5 ms·

Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to s

by jaas 3mo ago

Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. This subscriber agreement update was intended to better reflect our legal requirements. It does not reflect a major change in the service we provide. Our compliance program does evolve over time, and part of that is communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that. > That said, pretty sure this is stems from the insane US legal requirement to not export SSL technology to enemy countries. I'm sure some of y'all are old enough to remember when web browsers came in "international friendly" versions that supported 40 bit encryption, or "fancy secure" versions with 128 bit encryption. It doesn't.

notamario 3mo ago
When you say “our legal requirements” do you mean requirements LE imposes in its agreements or requires imposed on LE by governments?
- jaas 3mo ago
  I was referring to the requirements imposed on us. When it comes to sanctions, we do not block anything more than what is required by law.
  - marcus_holmes 3mo ago
    The current US government sanctions political enemies [0]. Wouldn't the more rational response to this legal situation be to leave the USA and move somewhere more willing to respect international law? [0] https://www.whitehouse.gov/presidential-actions/2025/02/imposing-sanctions-on-the-international-criminal-court/ https://www.whitehouse.gov/presidential-actions/2025/02/impo...
    - JuniperMesos 3mo ago
      Why would other countries be less likely to impose sanctions on their political enemies?
      - fc417fc802 3mo ago
        I can't answer why or why not but just in terms of track record the US is fairly egregious. The executive attempts to coerce individual UN officials via sanctions. While it may not be strictly illegal it is clearly flagrantly unethical.
    - bawolff 3mo ago
      > move somewhere more willing to respect international law? Some of these sanctions are required by international law (i.e. sanctions imposed by UNSC). For the other ones, international law generally lets countries have whatever trade policy they see fit including sanctions, unless they violate some other rule of international law or treaty obligation.
      - marcus_holmes 3mo ago
        Sanctioning the ICC obviously has nothing to do with trade policy. The USA signed the Rome Statute but never ratified it, and then withdrew its signatory status. There's an argument to be made that there was a treaty obligation there, but it's pretty weak.
        bawolff 3mo ago
        I personally think sanctioning the ICC judges is a disgusting act. However ultimately all sanctions are decisions to refrain from trading with someone, so it is in a sense a trade policy. I think what you're getting at is that usa is implementing that policy to obtain a political/diplomatic goal, which is true, but you could say the same about most trade policies. I think article 18(a) of the vienna convention of the law of treaties means that once you withdraw your signature, you no longer have any obligations in regards to the treaty. Maybe you could make some sort of argument that the sanctions violate the purpose of the geneva convention as they are designed to prevent bringing to justice people accused of grave breaches of the geneva convention. Like its an attempt to frustrate the application of article 49 of the first geneva convention [Ianal]
  - hdgvhicv 3mo ago
    By whose law? Thailand? China? Germany? Afghanistan?
FireBeyond 3mo ago
> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. The agreement very plainly says otherwise: > You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions The general population of those countries are absolutely "persons" "located in" a "country or territory that is the target of comprehensive U.S. sanctions." > communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that. This tries to frame it as a comprehension issue. It's not. The wording in your agreement is actually quite clear. I think it's reckless, if not disingenuous to frame this as "we really only mean government entities". Apropos of anything else, it's also not how US sanctions work - they are absolutely aimed at both the populace as well as the government itself.
- rootnod3 3mo ago
  Came here to quote exactly that paragraph.
- chme 3mo ago
  I assumed that they meant that they will not enforce it via technical means.
- jstanley 3mo ago
  It may be the case that "most of" their sanctions-related blocks apply only to governments (let's say there are 100 such blocks), while they still disallow usage by persons located in a country or territory that is the target of comprehensive US sanctions (let's say there are 50).
- undecisive 3mo ago
  They have "clarified" elsewhere on here that the normal citizenry get a legal exemption [waves hands mystically] somehow, and that they're only blocking people when they legally have to. Obviously (to the rest of us) if the agreement says otherwise, then they're saying that it's LE that is forbidding the citizens of these countries, and it's not (entirely) the government's fault, which completely contradicts what they're trying to say. We should probably be clear that this document is most likely a backside-covering exercise; it exists so that people can't sue LE for denial of service without a just cause, and so that the US can't prosecute them for intentionally shipping cryptographic services, or some such rubbish. If you live entirely outside the US legal system, or its multifaceted tendrils, and if you don't make too much noise, you may be fine. Obviously that's a far cry from a "right to free speech" level of protection, but then LE have no obligation to provide that to people outside the US, and arguably non-rich citizens within the US lost that a long time ago.
CobrastanJorji 3mo ago
Thanks for responding, and to clarify, I am confident that Let's Encrypt is shared as widely as they are able. Could you explain what that requirement does stem from?
morpheuskafka 3mo ago
You issued a certificate for North Korea's email infrastructure as recently as six days ago: https://crt.sh/?id=26878583197 https://crt.sh/?id=26878583197 (06/04/2026 smtp.star-co.net.kp) https://crt.sh/?id=20256841119 https://crt.sh/?id=20256841119 (08/11/2025 *.star.net.kp) Star Joint Venture is the manager of the .kp TLD and one of DPRK's two email providers (the other is silibank.net.kp) [1], used as the official email for various government bodies ex. ipa817@star-co.net.kp (IP Office), kscost@star-co.net.kp (Sci/Tech Commission), ksf@star-co.net.kp (Ministry of Culture and Sports), mhs-ip@star-co.net.kp (Atomic Energy). It is also widely used by those universities and companies that engage with the outside world. How did you determine that issuing a certificate to this domain or any .kp domain was compliant with the general ban on exporting goods and services to DPRK?
- throwaway2037 3mo ago
  This is incredible. How did you find these certs?
  - morpheuskafka 3mo ago
    I only noticed the star net one (not sure if it’s even in use) when writing this. I noticed the Pyongyang Zoo (which shares an IP with the Architects Society—one on 443 and one on 80 lmao) first, just from flipping through their very small IP space on Shodan. You can see them all on crt.sh, because LE has to upload them to a CT log for browsers to trust them. (That’s how most of those subdomain finder websites work too.) The email servers seem to have gotten certs from a for profit CA back in 2015, but I’m not sure if they ever used them. Most of their webspace seems to be HTTP only. (And it’s a good thing, because some of their Apache versions are potentially old enough to have Heartbleed.) The architects website has some pretty cool PDF magazines btw. They also have several websites for their insurance company’s (perhaps some intl org needs them to have a website for listing)—that’s a core hard currency stream for them and they previously have been accused of submitting false losses.
    - qingcharles 3mo ago
      Thank you. Had to go looking for these magazines. http://www.koreanarchitecture.gov.kp/index.php?kt=TWFnYXppbmVBcmNoaXRlY3Q=&lang=ZQ== http://www.koreanarchitecture.gov.kp/index.php?kt=TWFnYXppbm...
cpud36 3mo ago
> Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. > Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. It doesn't work that way. Blocking governments from getting certs doesn't hurt them in the slightest. The government can just create their own pki. But it hurts the general population instead. People do not live in vacuum, they still need to access government sites. And thus people are forced to install root certificates of questionable trust. When Let's Encrypt blocks government entities, it instead puts respective vulnerable population in even less secure environment. Although, given the current events, I am not sure Let's Encrypt continues to deserve the trust it had.

by jaas 3mo ago

notamario 3mo ago

When you say “our legal requirements” do you mean requirements LE imposes in its agreements or requires imposed on LE by governments?

jaas 3mo ago
I was referring to the requirements imposed on us. When it comes to sanctions, we do not block anything more than what is required by law.
- marcus_holmes 3mo ago
  The current US government sanctions political enemies [0]. Wouldn't the more rational response to this legal situation be to leave the USA and move somewhere more willing to respect international law? [0] https://www.whitehouse.gov/presidential-actions/2025/02/imposing-sanctions-on-the-international-criminal-court/ https://www.whitehouse.gov/presidential-actions/2025/02/impo...
  - JuniperMesos 3mo ago
    Why would other countries be less likely to impose sanctions on their political enemies?
    - fc417fc802 3mo ago
      I can't answer why or why not but just in terms of track record the US is fairly egregious. The executive attempts to coerce individual UN officials via sanctions. While it may not be strictly illegal it is clearly flagrantly unethical.
  - bawolff 3mo ago
    > move somewhere more willing to respect international law? Some of these sanctions are required by international law (i.e. sanctions imposed by UNSC). For the other ones, international law generally lets countries have whatever trade policy they see fit including sanctions, unless they violate some other rule of international law or treaty obligation.
    - marcus_holmes 3mo ago
      Sanctioning the ICC obviously has nothing to do with trade policy. The USA signed the Rome Statute but never ratified it, and then withdrew its signatory status. There's an argument to be made that there was a treaty obligation there, but it's pretty weak.
      - bawolff 3mo ago
        I personally think sanctioning the ICC judges is a disgusting act. However ultimately all sanctions are decisions to refrain from trading with someone, so it is in a sense a trade policy. I think what you're getting at is that usa is implementing that policy to obtain a political/diplomatic goal, which is true, but you could say the same about most trade policies. I think article 18(a) of the vienna convention of the law of treaties means that once you withdraw your signature, you no longer have any obligations in regards to the treaty. Maybe you could make some sort of argument that the sanctions violate the purpose of the geneva convention as they are designed to prevent bringing to justice people accused of grave breaches of the geneva convention. Like its an attempt to frustrate the application of article 49 of the first geneva convention [Ianal]
- hdgvhicv 3mo ago
  By whose law? Thailand? China? Germany? Afghanistan?

FireBeyond 3mo ago

> Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. The agreement very plainly says otherwise: > You are not a person or entity that is: (a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions The general population of those countries are absolutely "persons" "located in" a "country or territory that is the target of comprehensive U.S. sanctions." > communicating about it better in our terms of service. It's clear from some of the comments here that we have more work to do to make that text more understandable, we'll work on that. This tries to frame it as a comprehension issue. It's not. The wording in your agreement is actually quite clear. I think it's reckless, if not disingenuous to frame this as "we really only mean government entities". Apropos of anything else, it's also not how US sanctions work - they are absolutely aimed at both the populace as well as the government itself.

rootnod3 3mo ago
Came here to quote exactly that paragraph.
chme 3mo ago
I assumed that they meant that they will not enforce it via technical means.
jstanley 3mo ago
It may be the case that "most of" their sanctions-related blocks apply only to governments (let's say there are 100 such blocks), while they still disallow usage by persons located in a country or territory that is the target of comprehensive US sanctions (let's say there are 50).
undecisive 3mo ago
They have "clarified" elsewhere on here that the normal citizenry get a legal exemption [waves hands mystically] somehow, and that they're only blocking people when they legally have to. Obviously (to the rest of us) if the agreement says otherwise, then they're saying that it's LE that is forbidding the citizens of these countries, and it's not (entirely) the government's fault, which completely contradicts what they're trying to say. We should probably be clear that this document is most likely a backside-covering exercise; it exists so that people can't sue LE for denial of service without a just cause, and so that the US can't prosecute them for intentionally shipping cryptographic services, or some such rubbish. If you live entirely outside the US legal system, or its multifaceted tendrils, and if you don't make too much noise, you may be fine. Obviously that's a far cry from a "right to free speech" level of protection, but then LE have no obligation to provide that to people outside the US, and arguably non-rich citizens within the US lost that a long time ago.

CobrastanJorji 3mo ago

Thanks for responding, and to clarify, I am confident that Let's Encrypt is shared as widely as they are able. Could you explain what that requirement does stem from?

morpheuskafka 3mo ago

You issued a certificate for North Korea's email infrastructure as recently as six days ago: https://crt.sh/?id=26878583197 https://crt.sh/?id=26878583197 (06/04/2026 smtp.star-co.net.kp) https://crt.sh/?id=20256841119 https://crt.sh/?id=20256841119 (08/11/2025 *.star.net.kp) Star Joint Venture is the manager of the .kp TLD and one of DPRK's two email providers (the other is silibank.net.kp) [1], used as the official email for various government bodies ex. ipa817@star-co.net.kp (IP Office), kscost@star-co.net.kp (Sci/Tech Commission), ksf@star-co.net.kp (Ministry of Culture and Sports), mhs-ip@star-co.net.kp (Atomic Energy). It is also widely used by those universities and companies that engage with the outside world. How did you determine that issuing a certificate to this domain or any .kp domain was compliant with the general ban on exporting goods and services to DPRK?

throwaway2037 3mo ago
This is incredible. How did you find these certs?
- morpheuskafka 3mo ago
  I only noticed the star net one (not sure if it’s even in use) when writing this. I noticed the Pyongyang Zoo (which shares an IP with the Architects Society—one on 443 and one on 80 lmao) first, just from flipping through their very small IP space on Shodan. You can see them all on crt.sh, because LE has to upload them to a CT log for browsers to trust them. (That’s how most of those subdomain finder websites work too.) The email servers seem to have gotten certs from a for profit CA back in 2015, but I’m not sure if they ever used them. Most of their webspace seems to be HTTP only. (And it’s a good thing, because some of their Apache versions are potentially old enough to have Heartbleed.) The architects website has some pretty cool PDF magazines btw. They also have several websites for their insurance company’s (perhaps some intl org needs them to have a website for listing)—that’s a core hard currency stream for them and they previously have been accused of submitting false losses.
  - qingcharles 3mo ago
    Thank you. Had to go looking for these magazines. http://www.koreanarchitecture.gov.kp/index.php?kt=TWFnYXppbmVBcmNoaXRlY3Q=&lang=ZQ== http://www.koreanarchitecture.gov.kp/index.php?kt=TWFnYXppbm...

cpud36 3mo ago

> Let's Encrypt continues to be available to almost every vulnerable population in the world, including those that need it most. I say almost as I'm hesitant to speak in absolutes regarding a topic as complex as this. > Most of our sanctions-related blocks apply only to the governments of certain sanctioned countries, not their general population. It doesn't work that way. Blocking governments from getting certs doesn't hurt them in the slightest. The government can just create their own pki. But it hurts the general population instead. People do not live in vacuum, they still need to access government sites. And thus people are forced to install root certificates of questionable trust. When Let's Encrypt blocks government entities, it instead puts respective vulnerable population in even less secure environment. Although, given the current events, I am not sure Let's Encrypt continues to deserve the trust it had.