LE has to comply with the root CA standards too. For a variety of reasons there haven't been as many problems with LE - partly because they don't get paid by folks getting certs and issuing certs is a cost to them so their incentives are different.
I don't get entrust here. It's not like they weren't told what to do.
Simplicity is a shortcut to correctness. Let's Encrypt is a simple thing to implement. Relatively speaking of course. It would be tempting (unbearably so for a for-profit issuer) to have manual issuance, this means at least duplicating the effort as every system can also be manual and must have the appropriate checks in place for that.
As an example of how wedded Let's Encrypt is to simplicity, part of routine application process is to show your certificates expire properly, often a CA would manually create a certificate which either was already expired (back dating it but arguably this is allowed for technical procedures) or had a very short lifetime and so would expire by the time the trust programme examines the demo cert. Let's Encrypt instead issued an ordinary 90 day certificate, using the same automatic process as their subscribers - and then just waited months for it to expire. Like a boss.
Comments
LE has to comply with the root CA standards too. For a variety of reasons there haven't been as many problems with LE - partly because they don't get paid by folks getting certs and issuing certs is a cost to them so their incentives are different.
I don't get entrust here. It's not like they weren't told what to do.
Simplicity is a shortcut to correctness. Let's Encrypt is a simple thing to implement. Relatively speaking of course. It would be tempting (unbearably so for a for-profit issuer) to have manual issuance, this means at least duplicating the effort as every system can also be manual and must have the appropriate checks in place for that.
As an example of how wedded Let's Encrypt is to simplicity, part of routine application process is to show your certificates expire properly, often a CA would manually create a certificate which either was already expired (back dating it but arguably this is allowed for technical procedures) or had a very short lifetime and so would expire by the time the trust programme examines the demo cert. Let's Encrypt instead issued an ordinary 90 day certificate, using the same automatic process as their subscribers - and then just waited months for it to expire. Like a boss.