Skip to main content

mastodon - Link to source

šŸšØ Letā€™s Encrypt at risk from Trump cuts to OTF: ā€œLetā€™s Encrypt received around $800,000 in funding from the OTFā€

Dear @EUCommission, get your heads out of your arses and letā€™s find @letsencrypt ā‚¬1M/year (a rounding error in EU finances) and have them move to the EU.

If Letā€™s Encrypt is fucked, the web is fucked, and the Small Web is fucked too. So how about we donā€™t let that happen, yeah?

(In the meanwhile, if the Letā€™s Encrypt folks want to make a point about how essential they are, it might be an idea to refuse certificates to republican politicians. See how they like their donation systems breaking in real timeā€¦)

CC @nlnet @NGIZero@mastodon.xyz

#USA #fascism #OpenTechFund #LetsEncrypt #SSL #TLS #encryption #EU #web #tech #SmallWeb #SmallTech mastodon.social/@publictorstenā€¦

publictorsten (@publictorsten@mastodon.social)

Wenn Letā€™s Encrypt plƶtzlich nicht mehr klappt, wird das halbe Internet aus Zertifikatsfehlern bestehen. https://www.heise.de/news/Nach-Trump-Dekret-Kampf-um-US-Foerdermittel-fuer-Tor-F-Droid-und-Let-s-Encrypt-10328226.html
Mastodon
#tech #EU #USA #encryption #SmallWeb #smalltech #fascism #web #tls #letsencrypt #SSL #OpenTechFund @Let's Encrypt @European Commission @NLnet
This entry was edited (8 months ago)
in reply to Aral Balkan

Alexandre Dulaunoy
mastodon - Link to source
Alexandre Dulaunoy
• •

The main problem is the bureaucracy associated for this. Another issue is the ownership control of the organisation (DEP Cybersecurity), the organisation needs to be controlled by EU citizen and located in EU.

@EUCommission @letsencrypt @nlnet

@Let's Encrypt @European Commission @NLnet
in reply to Alexandre Dulaunoy

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
@a None of that is insurmountable or even hard. Could be done in a week if the political will was there. Itā€™s such a low hanging fruit.
@Alexandre Dulaunoy
in reply to Aral Balkan

Alexandre Dulaunoy
mastodon - Link to source
Alexandre Dulaunoy
• •

I really would like to share your optimism too.

If I can help in some ways, let me know. I was tracking the RFA budget withdraw and wondering how long OTF can survive without the funding.

@EUCommission @letsencrypt @nlnet

@Let's Encrypt @European Commission @NLnet
in reply to Aral Balkan

Job
mastodon - Link to source
Job
• •
@a While I agree, given the amount of "hey could you please put a back door in the chat app?" bullshit that European governments have once again regressed to recently, I'm not particularly hopeful about the "political will" part
@Alexandre Dulaunoy
in reply to Aral Balkan

Alesandro Ortiz šŸ‡µšŸ‡·šŸ³ļøā€šŸŒˆ
mastodon - Link to source
Alesandro Ortiz šŸ‡µšŸ‡·šŸ³ļøā€šŸŒˆ
• •
Google and other large tech companies can also make up the difference, assuming they're funding it already. If not, they certainly should.
in reply to Aral Balkan

Alesandro Ortiz šŸ‡µšŸ‡·šŸ³ļøā€šŸŒˆ
mastodon - Link to source
Alesandro Ortiz šŸ‡µšŸ‡·šŸ³ļøā€šŸŒˆ
• •

Fair enough. As long as the same private companies that benefit from LE pay their fair share of taxes too, we're roughly on the same page.

These companies and their users benefit from a more secure web, so they should pay for that, directly or indirectly.

In this case, I also doubt private companies would let LE be abandoned since it requires active maintenance costs in servers, etc. (vs. open source software they use which generally doesn't have public/expensive external infrastructure).

in reply to Aral Balkan

adison verlice
mastodon - Link to source
adison verlice
• •

they can't. that'd completely go against their values.
this is like asking them to refuse letsencrypt in Russia, they can't. it's an automated certificate system, they can't just prevent the issuing certificates simply because of their party.

even big websites, like the national security agency, and even whitehouse.gov use letsencrypt as well, so it wouldn't be a good sign for anyone.

This entry was edited (8 months ago)
in reply to Aral Balkan

adison verlice
mastodon - Link to source
adison verlice
• •
I will agree letsencrypt absolutely needs money to keep the lights on. and if worst comes to worst, hopefully they will move to EU. what I don't agree with is removing certificates from politicians that are in a different party
in reply to Aral Balkan

adison verlice
mastodon - Link to source
adison verlice
• •
also, this wouldn't prevent shit because the federal government can either use digicert (which is what some agencies use for certificate generation) or Google trust services PKI.
google trust services also issues automated I believe.
so simply doing that to letsencrypt wouldn't exactly, hurt, politicians. they have money we don't, so issuing digicert, sectigo or even entrust is something they can absolutely do
Unknown parent

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
@TheDutchChief Thank you, but you shouldnā€™t have to. You pay your taxes? That should be enough. This should be public infrastructure.
@Jeroen van Tol šŸ‹ šŸøšŸ”»
in reply to Aral Balkan

Kevin Karhan
mastodon - Link to source
Kevin Karhan
• •

call me weird but the developments of @letsencrypt vs. @cacert shows everything wrong with the way #SSL works.

We would've had a superior alternative to #LetsEncrypt if #GAFAMs weren't able or even allowed to cockblock #CACert by refusing to import it's ROOT-CA, whilst every commercial #CA gets their keys imported, no matter how shit they are or that they are essentially a hostile state actor!

#letsencrypt #SSL #CA #GAFAMs #cacert @Let's Encrypt @CAcert
in reply to Kevin Karhan

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
@kkarhan @cacert Yes, Iā€™ve been yelling from the top of my lungs that core Internet infrastructure like domain names, DNS, and TLS certificates should be public infrastructure for as long as I can remember. These are perfect examples of manufactured scarcity.
@Kevin Karhan @CAcert
in reply to Aral Balkan

Stefan Ritter
mastodon - Link to source
Stefan Ritter
• •
I totally understand what you're saying and I'm behind it too. But you should still remember that before Letsencrypt there was already Internet and it wasn't broken. It just got prettier.
in reply to Aral Balkan

Tom
mastodon - Link to source
Tom
• •
Or let's use the protocol they created - ACME - to create more independent CA, EU-based ! github.com/tdelmas/Let-s-Clone

GitHub - tdelmas/Let-s-Clone: How to spread Certificates Authorities like Let's Encrypt

How to spread Certificates Authorities like Let's Encrypt - tdelmas/Let-s-Clone
GitHub

Aral Balkan reshared this.

in reply to Tom

Aral Balkan
mastodon - Link to source
Aral Balkan
• •

Nice + yep, we could have an EU-based provider and regulate so that browsers must accept them.

And have it work with OpenNIC so we can decouple domain names from the artificial scarcity of the commercial ICAAN.

This entry was edited (8 months ago)
in reply to Tom

Tom
mastodon - Link to source
Tom
• •
Also, the problem is not only the funding. Under US law, they can't issue certificates to anybody under US-sanctions. It's only by chance that the International Criminal Court (whitehouse.gov/presidential-acā€¦) was not impacted.

Imposing Sanctions on the International Criminal Court ā€“ The White House

By the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency
The White House
in reply to Tom

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
@tdelmas Good shout. Yes. And whatā€™s the use of a standard if there arenā€™t multiple implementations?
@Tom
in reply to Aral Balkan

SpaceLifeForm
mastodon - Link to source
SpaceLifeForm
• •

Fundamentaly, the design is flawed because DNS is not decentralized.

Got Dot?

in reply to Aral Balkan

Saupreiss #PrƤparat500 šŸ—½
mastodon - Link to source
Saupreiss #PrƤparat500 šŸ—½
• •

LE is not the only Provider of free ACME-Issued certificates and some of the alternatives are even based in the EU.

@EUCommission @letsencrypt @nlnet

@Let's Encrypt @European Commission @NLnet
in reply to Saupreiss #PrƤparat500 šŸ—½

Aral Balkan
mastodon - Link to source
Aral Balkan
• •

These folks? They seem very commercial. Whatā€™s to stop them offering the free certs tomorrow? Thereā€™s value in having a noncommercial EU alternative funded with taxpayer money.

buypass.com/products/tls-ssl-cā€¦


Buy Norwegian SSL certificates

Choose Buypass to protect your websites with TLS/SSL certificates. Norwegian issuer.
Buypass.com
This entry was edited (8 months ago)
in reply to Aral Balkan

JĆørn
mastodon - Link to source
JĆørn
• •

@dalias Last time I checked, every public CA must log in the CT log, and they must at least log into Googleā€™s log.

So if Google refuses your log entry, doesnā€™t matter if your CA is European, the certificate wonā€™t be valid.

EU had an initiative for European CA, with eIDAS, but instead of improving it we were just very much against it. We get the future we voted for.

blog.mozilla.org/en/security/mā€¦


Mozilla and the EFF publish letter about the danger of Article 45.2

Technical experts at Mozilla and many other organizations have all spoken out about how these requirements would be bad for the web.
Eric Rescorla (The Mozilla Blog)
@Cassandrich
in reply to Aral Balkan

Momo
mastodon - Link to source
Momo
• •

Let's Encrypt states they are protecting 550M websites with their certificates. Imagine everyone would donate 1 cent per certificate per year. Yeah I know, payment processor fees, but hear me out: If Let's Encrypt would end up with 1 cent per certificate... this would mean 5.5 million Dollars per year. For each one of us it's just a few cents plus fees. But for them it would be about 7 times the amount they are endangered to loose now.

Yes, the EU could chip in for the US...

But so can we.

@EUCommission @letsencrypt @nlnet @dickenhobelix

@Dickenhobelix @Let's Encrypt @European Commission @NLnet
in reply to Aral Balkan

Alan
mastodon - Link to source
Alan
• •

EU really needs to take charge here. Let's Encrypt is essential.

Achim provides a bit more context about this move and the dubious legalities of cutting off OTF here:

eupolicy.social/@achimkla/1142ā€¦

Unfortunately it seems a number of Small Web/FOSS projects are affected by this.

Achim Klabunde

2025-03-23 13:24:53

mastodon - Link to source

OpenTechFund operated on budget committed by the US Congress. The US President cannot stop funding that the parliament has decided on. However, what he claims to be allowed to do is to reduce the staff of the agency in charge of administration of these funds so that it no longer can do its work.
What do you expect when government is handed over to BigTech?
Source (in German): netzpolitik.org/2025/projekte-ā€¦


Projekte fĆ¼r Internetfreiheit: Open Technology Fund steht vor dem Aus

Nun hat der Trumpsche Kahlschlag auch den Open Technology Fund erreicht. Das US-Projekt finanziert Projekte mit, die sich weltweit fĆ¼r die Internetfreiheit einsetzen. Damit ist vorerst Schluss, gab die OTF-PrƤsidentin Laura Cunningham bekannt.
netzpolitik.org
in reply to Aral Balkan

Tom Bortels
mastodon - Link to source
Tom Bortels
• •

OTF is just one of many, many sponsors of Let's Encrypt.

abetterinternet.org/sponsors/

Moving is highly non-viable - it would likely jeopardize at least some of their other funding, and it would be a physical and logistical nightmare. There are elaborate protocols for root key treatment involving recorded ceremonies and tamper-evident bags and such just for key signing - trying to move that all anywhere in the US would be stupidly hard, much less out of the country. It's a non-starter.

What is far more viable is for one or more new orgs to duplicate what Let's Encrypt did and set up a free trusted cert signing service - redundancy here would be welcome. The work of defining a protocol and mechanisms is already done. I just hand-waved away a ton of ugly - but it'd still be far faster and easier than trying to move Let's Encrypt physically out of the US.


Sponsors and Donors

Sponsors and Donors Those who make our work possible. Become a sponsor or donor Let's change the world. Or at least the Internet. A handful of organizations and a few thousand people provide 100% of our funding.
Internet Security Research Group
in reply to Aral Balkan

darq
mastodon - Link to source
darq
• •
zerossl.com/letsencrypt-alternā€¦
Just saying
Yeah it would suck but it wouldn't be the end

Let's Encrypt Alternative - ZeroSSL

Looking for a Let's Encrypt alternative? See how ZeroSSL stacks up against Let's Encrypt by comparing SSL certificate options, product features and pricing.
zerossl.com
in reply to Aral Balkan

darq
mastodon - Link to source
darq
• •
and again I can't see the countless replies, because the fediverse sucks ass
in reply to Aral Balkan

Klaus Frank
mastodon - Link to source
Klaus Frank
• •

We already have multiple European alternatives to @letsencrypt

We have ZeroSSL (Austria) and Buypass Go SSL (Norway).

So no problem here.
#LetsEncrypt

#letsencrypt @Let's Encrypt
Unknown parent

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
@Saupreiss Indeed. But nothing I would base a future system (e.g., the Small Web) on especially when there is a noncommercial alternative (I have no choice but to go commercial right now when it comes to DNS and VPS but the idea is to abstract that away as much as possible by supporting multiple. Easier said than done without standards but I guess thatā€™s where it differs with ACME so, who knows, it might be an idea to support them. But still, we have an opportunity to build a not-for-profit EU ACME certificate provider and we should take it.) :)
@Saupreiss #PrƤparat500 šŸ—½
in reply to Aral Balkan

Paul Campbell
mitra - Link to source
Paul Campbell
• •
There are European alternatives to letsencrypt. I switched to Zerossl, a German company I believe. All I had to do was add acme_ca https://acme.zerossl.com/v2/DV90 to my Caddyfile. Should be just as simple for other servers.
in reply to Paul Campbell

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
@paul AFAIK, theyā€™re all commercial. Letā€™s Encrypt is a not for profit. That matters. We need a non-commercial ACME provider in the EU funded by taxpayer money.
@Paul Campbell
in reply to Aral Balkan

motofix
mastodon - Link to source
motofix
• •
source link in English: heise.de/en/news/After-Trump-sā€¦

After Trump's decree: fight for US funding for Tor, F-Droid and Let's Encrypt

Following a decree by US President Trump, the Open Technology Fund is no longer receiving funding. That is why the organization is now going to court.
Sven Festag (heise online)
in reply to Aral Balkan

mijenix
mastodon - Link to source
mijenix
• •
sure, if they move their operations body into the EU why not
Unknown parent

Aral Balkan
mastodon - Link to source
Aral Balkan
• •
Man, I was wondering what that AGPL thingamabob Iā€™ve been adding to all my projects for at least a decade now was all about :)
This entry was edited (8 months ago)
Unknown parent

Aral Balkan
mastodon - Link to source
Aral Balkan
• •

@opalfrost The threadā€™s broken. This was meant to be a reply to the four freedoms post?

Letā€™s Encrypr runs Boulder, released under MPL: github.com/letsencrypt/boulder

Afaik, everything they do is released under an open source license.


GitHub - letsencrypt/boulder: An ACME-based certificate authority, written in Go.

An ACME-based certificate authority, written in Go. - GitHub - letsencrypt/boulder: An ACME-based certificate authority, written in Go.
GitHub
in reply to Aral Balkan

chrysn
mastodon - Link to source
chrysn
• •

Why move? They publish their tools, and the legal framework needs to be done again anyway. Let's set up a parallel one here.

There are 13 DNS root servers, I think we should have at least two free public certificate authorities. (Or, dun'no, maybe one per continent if the others want to do it too).

in reply to Aral Balkan

šŸ§DaveNullšŸ§ ā˜£ļøpResident Evilā˜£
mastodon - Link to source
šŸ§DaveNullšŸ§ ā˜£ļøpResident Evilā˜£
• •

"But what about funding IA-based innovation" (technofascism)ā€¦

EU probably doesn't give a flying fuck about small webā€¦

@EUCommission @letsencrypt @nlnet

@Let's Encrypt @European Commission @NLnet
in reply to Aral Balkan

šŸ§DaveNullšŸ§ ā˜£ļøpResident Evilā˜£
mastodon - Link to source
šŸ§DaveNullšŸ§ ā˜£ļøpResident Evilā˜£
• •

I wasn't even being sarcastic.

Giving a shitton of public money to technofascists 'because insert some bullshit about Artificial Stupidity" (according to people who don't know shit about computers but suddently decided "IA is the future/wijl improve everything cause marketing people said so") is actually one of the EU goalsā€¦

ec.europa.eu/commission/presscā€¦

@EUCommission @letsencrypt @nlnet


EU launches InvestAI initiative to mobilise ā‚¬200 billion of investment in artificial intelligence

Today, at the Artificial Intelligence (AI) Action Summit in Paris, Commission President Ursula von der Leyen has launched InvestAI, an initiative to mobilise ā‚¬200 billion for investment in AI, including a new European fund of ā‚¬20 billion for AI gigafā€¦
European Commission - European Commission
@Let's Encrypt @European Commission @NLnet
This entry was edited (8 months ago)
Unknown parent

Aral Balkan
mastodon - Link to source
Aral Balkan
• •

@jens @a Agree. mastodon.ar.al/@aral/114228345ā€¦

Aral Balkan

2025-03-26 10:50:21

mastodon - Link to source

So after listening to your feedback, I agree: letā€™s spend that money in the EU to create a publicly-owned, free and open ACME-compatible certificate authority.

See post quoted below, with links to Tomā€™s work as heā€™s already been thinking/working on this.

#EU #ACME #TLS #security #LetsEncrypt #technologyCommons #SmallTech mamot.fr/@tdelmas/114224564125ā€¦


@Jens FinkhƤuser @Alexandre Dulaunoy
ā‡§