I want Nico to win simply for the Sky postrace show . <| sep |> RIP freedom of speech . Sad . <| sep |> What a surprise , the New York Times still working as a mouth piece for NeoLiberal sentiments . <| sep |> What you ' re describing could happen to literally any cert authority . There ' s a reason why a certificate transparency organisationtransparency . orgfaq exists , so that any maliciously issued certs are known about immediately . You can ' t insert a new certificate into a chain of trust without literally everyone knowing about it . Without the cert chain , issued certs won ' t be valid so you have to publish it publically . At most one month later , the attacker can read everything on any connection that uses the let ' s encrypt automated update system . This kind of proves you don ' t understand how TLS works . There ' s no way for Let ' s Encrypt or any CA to eavesdrop on TLS communications from certificates they ' ve issued . When you connect to a server as a client , a keyexchange is performed . The server passes you some secret data , you pass it some secret data and the connection is encrypted . The certificate only proves the server is who they say they are the actual encryption is between client and server . At best , the worst someone can do is issue themselves a fraudulent cert to MITM between the client and the server , but this also has issues see point one about Cert transparency . Secondly , you don ' t need to wait 30 days for this to happen , the second you issue yourself a cert , you can masquerade as someone else . Effectively , your reasons for blocking LetsEncrypt are unfounded and , at best , misguided . Using the same logic , you should block ALL certificate authorities and only trust your own certs .