates actually\Npublicly trusted Dialogue: 0,0:10:01.73,0:10:06.09,Default,,0000,0000,0000,,we've applied to the\NMozilla, Apple, Google, and Microsoft root Dialogue: 0,0:10:06.09,0:10:07.67,Default,,0000,0000,0000,,programmes Dialogue: 0,0:10:07.67,0:10:11.48,Default,,0000,0000,0000,,but we've also had one of our Intermediate\NCertificates Dialogue: 0,0:10:11.48,0:10:16.35,Default,,0000,0000,0000,,cross-signed by IdenTrust,\Nwhich is another Certificate Authority. Dialogue: 0,0:10:16.35,0:10:18.94,Default,,0000,0000,0000,,This means that every certificate we issue Dialogue: 0,0:10:18.94,0:10:21.35,Default,,0000,0000,0000,,is already trusted. Dialogue: 0,0:10:21.35,0:10:24.34,Default,,0000,0000,0000,,So we don't have to worry about old devices Dialogue: 0,0:10:24.34,0:10:28.34,Default,,0000,0000,0000,,not trusting our certificates. Dialogue: 0,0:10:28.34,0:10:34.92,Default,,0000,0000,0000,,So, we started a closed beta\Nin about early September Dialogue: 0,0:10:34.92,0:10:38.89,Default,,0000,0000,0000,,and this went from …\Nall the way up to December, 3rd Dialogue: 0,0:10:38.89,0:10:40.40,Default,,0000,0000,0000,,and during that period we only issued Dialogue: 0,0:10:40.40,0:10:42.33,Default,,0000,0000,0000,,about 20'000 certificates. Dialogue: 0,0:10:42.33,0:10:45.59,Default,,0000,0000,0000,,You can see that the first period in september Dialogue: 0,0:10:45.59,0:10:53.100,Default,,0000,0000,0000,,was just staff issuing certificates to themselves.\NAnd I think we only issued around 100 or 200 certificates. Dialogue: 0,0:10:53.100,0:10:56.25,Default,,0000,0000,0000,,And then we opened a Closed Beta Dialogue: 0,0:10:56.25,0:10:59.34,Default,,0000,0000,0000,,and we issued around 20'000 more Dialogue: 0,0:10:59.34,0:11:03.05,Default,,0000,0000,0000,,and then on December, 3rd, we opened up to\Neveryone. Dialogue: 0,0:11:03.05,0:11:05.45,Default,,0000,0000,0000,,You didn't have to apply to join and Dialogue: 0,0:11:05.45,0:11:07.16,Default,,0000,0000,0000,,we'd issue a certificate as long\Nas you could prove Dialogue: 0,0:11:07.16,0:11:09.71,Default,,0000,0000,0000,,that you controlled a domain. Dialogue: 0,0:11:09.71,0:11:13.64,Default,,0000,0000,0000,,In the first day, we doubled the number of\Ncertificates we issued. Dialogue: 0,0:11:13.64,0:11:16.19,Default,,0000,0000,0000,,And in a week, I think, we quadrupled it. Dialogue: 0,0:11:16.19,0:11:18.77,Default,,0000,0000,0000,,I mean, in the first 12 hours we were issuing Dialogue: 0,0:11:18.77,0:11:23.53,Default,,0000,0000,0000,,a certificate almost every two seconds. Dialogue: 0,0:11:23.53,0:11:24.78,Default,,0000,0000,0000,,And since then, we've issued Dialogue: 0,0:11:24.78,0:11:32.19,Default,,0000,0000,0000,,over 200'000 certificates across 440'000 domain\Nnames. Dialogue: 0,0:11:32.19,0:11:34.33,Default,,0000,0000,0000,,This is … we're still in beta though. Dialogue: 0,0:11:34.33,0:11:36.09,Default,,0000,0000,0000,,That should be noted. Dialogue: 0,0:11:36.09,0:11:41.24,Default,,0000,0000,0000,,We don't expect to be … Dialogue: 0,0:11:41.24,0:11:43.58,Default,,0000,0000,0000,,We expect to do a Google-style Beta Dialogue: 0,0:11:43.58,0:11:48.26,Default,,0000,0000,0000,,—it will probably take a while. Dialogue: 0,0:11:48.26,0:11:52.24,Default,,0000,0000,0000,,Using Certificate Transparency Logs Dialogue: 0,0:11:52.24,0:11:54.90,Default,,0000,0000,0000,,which are a collection that Google has created Dialogue: 0,0:11:54.90,0:12:00.02,Default,,0000,0000,0000,,of almost all currently valid certificates Dialogue: 0,0:12:00.02,0:12:02.51,Default,,0000,0000,0000,,we can see that Let's Encrypt is already Dialogue: 0,0:12:02.51,0:12:05.31,Default,,0000,0000,0000,,the fifth largest Certificate Authority Dialogue: 0,0:12:05.31,0:12:09.55,Default,,0000,0000,0000,,and we're already larger than both WoSign and StartSSL Dialogue: 0,0:12:09.55,0:12:15.27,Default,,0000,0000,0000,,the two currently free\Npublic Certificate Authorities. Dialogue: 0,0:12:15.27,0:12:22.73,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:12:22.73,0:12:24.70,Default,,0000,0000,0000,,So our goal is to … Dialogue: 0,0:12:24.70,0:12:27.25,Default,,0000,0000,0000,,it isn't to be the largest Certificate Authority Dialogue: 0,0:12:27.25,0:12:29.56,Default,,0000,0000,0000,,but it is to raise the total percentage Dialogue: 0,0:12:29.56,0:12:34.08,Default,,0000,0000,0000,,of connections on the internet\Nthat go over HTTPS. Dialogue: 0,0:12:34.08,0:12:39.91,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:12:39.91,0:12:42.87,Default,,0000,0000,0000,,So this is a very hard thing to measure. Dialogue: 0,0:12:42.87,0:12:44.82,Default,,0000,0000,0000,,Unless you're sitting on a backbone, Dialogue: 0,0:12:44.82,0:12:47.66,Default,,0000,0000,0000,,it's almost impossible to tell what percentage Dialogue: 0,0:12:47.66,0:12:51.09,Default,,0000,0000,0000,,is going over HTTP\Nand what percentage is going over HTTPS. Dialogue: 0,0:12:51.09,0:12:54.44,Default,,0000,0000,0000,,Luckily, Firefox can provide us with Dialogue: 0,0:12:54.44,0:12:59.17,Default,,0000,0000,0000,,certain TLS telemetry about what\NCertificate Authorities Dialogue: 0,0:12:59.17,0:13:01.53,Default,,0000,0000,0000,,issue certificates that they're seeing Dialogue: 0,0:13:01.53,0:13:04.72,Default,,0000,0000,0000,,and we can also use Certificate Transparency Dialogue: 0,0:13:04.72,0:13:10.35,Default,,0000,0000,0000,,to try and figure out how people are\Nactually using our certificates. Dialogue: 0,0:13:10.35,0:13:12.18,Default,,0000,0000,0000,,We have a bunch of stats … Dialogue: 0,0:13:12.18,0:13:16.27,Default,,0000,0000,0000,,There are currently over\Na 120'000 individual registrations. Dialogue: 0,0:13:16.27,0:13:20.32,Default,,0000,0000,0000,,So, we count … a single registration\Ncan issue multiple certificates Dialogue: 0,0:13:20.32,0:13:25.11,Default,,0000,0000,0000,,and we see that there are currently only\Nabout two certificates per registration Dialogue: 0,0:13:25.11,0:13:27.100,Default,,0000,0000,0000,,with two DNS names per certificate. Dialogue: 0,0:13:27.100,0:13:31.25,Default,,0000,0000,0000,,Now this is most likely because people\Nare just testing the servers Dialogue: 0,0:13:31.25,0:13:37.23,Default,,0000,0000,0000,,so they will go out and try and find\Na certificate for their blog or personal website Dialogue: 0,0:13:37.23,0:13:40.46,Default,,0000,0000,0000,,and not very many people are using Dialogue: 0,0:13:40.46,0:13:47.28,Default,,0000,0000,0000,,very large certificates with multiple\NSubject Alternate Names yet. Dialogue: 0,0:13:47.28,0:13:50.89,Default,,0000,0000,0000,,We see that around 33% of the names\Nthat we issued for Dialogue: 0,0:13:50.89,0:13:53.98,Default,,0000,0000,0000,,have multiple certificates\Nwith that name in them. Dialogue: 0,0:13:53.98,0:13:55.78,Default,,0000,0000,0000,,This is actually a very common thing Dialogue: 0,0:13:55.78,0:13:58.18,Default,,0000,0000,0000,,we were expecting to see. Dialogue: 0,0:13:58.18,0:14:03.55,Default,,0000,0000,0000,,Because we issue a very large number\Nof certificates to Content Distribution Networks. Dialogue: 0,0:14:03.55,0:14:07.01,Default,,0000,0000,0000,,And these Networks will have tons of endpoints Dialogue: 0,0:14:07.01,0:14:09.84,Default,,0000,0000,0000,,that will work for a whole bunch Dialogue: 0,0:14:09.84,0:14:11.76,Default,,0000,0000,0000,,of different websites. Dialogue: 0,0:14:11.76,0:14:13.91,Default,,0000,0000,0000,,So they will, you know, Dialogue: 0,0:14:13.91,0:14:17.64,Default,,0000,0000,0000,,maybe have 15 certificates that'll have\Na set of 50 Domain Names Dialogue: 0,0:14:17.64,0:14:21.17,Default,,0000,0000,0000,,spread out across them. Dialogue: 0,0:14:21.17,0:14:23.48,Default,,0000,0000,0000,,We also see that 20% of certificates have Dialogue: 0,0:14:23.48,0:14:26.83,Default,,0000,0000,0000,,the exact same duplicate name sets. Dialogue: 0,0:14:26.83,0:14:29.02,Default,,0000,0000,0000,,This has probably more to do with Dialogue: 0,0:14:29.02,0:14:31.54,Default,,0000,0000,0000,,people trying to get used\Nto our official client Dialogue: 0,0:14:31.54,0:14:34.14,Default,,0000,0000,0000,,and us having to fix a few bugs in it Dialogue: 0,0:14:34.14,0:14:37.27,Default,,0000,0000,0000,,—that meant that people would reissue Dialogue: 0,0:14:37.27,0:14:39.38,Default,,0000,0000,0000,,the same certificate over and over Dialogue: 0,0:14:39.38,0:14:44.08,Default,,0000,0000,0000,,without noticing that\Nthey already had a valid one. Dialogue: 0,0:14:44.08,0:14:47.45,Default,,0000,0000,0000,,But we're seeing that slowly decrease. Dialogue: 0,0:14:47.45,0:14:50.69,Default,,0000,0000,0000,,We've also seen that\N80% of the domain names that we've issued for Dialogue: 0,0:14:50.69,0:14:52.46,Default,,0000,0000,0000,,have never had a certificate before, Dialogue: 0,0:14:52.46,0:14:55.44,Default,,0000,0000,0000,,according to the Certificate Transparency logs. Dialogue: 0,0:14:55.44,0:14:57.22,Default,,0000,0000,0000,,So we're actually providing people who Dialogue: 0,0:14:57.22,0:15:01.01,Default,,0000,0000,0000,,previously wouldn't have got a TLS certificate Dialogue: 0,0:15:01.01,0:15:03.47,Default,,0000,0000,0000,,with certificates. Dialogue: 0,0:15:03.47,0:15:10.68,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:15:10.68,0:15:16.16,Default,,0000,0000,0000,,And we've had … about 1% of our total issuance\Nhave been revoked so far, Dialogue: 0,0:15:16.16,0:15:23.78,Default,,0000,0000,0000,,which is a good sign that our\Nsystem is actually working. Dialogue: 0,0:15:23.78,0:15:28.06,Default,,0000,0000,0000,,So, in order to see how people are\Nactually deploying our certificates, Dialogue: 0,0:15:28.06,0:15:30.81,Default,,0000,0000,0000,,we've written a very small TLS scanner Dialogue: 0,0:15:30.81,0:15:32.28,Default,,0000,0000,0000,,that will go through the DNS names Dialogue: 0,0:15:32.28,0:15:33.57,Default,,0000,0000,0000,,of certificates we've issued Dialogue: 0,0:15:33.57,0:15:36.73,Default,,0000,0000,0000,,and try to see if they actually use them. Dialogue: 0,0:15:36.73,0:15:38.70,Default,,0000,0000,0000,,We see that about 75% of the people Dialogue: 0,0:15:38.70,0:15:40.59,Default,,0000,0000,0000,,that we've issued a certificate for Dialogue: 0,0:15:40.59,0:15:45.26,Default,,0000,0000,0000,,have actually deployed it on\Nthe domain name we've issued it for. Dialogue: 0,0:15:45.26,0:15:49.26,Default,,0000,0000,0000,,And only 8% of those names have\Na broken TLS configuration. Dialogue: 0,0:15:49.26,0:15:50.97,Default,,0000,0000,0000,,This means, if you try to connect to them, Dialogue: 0,0:15:50.97,0:15:53.80,Default,,0000,0000,0000,,your Browser would reject the certificate. Dialogue: 0,0:15:53.80,0:15:56.14,Default,,0000,0000,0000,,This can be because they're using Dialogue: 0,0:15:56.14,0:15:58.20,Default,,0000,0000,0000,,a self-signed certificate or Dialogue: 0,0:15:58.20,0:16:03.39,Default,,0000,0000,0000,,because they aren't presenting the right\Nchain of certificates, among other things. Dialogue: 0,0:16:03.39,0:16:05.29,Default,,0000,0000,0000,,And 3% of the names we've issued for Dialogue: 0,0:16:05.29,0:16:07.53,Default,,0000,0000,0000,,don't serve HTTPS at all. Dialogue: 0,0:16:07.53,0:16:11.22,Default,,0000,0000,0000,,Now this actually is probably quite small Dialogue: 0,0:16:11.22,0:16:15.14,Default,,0000,0000,0000,,because we only scan for HTTPS. Dialogue: 0,0:16:15.14,0:16:16.53,Default,,0000,0000,0000,,People could be using these certificates Dialogue: 0,0:16:16.53,0:16:22.25,Default,,0000,0000,0000,,for mail servers or IRC servers or XMPP servers\Nand we wouldn't know. Dialogue: 0,0:16:22.25,0:16:25.05,Default,,0000,0000,0000,,And we can see that 45% of the certificates Dialogue: 0,0:16:25.05,0:16:30.08,Default,,0000,0000,0000,,are used by every single\NDNS name that they contain. Dialogue: 0,0:16:30.08,0:16:32.63,Default,,0000,0000,0000,,Which is actually a quite good number. Dialogue: 0,0:16:32.63,0:16:35.55,Default,,0000,0000,0000,,So, looking at the Firefox telemetry, Dialogue: 0,0:16:35.55,0:16:41.34,Default,,0000,0000,0000,,we see that only 0.1% of\Ncurrently successful TLS handshakes Dialogue: 0,0:16:41.34,0:16:43.83,Default,,0000,0000,0000,,use a Let's Encrypt certificate. Dialogue: 0,0:16:43.83,0:16:48.52,Default,,0000,0000,0000,,Now this sounds very low, but\Nit actually makes a lot of sense. Dialogue: 0,0:16:48.52,0:16:49.66,Default,,0000,0000,0000,,We don't plan to … Dialogue: 0,0:16:49.66,0:16:50.95,Default,,0000,0000,0000,,or … our goal is not to make Dialogue: 0,0:16:50.95,0:16:54.89,Default,,0000,0000,0000,,the largest websites on the Internet\Nuse our certificates. Dialogue: 0,0:16:54.89,0:16:57.77,Default,,0000,0000,0000,,If that happened, the percentage of\Nsuccessful TLS handshakes Dialogue: 0,0:16:57.77,0:17:00.89,Default,,0000,0000,0000,,that we were involved in would be much higher. Dialogue: 0,0:17:00.89,0:17:06.63,Default,,0000,0000,0000,,But our goal is to issue certificates\Nto the long tail of people. Dialogue: 0,0:17:06.63,0:17:09.83,Default,,0000,0000,0000,,People who may not have\Nhundreds of thousands of visitors Dialogue: 0,0:17:09.83,0:17:11.16,Default,,0000,0000,0000,,to their website Dialogue: 0,0:17:11.16,0:17:15.66,Default,,0000,0000,0000,,but should still be able to use\Ncryptographic protocols. Dialogue: 0,0:17:15.66,0:17:21.07,Default,,0000,0000,0000,,So, we have an official client\Nwhich is called "Let's Encrypt" Dialogue: 0,0:17:21.07,0:17:28.87,Default,,0000,0000,0000,,but … which is currently used\Nby about 65% of our users. Dialogue: 0,0:17:28.87,0:17:32.49,Default,,0000,0000,0000,,This is a very complicated client Dialogue: 0,0:17:32.49,0:17:34.44,Default,,0000,0000,0000,,and it will do a lot of things for you. Dialogue: 0,0:17:34.44,0:17:40.09,Default,,0000,0000,0000,,It will manage renewal,\Nit will manage installing Dialogue: 0,0:17:40.09,0:17:43.53,Default,,0000,0000,0000,,into your either Apache or nginx server\Namong other things. Dialogue: 0,0:17:43.53,0:17:46.30,Default,,0000,0000,0000,,But there've also been,\Nsince we entered public beta, Dialogue: 0,0:17:46.30,0:17:50.01,Default,,0000,0000,0000,,around 30 unique 3rd party clients\Nthat have popped up. Dialogue: 0,0:17:50.01,0:17:55.70,Default,,0000,0000,0000,,For pretty much any scenario you\Nmight want to use a certificate for, Dialogue: 0,0:17:55.70,0:17:58.81,Default,,0000,0000,0000,,including a web server called "Caddy" Dialogue: 0,0:17:58.81,0:18:02.75,Default,,0000,0000,0000,,that has a built-in ACME client,\Nwhich means that as soon as … Dialogue: 0,0:18:02.75,0:18:06.45,Default,,0000,0000,0000,,you can turn on your web server and if you\Ndon't have an SSL certificate, Dialogue: 0,0:18:06.45,0:18:11.16,Default,,0000,0000,0000,,it will automatically go out and\Nfetch one for you. Dialogue: 0,0:18:11.16,0:18:16.31,Default,,0000,0000,0000,,Another one is a web based client so you\Ncan go in your browser and Dialogue: 0,0:18:16.31,0:18:22.87,Default,,0000,0000,0000,,generate a certificate without installing\Nanything on your system at all. Dialogue: 0,0:18:22.87,0:18:25.41,Default,,0000,0000,0000,,So our main goal is actually to get Dialogue: 0,0:18:25.41,0:18:28.06,Default,,0000,0000,0000,,Hosting providers and\NContent Distribution Networks Dialogue: 0,0:18:28.06,0:18:30.36,Default,,0000,0000,0000,,to use our certificates. Dialogue: 0,0:18:30.36,0:18:34.79,Default,,0000,0000,0000,,While most people here might want to\Njust go out and install a certificate Dialogue: 0,0:18:34.79,0:18:37.16,Default,,0000,0000,0000,,on the server they run themselves, Dialogue: 0,0:18:37.16,0:18:41.04,Default,,0000,0000,0000,,the majority of people who are running\Nsmaller websites are using Dialogue: 0,0:18:41.04,0:18:44.83,Default,,0000,0000,0000,,a hosting provider who will\Nrun all of this for them. Dialogue: 0,0:18:44.83,0:18:49.57,Default,,0000,0000,0000,,And, generally, these people will\Ncharge for certificates Dialogue: 0,0:18:49.57,0:18:52.12,Default,,0000,0000,0000,,and our goal is to try and get them to Dialogue: 0,0:18:52.12,0:18:54.15,Default,,0000,0000,0000,,a) make it free, and Dialogue: 0,0:18:54.15,0:18:57.49,Default,,0000,0000,0000,,b) make it painless for the users. Dialogue: 0,0:18:57.49,0:19:02.30,Default,,0000,0000,0000,,So, so far we have Akamai, KeyCDN, DreamHost,\NCyon and Pressjitsu Dialogue: 0,0:19:02.30,0:19:06.09,Default,,0000,0000,0000,,—these are both hosting providers and\NContent Distribution networks Dialogue: 0,0:19:06.09,0:19:08.44,Default,,0000,0000,0000,,who have already integrated with Let's Encrypt Dialogue: 0,0:19:08.44,0:19:13.96,Default,,0000,0000,0000,,and will allow you to get a certificate\Ncompletely for free. Dialogue: 0,0:19:13.96,0:19:15.85,Default,,0000,0000,0000,,And we assume that, in the long term, Dialogue: 0,0:19:15.85,0:19:18.58,Default,,0000,0000,0000,,this will make up the majority of our usage. Dialogue: 0,0:19:18.58,0:19:22.62,Default,,0000,0000,0000,,Most likely, people issuing\Nhundreds of thousands of certificates Dialogue: 0,0:19:22.62,0:19:27.77,Default,,0000,0000,0000,,won't be individuals,\Nthey'll be hosting providers. Dialogue: 0,0:19:27.77,0:19:29.53,Default,,0000,0000,0000,,So our … Dialogue: 0,0:19:29.53,0:19:32.89,Default,,0000,0000,0000,,We still have a lot of work to do\Non our Certificate Authority. Dialogue: 0,0:19:32.89,0:19:39.13,Default,,0000,0000,0000,,Currently, you can only do validation\Nbased on either HTTP or HTTPS. Dialogue: 0,0:19:39.13,0:19:44.18,Default,,0000,0000,0000,,This has made it quite complicated\Nfor people who have very complex set-ups, Dialogue: 0,0:19:44.18,0:19:49.62,Default,,0000,0000,0000,,that are using load-balancers or other systems Dialogue: 0,0:19:49.62,0:19:53.44,Default,,0000,0000,0000,,to validate their websites. Dialogue: 0,0:19:53.44,0:19:57.76,Default,,0000,0000,0000,,One of our solutions for this is the\NDNS challenge which will allow anyone Dialogue: 0,0:19:57.76,0:20:02.81,Default,,0000,0000,0000,,to just add a DNS record and automatically\Nvalidate the domain name they want. Dialogue: 0,0:20:02.81,0:20:08.35,Default,,0000,0000,0000,,We also want to implement a\N"Proof of Possession" challenge. Dialogue: 0,0:20:08.35,0:20:11.50,Default,,0000,0000,0000,,This means that if you asked for\Na certificate for a Domain Name Dialogue: 0,0:20:11.50,0:20:15.64,Default,,0000,0000,0000,,that we know is already using\Nan SSL certificate, Dialogue: 0,0:20:15.64,0:20:20.77,Default,,0000,0000,0000,,we'll ask you to prove that you\Ncontrol the private key of that certificate. Dialogue: 0,0:20:20.77,0:20:26.44,Default,,0000,0000,0000,,And this is a extra way to verify Dialogue: 0,0:20:26.44,0:20:29.61,Default,,0000,0000,0000,,that a single person won't control Dialogue: 0,0:20:29.61,0:20:34.01,Default,,0000,0000,0000,,or can't mis-issue a certificate for\Na domain they can't control. Dialogue: 0,0:20:34.01,0:20:36.98,Default,,0000,0000,0000,,We also want to add Multi-Path Validation. Dialogue: 0,0:20:36.98,0:20:39.44,Default,,0000,0000,0000,,Currently, we validate from a single point. Dialogue: 0,0:20:39.44,0:20:44.15,Default,,0000,0000,0000,,And this means that we are susceptible to\Nnetwork-local attacks. Dialogue: 0,0:20:44.15,0:20:48.22,Default,,0000,0000,0000,,—but this will change very soon. Dialogue: 0,0:20:48.22,0:20:50.62,Default,,0000,0000,0000,,Alright, thank you. Dialogue: 0,0:20:50.62,0:21:03.41,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:21:03.41,0:21:07.48,Default,,0000,0000,0000,,Angel: Thank you.\NThe first few questions are for the Internet. Dialogue: 0,0:21:07.48,0:21:10.39,Default,,0000,0000,0000,,Signal Angel: Okay, the first question\Nfrom the Internet is: Dialogue: 0,0:21:10.39,0:21:15.98,Default,,0000,0000,0000,,Question: Given the critics on the\Nofficial client, wouldn't it have been Dialogue: 0,0:21:15.98,0:21:21.59,Default,,0000,0000,0000,,better to split the service and the client? Dialogue: 0,0:21:21.59,0:21:26.92,Default,,0000,0000,0000,,Shoemaker: I think … Dialogue: 0,0:21:26.92,0:21:30.57,Default,,0000,0000,0000,,The client is a very hard thing to implement Dialogue: 0,0:21:30.57,0:21:35.92,Default,,0000,0000,0000,,and we, because we're the people who created\Nthe protocol, Dialogue: 0,0:21:35.92,0:21:40.41,Default,,0000,0000,0000,,I think it makes sense for us to also\Nwork on trying to create the client for it. Dialogue: 0,0:21:40.41,0:21:44.95,Default,,0000,0000,0000,,If we had just waited\Nfor somebody else to do it, Dialogue: 0,0:21:44.95,0:21:50.97,Default,,0000,0000,0000,,I don't think we would've been able\Nto get as far as we have so far. Dialogue: 0,0:21:50.97,0:21:55.95,Default,,0000,0000,0000,,SigAngQ: The second question is … Dialogue: 0,0:21:55.95,0:21:58.80,Default,,0000,0000,0000,,that, well, a lot of people are apparently\Ninterested in your t-shirt Dialogue: 0,0:21:58.80,0:22:01.36,Default,,0000,0000,0000,,and want to know:\N1) what's on it and Dialogue: 0,0:22:01.36,0:22:03.81,Default,,0000,0000,0000,,2) where can they get one. Dialogue: 0,0:22:03.81,0:22:06.40,Default,,0000,0000,0000,,Shoemaker: Unfortunately,\Nthese aren't for sale … yet. Dialogue: 0,0:22:06.40,0:22:09.08,Default,,0000,0000,0000,,But they should be very soon. Dialogue: 0,0:22:09.08,0:22:11.72,Default,,0000,0000,0000,,And you may notice that this is\Nsupposed to be the Dialogue: 0,0:22:11.72,0:22:14.04,Default,,0000,0000,0000,,contents of a certificate. Dialogue: 0,0:22:14.04,0:22:17.95,Default,,0000,0000,0000,,You can try and decode it,\Nbut I don't think you'll get very far. Dialogue: 0,0:22:17.95,0:22:22.37,Default,,0000,0000,0000,,StgMgr: Okay, next question\Nfrom microphone #1. Dialogue: 0,0:22:22.37,0:22:25.78,Default,,0000,0000,0000,,Q: Since I've tried your service and\Nit works very well, Dialogue: 0,0:22:25.78,0:22:29.60,Default,,0000,0000,0000,,I was wondering what keeps you from\Ngoing into public. Dialogue: 0,0:22:29.60,0:22:36.64,Default,,0000,0000,0000,,I mean, you're now choosing a Beta type\N—what is "Beta" in your service, currently? Dialogue: 0,0:22:36.64,0:22:42.24,Default,,0000,0000,0000,,Shmk: Well … chuckles our service\Nhasn't been completely tested. Dialogue: 0,0:22:42.24,0:22:43.74,Default,,0000,0000,0000,,{\i1}slight laughter{\i0} Dialogue: 0,0:22:43.74,0:22:47.26,Default,,0000,0000,0000,,We wouldn't suggest that\Na website like Facebook Dialogue: 0,0:22:47.26,0:22:49.86,Default,,0000,0000,0000,,that gets millions of requests a day Dialogue: 0,0:22:49.86,0:22:53.53,Default,,0000,0000,0000,,would deploy one of our certificates\Njust yet. Dialogue: 0,0:22:53.53,0:22:59.52,Default,,0000,0000,0000,,Yeah … It is …\NCurrently, we have a hard limit on Dialogue: 0,0:22:59.52,0:23:02.08,Default,,0000,0000,0000,,how many certificates we're able to issue Dialogue: 0,0:23:02.08,0:23:05.46,Default,,0000,0000,0000,,due to our hardware security modules Dialogue: 0,0:23:05.46,0:23:09.71,Default,,0000,0000,0000,,and because of that, we're kind of\Ntrying to take it slowly for now. Dialogue: 0,0:23:09.71,0:23:11.62,Default,,0000,0000,0000,,Q: But it works? Dialogue: 0,0:23:11.62,0:23:14.35,Default,,0000,0000,0000,,Shmk: Yeah. As far as we now. chuckles. Dialogue: 0,0:23:14.35,0:23:17.74,Default,,0000,0000,0000,,StgMgr: Okay, next question\Nfrom microphone #2. Dialogue: 0,0:23:17.74,0:23:21.58,Default,,0000,0000,0000,,Q: Hi. What are you using for revocation?\NAre you using the Dialogue: 0,0:23:21.58,0:23:25.25,Default,,0000,0000,0000,,standard-defined revocation lists\Nor do you have your own solution? Dialogue: 0,0:23:25.25,0:23:30.56,Default,,0000,0000,0000,,We're using OCSP, our plan is to\Npromote OCSP Stapling Dialogue: 0,0:23:30.56,0:23:37.45,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:23:37.45,0:23:44.00,Default,,0000,0000,0000,,The CRL model is too broken and\Nwe're kind of trying to push Dialogue: 0,0:23:44.00,0:23:48.19,Default,,0000,0000,0000,,both Apache and nginx to get to\Nact together with OCSP Stapling Dialogue: 0,0:23:48.19,0:23:52.49,Default,,0000,0000,0000,,so that it'll actually be a useful\Nrevocation method. Dialogue: 0,0:23:52.49,0:23:57.17,Default,,0000,0000,0000,,StgMgr: Okay, next question is for\Nthe Internet, and after that microphone 1 again. Dialogue: 0,0:23:57.17,0:23:58.44,Default,,0000,0000,0000,,SigAngQ: Okay, the question is: Dialogue: 0,0:23:58.44,0:24:02.72,Default,,0000,0000,0000,,Why is there a limit on\Ncertificate issues per domain? Dialogue: 0,0:24:02.72,0:24:05.60,Default,,0000,0000,0000,,Because that is especially annoying for\Ndynamic DNS users. Dialogue: 0,0:24:05.60,0:24:07.55,Default,,0000,0000,0000,,Shmk: Yes. We agree. Dialogue: 0,0:24:07.55,0:24:12.88,Default,,0000,0000,0000,,Currently, we use the Public Suffix List\Nto decide how many certificates Dialogue: 0,0:24:12.88,0:24:14.74,Default,,0000,0000,0000,,a domain should get. Dialogue: 0,0:24:14.74,0:24:21.61,Default,,0000,0000,0000,,So if you have, say, roan.com, you'll only\Nbe able to get 5 certificates for that domain. Dialogue: 0,0:24:21.61,0:24:25.43,Default,,0000,0000,0000,,Currently, this is because we have a\Nhard limit on how many certificates Dialogue: 0,0:24:25.43,0:24:28.90,Default,,0000,0000,0000,,we are able to issue, so we don't want\Na single user to be able to go out Dialogue: 0,0:24:28.90,0:24:34.16,Default,,0000,0000,0000,,and take off a\Nsignificant percentage of that. Dialogue: 0,0:24:34.16,0:24:37.57,Default,,0000,0000,0000,,We're trying to figure out a better\Nrate-limiting solution. Dialogue: 0,0:24:37.57,0:24:41.40,Default,,0000,0000,0000,,You should notice in the future that you'll\Nbe able to issue a lot more certificates Dialogue: 0,0:24:41.40,0:24:45.49,Default,,0000,0000,0000,,but we're just not there, yet. Dialogue: 0,0:24:45.49,0:24:50.13,Default,,0000,0000,0000,,Q: Hi. First, thanks for the talk and for\Nthe great aim I think we all support. Dialogue: 0,0:24:50.13,0:24:55.16,Default,,0000,0000,0000,,I have a question regarding the audit that\Nhas to be done by Let's Encrypt, Dialogue: 0,0:24:55.16,0:25:00.56,Default,,0000,0000,0000,,because for new kids on the block, usually\Nthere is this kind of certain audits Dialogue: 0,0:25:00.56,0:25:04.14,Default,,0000,0000,0000,,where the Mozilla Foundation also was\Na part of creating this Dialogue: 0,0:25:04.14,0:25:07.87,Default,,0000,0000,0000,,and as I know, there is a\Nthree-month grace period Dialogue: 0,0:25:07.87,0:25:10.73,Default,,0000,0000,0000,,of like handing in all the papers\Nand whatever afterwards Dialogue: 0,0:25:10.73,0:25:13.96,Default,,0000,0000,0000,,and if you started in September,\Nthat means, now we're in December, Dialogue: 0,0:25:13.96,0:25:16.93,Default,,0000,0000,0000,,so what's the status of this\Nwhole audit thing? Dialogue: 0,0:25:16.93,0:25:19.86,Default,,0000,0000,0000,,And, as I know, maybe you can comment\Non this as well: Dialogue: 0,0:25:19.86,0:25:22.37,Default,,0000,0000,0000,,The cross-validation does not\Ncount for this?! Dialogue: 0,0:25:22.37,0:25:23.66,Default,,0000,0000,0000,,So I'd be very interested. Dialogue: 0,0:25:23.66,0:25:29.27,Default,,0000,0000,0000,,Shmk: So, we are not yet in the root\Nprogrammes of any of the major Browsers. Dialogue: 0,0:25:29.27,0:25:35.55,Default,,0000,0000,0000,,We've, I think, just finished our audits. Dialogue: 0,0:25:35.55,0:25:39.27,Default,,0000,0000,0000,,Unfortunately, a cross-signature doesn't\Nrequire any audits. Dialogue: 0,0:25:39.27,0:25:42.60,Default,,0000,0000,0000,,If you can pay a Certificate Authority\Nenough money, they will cross-sign Dialogue: 0,0:25:42.60,0:25:45.76,Default,,0000,0000,0000,,one of your certificates and\Nallow you to issue. Dialogue: 0,0:25:45.76,0:25:49.65,Default,,0000,0000,0000,,It's a very silly system. Dialogue: 0,0:25:49.65,0:25:57.10,Default,,0000,0000,0000,,So, yeah, it means that we can currently\Nissue completely valid, trusted certificates, Dialogue: 0,0:25:57.10,0:26:03.31,Default,,0000,0000,0000,,but we are not a member of the organisation\Nthat decides how that works. Dialogue: 0,0:26:03.31,0:26:06.04,Default,,0000,0000,0000,,It's strange … Dialogue: 0,0:26:06.04,0:26:07.91,Default,,0000,0000,0000,,StgMgr: Next question from\Nmicrophone #5? Dialogue: 0,0:26:07.91,0:26:13.93,Default,,0000,0000,0000,,Q: Hi. I, first of all, would like to\Nthank everyone working on this project, Dialogue: 0,0:26:13.93,0:26:16.88,Default,,0000,0000,0000,,you guys are awesome!\NShoemaker: Thank you! Dialogue: 0,0:26:16.88,0:26:23.03,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:26:23.03,0:26:26.70,Default,,0000,0000,0000,,Q: So, I've got a question regarding nginx. Dialogue: 0,0:26:26.70,0:26:35.20,Default,,0000,0000,0000,,Do you know when you might have it\Ncompletely supported? Dialogue: 0,0:26:35.20,0:26:38.91,Default,,0000,0000,0000,,Shoemaker: I'm not 100% sure.\NWe're working on … Dialogue: 0,0:26:38.91,0:26:42.23,Default,,0000,0000,0000,,—this is kind of our main focus in the\Nclient right now. Dialogue: 0,0:26:42.23,0:26:48.49,Default,,0000,0000,0000,,We're increasing how well the\NApache and nginx plug-ins work, Dialogue: 0,0:26:48.49,0:26:51.15,Default,,0000,0000,0000,,nginx has kind of got the short end\Nof the stick currently Dialogue: 0,0:26:51.15,0:26:56.53,Default,,0000,0000,0000,,because the majority of people we are\Nworking with are using Apache. Dialogue: 0,0:26:56.53,0:26:59.82,Default,,0000,0000,0000,,The next few months, this should\Nimprove significantly. Dialogue: 0,0:26:59.82,0:27:02.15,Default,,0000,0000,0000,,Q: Okay, thank you. Dialogue: 0,0:27:02.15,0:27:06.62,Default,,0000,0000,0000,,StgMgr: Next question is from microphone #4\Nand then we'll be go back to the Internet. Dialogue: 0,0:27:06.62,0:27:08.34,Default,,0000,0000,0000,,Q: So, I have two: Dialogue: 0,0:27:08.34,0:27:13.52,Default,,0000,0000,0000,,So, let's that that tomorrow SHA-2,\Nsuddenly there's a big attack, Dialogue: 0,0:27:13.52,0:27:17.37,Default,,0000,0000,0000,,everyone should move to SHA-3,\Nbut unfortunately, as we all know, Dialogue: 0,0:27:17.37,0:27:19.81,Default,,0000,0000,0000,,many clients would lag. Dialogue: 0,0:27:19.81,0:27:21.32,Default,,0000,0000,0000,,How would you plan to solve this situation? Dialogue: 0,0:27:21.32,0:27:26.03,Default,,0000,0000,0000,,Will you push everyone to\Nmigrate instantly to SHA-3? Dialogue: 0,0:27:26.03,0:27:31.58,Default,,0000,0000,0000,,Will you cater to those of your users that\Nwould like to remain, you know, Dialogue: 0,0:27:31.58,0:27:33.44,Default,,0000,0000,0000,,as compatible as possible? Dialogue: 0,0:27:33.44,0:27:35.28,Default,,0000,0000,0000,,And, kind of related to that, Dialogue: 0,0:27:35.28,0:27:38.44,Default,,0000,0000,0000,,can you give us\N—I'm sure, you've been asked this question a lot Dialogue: 0,0:27:38.44,0:27:43.41,Default,,0000,0000,0000,,—why 90 days? Why not a lot less\Nand maybe even get rid of the entire Dialogue: 0,0:27:43.41,0:27:48.24,Default,,0000,0000,0000,,revocation system, why not more?\NCan you give us a little glimpse Dialogue: 0,0:27:48.24,0:27:50.71,Default,,0000,0000,0000,,on how you want to handle these decisions? Dialogue: 0,0:27:50.71,0:27:54.51,Default,,0000,0000,0000,,Shoemaker: So, the first question: Dialogue: 0,0:27:54.51,0:27:59.40,Default,,0000,0000,0000,,That decision isn't 100% up to us.\NIt'd be more up to the CA/B forum Dialogue: 0,0:27:59.40,0:28:02.84,Default,,0000,0000,0000,,and how they choose to\Nsunset the algorithm. Dialogue: 0,0:28:02.84,0:28:07.21,Default,,0000,0000,0000,,Most likely, we'd continue issuing\Nuntil the deadline Dialogue: 0,0:28:07.21,0:28:11.70,Default,,0000,0000,0000,,so that people can switch over\Nas seamlessly as possible. Dialogue: 0,0:28:11.70,0:28:18.06,Default,,0000,0000,0000,,But again, that's kind of a\Npolicy question for the governing body. Dialogue: 0,0:28:18.06,0:28:21.85,Default,,0000,0000,0000,,And then, the 90 days:\NWe've been considering allowing Dialogue: 0,0:28:21.85,0:28:24.46,Default,,0000,0000,0000,,less than 90 days, so if you'd like to Dialogue: 0,0:28:24.46,0:28:29.58,Default,,0000,0000,0000,,issue a 1-day certificate or a\N2-day certificate, that should be possible. Dialogue: 0,0:28:29.58,0:28:31.75,Default,,0000,0000,0000,,We decided that there should\Nbe a hard limit, though, Dialogue: 0,0:28:31.75,0:28:35.24,Default,,0000,0000,0000,,on how long a certificate\Nwe are willing to issue. Dialogue: 0,0:28:35.24,0:28:38.46,Default,,0000,0000,0000,,And 90 days is, in part, due to how long Dialogue: 0,0:28:38.46,0:28:41.40,Default,,0000,0000,0000,,we would think a certificate\Nthat was compromised Dialogue: 0,0:28:41.40,0:28:47.21,Default,,0000,0000,0000,,is safe to be around,\Nand that should be as small as possible. Dialogue: 0,0:28:47.21,0:28:49.93,Default,,0000,0000,0000,,Unfortunately, renewal is still\Na hard problem, Dialogue: 0,0:28:49.93,0:28:54.33,Default,,0000,0000,0000,,so we can't just say "a week" or "two weeks" Dialogue: 0,0:28:54.33,0:29:00.86,Default,,0000,0000,0000,,and ninety days was kind of what we\Ncame down to is the safest. Dialogue: 0,0:29:00.86,0:29:02.76,Default,,0000,0000,0000,,Stage Manager: Okay,\Nlast question is for the Internet. Dialogue: 0,0:29:02.76,0:29:05.19,Default,,0000,0000,0000,,SigAngQ: Okay, then the\Nlast question will be: Dialogue: 0,0:29:05.19,0:29:08.06,Default,,0000,0000,0000,,What is the stack that you\Nuse to generate the certificates? Dialogue: 0,0:29:08.06,0:29:11.36,Default,,0000,0000,0000,,Do you have any special optimisation,\Nlike code or hardware to Dialogue: 0,0:29:11.36,0:29:14.33,Default,,0000,0000,0000,,keep up with the increased demand? Dialogue: 0,0:29:14.33,0:29:19.41,Default,,0000,0000,0000,,Shoemaker: So … We sign our certificates\Nusing hardware security modules and Dialogue: 0,0:29:19.41,0:29:23.64,Default,,0000,0000,0000,,there's a library produced by CloudFlare\Nwhich they use for their Dialogue: 0,0:29:23.64,0:29:28.63,Default,,0000,0000,0000,,universal SSL programme,\Nwhich is called CFSSL, Dialogue: 0,0:29:28.63,0:29:31.50,Default,,0000,0000,0000,,but there is no special process involved. Dialogue: 0,0:29:31.50,0:29:37.59,Default,,0000,0000,0000,,It's just typical X.509 generation. Dialogue: 0,0:29:37.59,0:29:40.03,Default,,0000,0000,0000,,Stage Manager: Okay, thank you very much. Dialogue: 0,0:29:40.03,0:29:45.44,Default,,0000,0000,0000,,{\i1}applause{\i0} Dialogue: 0,0:29:45.44,0:29:51.40,Default,,0000,0000,0000,,{\i1}music{\i0} Dialogue: 0,0:29:51.40,0:29:57.00,Default,,0000,0000,0000,,subtitles created by c3subtitles.de\Nin the year 2016. Join, and help us!