We made it so everyone has to use short term rolling certificates that expire super quickly… for security!
You’ll never guess what happened next!
How about we build a service that ignores the US sanctions and instead honours the United Nations sanctions?
It’s much easier said than done. Anyone can start a new Certificate Authority but for it to be useful internationally it (its public key) needs to be built-in to (trusted by) all of the popular web browsers, the largest of which are all controlled by US companies.
While that’s absolutely a consideration, it’s hardly an insurmountable issue.
Would that change the list of sanctioned countries meaningfully?
Yes. It would be by global consensus rather than at the whim of an individual.
Here’s the latest list I could find, and they’re clearly not the same.
https://www.sanctionscanner.com/blog/list-of-sanctioned-countries-by-ofac-un-and-eu-2025-1103
effectively making it useless by doing whatever is the fascist bidding.
effectively making it useless
do you know what Let’s Encrypt is? it is very far from useless; the system it is a part of is very flawed but it’s how the web works currently and US sanctions restricting access to it is absurd.
yup. i’ve used their services, but there is no point if they can sanction what probably amounts to half the world off of it.
I don’t follow how a useful thing becomes “useless” or “no point” just because millions of people are unjustly denied access to it.
Fwiw Let’s Encrypt was just the first but isn’t actually the only free ACME provider anymore; acme.sh has a list of other providers in its readme and there is another list here. Actalis is Italian apparently; unfortunately I think the rest might be ultimately US-based (ZeroSSL says it’s Austrian but it’s owned by a US company).
It would be nice if some more independent country (eg, China) who already has one or more CAs trusted by all major browsers would step up and start offering free certs to the world.
It’s worth noting that HTTPS is needed not only for its confidentiality and authenticity properties, but also is required by browsers for pages to be allowed to use modern features like WebRTC (needed to have a voice or video call from a web page).
Building infrastructure around something so vulnerable to be abused that way contributes to the problem.
