Meta tags:

Headings (most frequently used words):

certificates, caa, the, serving, new, encrypt, with, to, supporting, let, intermediates, ecdsa, more, internet, philanthropic, zooming, in, scale, on, three, at, nonprofits, org, we, serve, getting, foundations, what, is, adoption, started, thanks, famedly, us, since, beginning, committed, better, support, our, future, no, sunny, default, hard, or, pinning, of, risks, for, as, questions, sign, cross, x3, ca, root, dst, removing, coding, rotating, delay, from, merge, intermediate, logs, running, tiles, database, bottlenecks, issuance, deployment, changes, minor, other, chains, smaller, providing, work,

Text of the page (most frequently used words):
the (348), and (205), our (142), for (102), #that (81), let (76), #encrypt (76), #with (61), #certificates (60), certificate (56), #this (52), #isrg (51), #from (48), #will (48), are (45), can (42), more (41), have (41), you (41), their (41), intermediates (40), root (38), new (35), your (34), ecdsa (34), org (33), 2023 (33), which (32), intermediate (29), #support (28), chain (28), letsencrypt (27), internet (26), one (26), cross (26), security (25), like (25), https (25), all (24), work (24), log (23), caa (22), subscribers (22), tls (22), 2024 (21), make (21), html (20), sunlight (20), has (20), not (19), who (19), its (19), two (19), sponsor (19), logs (18), but (18), ari (18), over (18), these (17), signed (17), issuance (17), community (17), year (17), sign (16), privacy (16), acme (16), any (16), years (16), also (16), they (16), please (15), been (15), issued (15), people (15), rsa (14), only (14), web (14), about (14), was (14), provide (14), use (14), end (13), than (13), means (13), would (13), trust (13), nonprofit (13), now (12), those (12), each (12), using (12), into (12), project (12), organization (12), there (11), time (11), entity (11), tiles (11), need (11), when (11), 0000 (11), even (11), them (11), client (11), just (11), most (11), possible (11), users (11), what (10), android (10), future (10), transparency (10), made (10), tree (10), key (10), clients (10), every (10), trusted (10), secure (9), had (9), 2020 (9), forward (9), same (9), help (9), impact (9), ask (9), company (9), other (9), sponsors (9), set (9), how (9), because (9), read (9), first (9), uses (9), website (9), benefit (9), while (9), running (8), scale (8), public (8), compatibility (8), individual (8), look (8), chains (8), services (8), getting (8), making (8), group (8), could (8), through (8), million (8), organizations (8), since (8), important (8), change (8), single (8), improve (8), easy (8), default (8), world (8), around (8), without (8), take (8), available (8), part (7), few (7), database (7), focus (7), supporters (7), active (7), api (7), serving (7), both (7), should (7), out (7), get (7), dst (7), changes (7), team (7), dns (7), divvi (7), challenges (7), data (7), consider (7), path (7), domain (7), pinning (7), page (7), nonprofits (7), email (7), widely (7), account (7), funding (7), research (7), contributions (7), implementation (6), three (6), access (6), many (6), store (6), design (6), famedly (6), still (6), comes (6), binding (6), used (6), renewal (6), free (6), 100 (6), may (6), great (6), websites (6), way (6), memory (6), version (6), leaf (6), ensure (6), supporting (6), donation (6), contribution (6), see (6), september (6), rights (6), order (6), depend (6), past (6), thank (6), role (6), very (6), 2015 (6), next (6), started (5), request (5), process (5), providing (5), prossimo (5), respecting (5), include (5), authority (5), sure (5), user (5), software (5), issues (5), infrastructure (5), information (5), expiration (5), some (5), own (5), during (5), within (5), where (5), forum (5), involved (5), action (5), being (5), grateful (5), small (5), thu (5), experience (5), storage (5), mission (5), method (5), come (5), system (5), know (5), staff (5), containing (5), overall (5), makes (5), apis (5), architecture (5), everyone (5), large (5), issuing (5), improving (5), already (5), delay (5), renewing (5), run (5), letter (5), multiple (5), merge (5), annual (5), reliability (5), helping (4), subscriber (4), cdt (4), were (4), good (4), removing (4), keys (4), building (4), google (4), billions (4), transition (4), questions (4), build (4), december (4), philanthropic (4), hash (4), happen (4), currently (4), automated (4), sha (4), ability (4), effort (4), metrics (4), millions (4), report (4), protect (4), issue (4), biggest (4), begin (4), well (4), towards (4), renewed (4), hard (4), anniversary (4), josh (4), level (4), leader (4), election (4), digital (4), built (4), becoming (4), why (4), safe (4), continue (4), extension (4), moving (4), lot (4), documentation (4), check (4), added (4), existing (4), less (4), adoption (4), course (4), projects (4), bit (4), increase (4), avoid (4), expire (4), renewals (4), doesn (4), number (4), longer (4), further (4), march (4), abetterinternet (4), months (4), board (4), best (4), handshakes (4), size (4), working (4), simple (4), want (4), control (4), signal (4), technical (4), including (4), service (4), teams (4), downloading (4), worth (4), keep (4), instead (4), directly (4), post (4), details (4), ahead (4), shorter (4), allows (4), however (4), step (4), earlier (4), ecosystem (4), trillian (4), databases (3), leads (3), opportunities (3), different (3), operational (3), introducing (3), october (3), operation (3), becomes (3), systems (3), submitting (3), safety (3), preserving (3), choice (3), high (3), helps (3), june (3), fortunate (3), list (3), static (3), funders (3), replace (3), feedback (3), www (3), publicly (3), chrome (3), date (3), ten (3), full (3), particularly (3), think (3), limit (3), site (3), efficient (3), recommend (3), along (3), rfc (3), adopting (3), thursday (3), provided (3), potential (3), configure (3), terminating (3), alternate (3), devices (3), efficiency (3), reduce (3), handshake (3), significantly (3), costs (3), too (3), shortening (3), type (3), add (3), join (3), become (3), serve (3), open (3), tradeoff (3), brought (3), big (3), much (3), node (3), short (3), prevent (3), instances (3), aclu (3), vision (3), human (3), shared (3), governance (3), hrw (3), trusting (3), updated (3), policy (3), top (3), stored (3), his (3), craig (3), smaller (3), protects (3), either (3), merkle (3), monitor (3), changed (3), current (3), here (3), foundation (3), thanks (3), beginning (3), 10th (3), critical (3), common (3), production (3), mar (3), supported (3), share (3), development (3), lifetime (3), jan (3), decade (3), needed (3), such (3), sponsorship (3), handle (3), rotating (3), going (3), technology (3), growing (3), conversation (3), created (3), operating (3), better (3), wanted (3), ietf (3), revocation (3), widespread (3), proud (3), cost (3), allow (3), doing (3), hope (3), automatically (3), easily (3), does (3), days (3), 2021 (3), founder (3), identrust (3), event (3), five (3), commented (3), ongoing (3), continuing (3), terms (3), often (3), realize (3), works (3), today (3), ssl (3), renew (3), second (3), then (3), approach (3), gable (2), leadership (2), lived (2), proof (2), 6th (2), close (2), stopped (2), international (2), later (2), 8th (2), promise (2), side (2), browser (2), switch (2), maximum (2), webserver (2), start (2), individuals (2), entries (2), contrast (2), everywhere (2), usage (2), beyond (2), right (2), 30th (2), surveillance (2), eliminating (2), general (2), choose (2), relevant (2), firefox (2), latency (2), secured (2), folks (2), success (2), enhancing (2), aaron (2), six (2), pki (2), stop (2), thing (2), foundations (2), r10 (2), collection (2), gift (2), r14 (2), object (2), encourage (2), called (2), sequence (2), named (2), couldn (2), significant (2), similar (2), offers (2), contains (2), head (2), oak (2), views (2), overloading (2), month (2), robustness (2), per (2), financially (2), setting (2), taking (2), via (2), record (2), face (2), ones (2), answer (2), innovation (2), low (2), shopify (2), ceo (2), visitors (2), certs (2), loads (2), coding (2), anything (2), fast (2), mechanism (2), 8657 (2), review (2), something (2), updating (2), complicated (2), section (2), swap (2), improved (2), filippo (2), remain (2), name (2), write (2), resliiency (2), approaching (2), bytes (2), update (2), allowing (2), huge (2), cryptographically (2), resiliency (2), might (2), closer (2), gain (2), previously (2), addition (2), especially (2), engineer (2), dec (2), eoy (2), percentage (2), last (2), place (2), itself (2), require (2), third (2), enhance (2), splitting (2), caa23 (2), excited (2), another (2), layer (2), shard (2), browsers (2), rely (2), allowed (2), capacity (2), rather (2), continued (2), old (2), fall (2), maybe (2), hostpoint (2), joint (2), bringing (2), gotten (2), fri (2), goal (2), incorporated (2), 2013 (2), announced (2), cryptography (2), relatively (2), recently (2), dev (2), amount (2), agile (2), 2016 (2), field (2), content (2), mature (2), dollars (2), got (2), leading (2), ensures (2), emergency (2), strategy (2), direction (2), comprehend (2), tried (2), maintainers (2), newmark (2), apps (2), ready (2), form (2), looking (2), challenge (2), trustfabric (2), things (2), millionth (2), apr (2), tile (2), introduced (2), pretty (2), others (2), issuer (2), led (2), complex (2), href (2), serves (2), context (2), series (2), kernel (2), contain (2), desire (2), shaping (2), dynamic (2), values (2), linux (2), feel (2), adopted (2), fact (2), february (2), webpki (2), response (2), civil (2), 2019 (2), cached (2), complete (2), monitors (2), philanthropies (2), conducting (2), approves (2), servers (2), nearly (2), option (2), fortune (2), held (2), based (2), giving (2), commitment (2), logging (2), meet (2), scts (2), far (2), case (2), online (2), true (2), stopgap (2), programs (2), mozilla (2), played (2), partnership (2), highly (2), specification (2), don (2), states (2), risk (2), hierarchy (2), emails (2), affected (2), never (2), reasons (2), failure (2), seemed (2), direct (2), cloud (2), engineers (2), publishing (2), domains (2), generated (2), lets (2), changing (2), day (2), united (2), 501 (2), able (2), long (2), ambitious (2), wasn (2), mind (2), 360 (2), encouraging (2), didn (2), leave (2), donating (2), aims (2), 256 (2), opportunity (2), constantly (2), believe (2), known (2), updates (2), frequently (2), wed (2), cache (2), yet (2), needs (2), test (2), practices (2), cas (2), meant (2), backup (2), arranged (2), result (2), entirely (2), ngos (2), focused (2), efforts (2), horizontally, motivated, gracefully, unavailable, failing, requesting, nodes, annually, distributed, file, readily, providers, obvious, somewhat, writing, backed, etcd, front, replaced, simplify, improves, note, storing, objective, writer, twice, idea, exposing, intends, routinely, though, goals, realization, serverless, comments, supportive, spec, cacheable, ecosystems, folding, ctfe, adding, certbot, pins, looks, tooling, mailing, announcement, released, find, resources, depicts, auditors, consuming, usable, requirements, sunny, embed, positive, invitation, diagram, originally, director, aas, parental, filling, brand, donor, pleasure, watching, grow, care, deeply, published, slack, vice, president, amazon, hugo, deploying, financial, learn, contact, channel, final, index, overhead, computing, down, incidents, near, misses, stops, unmerged, missing, alternative, breaking, smallest, independent, power, served, increases, lower, uptime, prefer, compare, applicable, checkpoints, again, accidentally, once, forked, value, slow, seems, verification, following, proofs, fetch, inclusion, requiring, server, lookup, tables, takes, holding, submissions, batches, integrates, hours, whether, worthwhile, cases, limited, submission, feature, return, timestamp, sct, immediately, conventionally, regardless, inexpensively, advisable, expose, speed, continuity, business, errors, pairs, increased, manual, pinned, delegating, decide, backend, connecting, accessibility, wednesday, interesting, informative, tour, practice, outdated, discourages, automation, familiar, encourages, publishes, troubleshooting, experts, subscribe, failures, reduced, tech, 700, increasing, volume, instance, four, daily, exactly, represented, must, logged, separate, established, holds, reflecting, ease, introduce, ground, modern, constraints, broader, sigsum, 384, operators, insights, instrumental, valsorda, scalability, alerts, intend, 2048, drastically, broken, algorithm, truncated, tiny, mentioning, minor, reduces, given, platforms, offer, selected, randomizing, optimize, wings, libraries, waiting, decided, reasonable, largest, configurations, lifetimes, randomized, shouldn, emergencies, historically, impacted, rare, impossible, move, put, oid, exercise, rotation, typically, reserve, deployment, ceremony, mistakes, mirror, keeps, identical, removed, infrequently, cps, policies, remove, exercised, saves, bandwidth, saved, usually, subject, calculated, altogether, steps, hopeful, predict, although, nice, faces, plays, explicitly, structure, binary, elliptic, children, preventing, bug, incompatible, thus, arise, actual, appended, digitally, forms, verifiable, append, curve, initially, planned, problems, discussions, expect, risks, original, robust, scalable, particular, inspired, roots, format, blog, subtree, otherwise, saving, caching, cdn, filesystem, unlike, endpoints, previous, computation, processing, faster, eliminate, leaner, efficiently, compressed, files, internal, elements, opted, unless, hashes, certain, height, pre, russ, cox, after, explanation, included, checksum, pin, performance, shrinking, terabytes, enough, concerning, tue, fail, ran, mysql, 16tib, hasn, trouble, deployed, dates, relational, helped, switching, shards, history, cover, batch, scaled, bottlenecks, replacements, explore, motivation, behind, diversity, between, burden, scaling, limits, requires, incredibly, disks, whose, lots, ram, cheap, numerous, carry, 24th, overloaded, attempting, rate, april, forever, imposed, forced, equivalent, environment, staging, shorten, slowly, aligning, simultaneously, crawl, diminishing, detecting, mis, executive, stack, seamless, harder, generally, november, 2014, intending, highlights, founding, hundreds, urgent, fore, revolutionize, collect, peoples, lives, quantify, standard, simply, passed, eric, rescorla, alex, halderman, peter, eckersley, founded, home, extent, leveraged, launched, 2017, protocol, became, granted, reliably, investments, thrive, primarily, stepped, story, despite, play, degree, swirling, hinders, sense, word, wouldn, servicing, billionth, notification, exposure, covid, starts, donors, merged, rust, 2022, wholeheartedly, whom, partners, subsequent, willingness, exists, follows, preceding, monday, before, expires, least, cycle, migrate, off, requests, endpoint, terminates, soon, feb, roll, extend, breakages, risen, releases, dropping, sent, finally, late, expiring, versions, suddenly, breakage, outlive, onto, occurred, non, arrange, eye, demonstrated, creating, appreciate, understanding, communication, correctly, downloads, installs, modes, seen, coded, buckets, author, statistics, mobile, population, trusts, therefore, installing, operator, above, advice, likely, agent, visits, drop, sudden, strings, taken, exist, jul, equipped, ovhcloud, society, siteground, cyon, vultr, automattic, electronic, frontier, infomaniak, planethoster, discourse, eight, valuable, nowadays, charge, akamai, viewed, audacious, incredible, back, costly, aim, nineteen, came, seventeen, grantmakers, stayed, eighth, markus, gebert, cisco, committed, live, give, say, charitable, actually, vast, majority, sponsorships, donated, moment, quite, literally, together, powered, happier, combined, sizes, interaction, shapes, shops, person, thousands, average, transactional, budget, straightforward, finding, lütke, tobi, gold, fundraising, announce, agility, recall, progress, circumstances, disrupting, adapting, responding, bountiful, job, prepare, threats, exciting, bright, involving, optimization, norm, did, code, prior, major, raise, money, safer, plans, rarely, sudo, media, codecs, ntp, ever, term, sustainability, extenuating, reason, roland, suggestion, shoemaker, submitted, draft, plan, coming, standardized, couple, additional, benefits, modulate, load, spikes, whenever, merely, ideal, revoke, early, normal, scenario, wait, night, middle, possibly, trigger, times, manually, aren, disruption, send, mean, unexpected, mon, according, roster, tella, kristin, berdan, fill, counsel, her, apparent, she, joins, sarah, heil, cfo, newest, defenders, app, matter, document, violations, took, combination, determination, state, lead, brandon, pitman, insight, aspects, behavior, collecting, telemetry, hired, sharing, continues, importance, mitm, attacks, knowledge, private, compromised, barriers, tld, commonly, alone, registered, varied, signify, having, daf, amazing, sponsoring, toward, usefulness, validate, across, assembled, impactful, anyways, operate, collectively, ubiquitous, generosity, relate, lens, horizontal, deliver, stakeholders, excellent, quo, pushing, expectations, ourselves, roadmap, committing, sub, compromise, broadens, universe, develop, cannot, prone, fragility, james, maintaining, renken, balance, ambition, quality, life, observations, absence, class, nervous, embarked, discover, balls, keeping, air, status, responsible, performant, line, components, increasingly, eager, address, problem, evidenced, participation, gathering, hosted, drew, industry, leaders, meanwhile, initiatives, guide, grown, av1, engineering, total, ago, tectonics, invigorated, decoder, ferrous, implement, golf, tweede, firms, ochtman, dirkjan, area, snoopers, missions, 257, authorities, turn, hanging, fruit, sets, validation, methods, http, alpn, demonstrate, specific, handling, integration, owners, specify, names, hearing, proactive, subdomain, under, reactive, verify, intended, authorization, cloudflare, town, sep, touch, parent, seeking, philanthropists, chose, setup, commenting, records, 036, hour, operates, considering, extensions, tenth, campaign, hiccups, highlight, always, respect, closest, provider, supports, manage, healthcare, said, german, signatures, cryptographic, dnssec, grünhage, christian, loophole, 8659, closing, absolutely, remarked, marginal, larger, ocean, necessary, enabling, perspective, advocate, countries, censorship, hastened, measures, obtain, center, democracy, 500, trove, empowering, alike, informed, global, outside, longtime, benefitting, traffic, watch, guardian, liberty, citizens, constituents, trying, american, liberties, union, zooming, fundamental, defender, cto, cyber, philanthropy, defense, national, billion, dollar, hewlett, primary, tool, communicate, areas, yield, silicon, valley, presence, knodel, encrypts, mallory, personal, card, credit, protecting, transaction, intercepted, advance, pages, space, ways, insightful, democratic, promote, reports,

Text of the page (random words):
ate removing a second intermediate and the option to issue an ecdsa end entity certificate from an rsa intermediate the let s encrypt staging environment will make an equivalent change on april 24th 2024 most let s encrypt subscribers will not need to take any action in response to this change because acme clients like certbot will automatically configure the new intermediates when certificates are renewed the subscribers who will be affected are those who currently pins intermediate certificates more on that later the following diagram depicts what the new hierarchy looks like you can see details of all of the certificates on our updated chain of trust documentation page new intermediate certificates earlier this year let s encrypt generated new intermediate keys and certificates they will replace the current intermediates which were issued in september 2020 and are approaching their expiration all certificates issued by both rsa and ecdsa intermediates will be served with a default chain of isrg root x1 rsa or ecdsa intermediate end entity certificate that is all certificates regardless of whether you choose to have an rsa or ecdsa end entity certificate will have one intermediate which is directly signed by the isrg root x1 which is let s encrypt s most widely trusted root the new ecdsa intermediates will also have an alternate chain to isrg root x2 isrg root x2 ecdsa intermediate end entity certificate this is only applicable to a small number of subscribers who prefer the smallest tls handshake possible to use this ecdsa only chain see your acme client s documentation on how to request alternate chains there will not be any alternative chains for the rsa intermediates it is important to note that there will now be multiple active rsa and two active ecdsa intermediates at the same time an rsa leaf certificate may be signed by any of the active rsa intermediates a value from r10 to r14 in the issuer common name field of your certificate and an ecdsa leaf certificate may be signed by any of the active ecdsa intermediates e5 through e9 again your acme client should handle this automatically a certificate authority s intermediate certificates expire every few years and need to be replaced just like a website s certificate is routinely renewed going forward let s encrypt intends to switch what intermediates are in use annually which will help enhance the overall security of the certificates removing dst root ca x3 cross sign the new intermediate chains will not include the dst root ca x3 cross sign as previously announced in our post about shortening the let s encrypt chain of trust by eliminating the cross sign we re making our certificates leaner and more efficient leading to faster page loads for internet users we already stopped providing the cross sign in the default certificate chain on february 8th 2024 so if your acme client is not explicitly requesting the chain with dst root ca x3 this will not be a change for you ecdsa intermediates as default for ecdsa certificates currently ecdsa end entity certificates are signed by our rsa intermediates unless users opted in via a request form to use our ecdsa intermediates with our new intermediates we will begin issuing all ecdsa end entity certificates from the ecdsa intermediates the request form and allow list will no longer be used which we had introduced to make ecdsa intermediates available earlier the default ecdsa chain included two intermediates both e1 and the cross signed isrg root x2 i e isrg root x1 isrg root x2 e1 end entity certificate after the change it will contain only a single intermediate the version of one of our new ecdsa intermediates cross signed by isrg root x1 i e isrg root x1 e5 end entity certificate this ensures that all of our intermediates both rsa and ecdsa are signed directly by our most widely trusted isrg root x1 we expect this change to benefit most users with smaller tls handshakes if compatibility problems with ecdsa intermediates arise we recommend let s encrypt users switch to rsa certificates android 7 0 is known to have a bug preventing it from working with most elliptic curve ec certificates including our ecdsa intermediates however that version of android doesn t trust our isrg root x1 and thus is already incompatible risks of pinning or hard coding intermediates we do not recommend pinning or otherwise hard coding intermediates or roots pinning intermediates is especially not advisable as they change often if you do pin intermediates make sure you have the complete set of new intermediates available here questions we re grateful for the millions of subscribers who have trusted us to carry out best practices to make the web more secure and privacy respecting and rotating intermediates more frequently is one of them we d also like to thank our great community and the funders whose support makes this work possible if you have any questions about this transition or any of the other work we do please ask on our community forum we depend on contributions from our supporters in order to provide our services if your company or organization can help our work by becoming a sponsor of let s encrypt please email us at sponsor letsencrypt org we ask that you make an individual contribution if it is within your means https letsencrypt org 2024 04 12 changes to issuance chains html new intermediate certificates https letsencrypt org 2024 03 19 new intermediate certificates html tue 19 mar 2024 00 00 00 0000 on wednesday march 13 2024 let s encrypt generated 10 new intermediate ca key pairs and issued 15 new intermediate ca certificates containing the new public keys these new intermediate certificates provide smaller and more efficient certificate chains to let s encrypt subscribers enhancing the overall online experience in terms of speed security and accessibility first a bit of history in september 2020 let s encrypt issued a new root and collection of intermediate certificates those certificates helped us improve the privacy and efficiency of web security by making ecdsa end entity certificates widely available however those intermediates are approaching their expiration dates so it is time to replace them our new batch of intermediates are very similar to the ones we issued in 2020 with a few small changes we re going to go over what those changes are and why we made them the new certificates we created 5 new 2048 bit rsa intermediate certificates named in sequence from r10 through r14 these are issued by isrg root x1 you can think of them as direct replacements for our existing r3 and r4 intermediates we also created 5 new p 384 ecdsa intermediate certificates named in sequence from e5 through e9 each of these is represented by two certificates one issued by isrg root x2 exactly like our existing e1 and e2 and one issued or cross signed by isrg root x1 you can see details of all of the certificates on our updated hierarchy page rotating issuance rotating the set of intermediates we issue from helps keep the internet agile and more secure it encourages automation and efficiency and discourages outdated practices like key pinning key pinning is a practice in which clients either acme clients getting certificates for their site or apps connecting to their own backend servers decide to trust only a single issuing intermediate certificate rather than delegating trust to the system trust store updating pinned keys is a manual process which leads to an increased risk of errors and potential business continuity failures intermediates usually change only every five years so this joint is exercised infrequently and client software keeps making the same mistakes shortening the lifetime from five years to three years means we will be conducting another ceremony in just two years ahead of the expiration date on these recently created certificates this ensures we exercise the joint more frequently than in the past we also issued more intermediates this time around historically we ve had two of each key type rsa and ecdsa one for active issuance and one held as a backup for emergencies moving forward we will have five two conducting active issuance two waiting in the wings to be introduced in about one year and one for emergency backup randomizing the selected issuer for a given key type means it will be impossible to predict which intermediate a certificate will be issued from we are very hopeful that these steps will prevent intermediate key pinning altogether and help the webpki remain agile moving forward these shorter intermediate lifetimes and randomized intermediate issuance shouldn t impact the online experience of the general internet user subscribers may be impacted if they are pinning one of our intermediates though this should be incredibly rare providing smaller chains when we issued isrg root x2 in 2020 we decided to cross sign it from isrg root x1 so that it would be trusted even by systems that didn t yet have isrg root x2 in their trust store this meant that subscribers who wanted issuance from our ecdsa intermediates would have a choice they could either have a very short ecdsa only but low compatibility chain terminating at isrg root x2 or they could have a longer high compatibility chain terminating at isrg root x1 at the time this tradeoff tls handshake size vs compatibility seemed like a reasonable choice to provide and we provided the high compatibility chain by default to support the largest number of configurations isrg root x2 is now trusted by most platforms and we can now offer an improved version of the same choice the same very short ecdsa only chain will still be available for subscribers who want to optimize their tls handshakes at the cost of some compatibility but the high compatibility chain will be drastically improving instead of containing two intermediates both e1 and the cross signed isrg root x2 it will now contain only a single intermediate the version of one of our new ecdsa intermediates cross signed by isrg root x1 this reduces the size of our default ecdsa chain by about a third and is an important step towards removing our ecdsa allow list other minor changes we ve made two other tiny changes that are worth mentioning but will have no impact on how subscribers and clients use our certificates we ve changed how the subject key id field is calculated from a sha 1 hash of the public key to a truncated sha 256 hash of the same data although this use of sha 1 was not cryptographically relevant it is still nice to remove one more usage of that broken algorithm helping move towards a world where cryptography libraries don t need to include sha 1 support at all we have removed our cps oid from the certificate policies extension this saves a few bytes in the certificate which can add up to a lot of bandwidth saved over the course of billions of tls handshakes both of these mirror two identical changes that we made for our subscriber certificates in the past year deployment we intend to put two of each of the new rsa and ecdsa keys into rotation in the next few months two of each will be ready to swap in at a future date and one of each will be held in reserve in case of an emergency read more about the strategy in our december 2023 post on the community forum not familiar with the forum it s where let s encrypt publishes updates on our issuance tech and apis it s also where you can go for troubleshooting help from community experts and let s encrypt staff check it out and subscribe to alerts for technical updates we hope that this has been an interesting and informative tour around our new intermediates and we look forward to continuing to improve the internet one certificate at a time we depend on contributions from our community of users and supporters in order to provide our services if your company or organization would like to sponsor let s encrypt please email us at sponsor letsencrypt org we ask that you make an individual contribution if it is within your means https letsencrypt org 2024 03 19 new intermediate certificates html introducing sunlight a ct implementation built for scalability ease of operation and reduced cost https letsencrypt org 2024 03 14 introducing sunlight html thu 14 mar 2024 00 00 00 0000 let s encrypt is proud to introduce sunlight a new implementation of a certificate transparency log that we built from the ground up with modern web pki opportunities and constraints in mind in partnership with filippo valsorda who led the design and implementation we incorporated feedback from the broader transparency logging community including the chrome and trustfabric teams at google the sigsum project and other ct log and monitor operators their insights have been instrumental in shaping the project s direction ct plays an important role in the web pki enhancing the ability to monitor and research certificate issuance the operation of a ct log however faces growing challenges with the increasing volume of certificates for instance let s encrypt issues over four million certificates daily each of which must be logged in two separate ct logs our well established oak log currently holds over 700 million entries reflecting the significant scale of these challenges in this post we ll explore the motivation behind sunlight and how its design aims to improve the robustness and diversity of the ct ecosystem while also improving the reliability and performance of let s encrypt s logs bottlenecks from the database let s encrypt has been running public ct logs since 2019 and we ve gotten a lot of operational experience with running them but it hasn t been trouble free the biggest challenge in the architecture we ve deployed for our oak log is that the data is stored in a relational database we ve scaled that up by splitting each year s worth of data into a shard with its own database and then later shrinking the shards to cover six months instead of a full year the approach of splitting into more and more databases is not something we want to continue doing forever as the operational burden and costs increase the current storage size of a ct log shard is between 5 and 10 terabytes that s big enough to be concerning for a single database we previously had a test log fail when we ran into a 16tib limit in mysql scaling read capacity up requires large database instances with fast disks and lots of ram which are not cheap we ve had numerous instances of ct logs becoming overloaded by clients attempting to read all the data in the log overloading the database in the process when rate limits are imposed to prevent overloading clients are forced to slowly crawl the api diminishing ct s efficiency as a fast mechanism for detecting mis issued certificates serving tiles initially let s encrypt only planned on building a new ct log implementation however our discussions with filippo made us realize that other transparency systems had improved on the original certificate transparency design and we could m...