Is it possible to register my onion with LetsEncrypt? I'm using Arch.

If no, why not?



You cannot.

Currently only EV certs that are valid for both some canonicle domain and an onion address are able to have TLS certificates issued but not an onion address alone, and not non-EV certificates.

This is essentially a policy thing internal to the CA/Browser forum.

From Ryan Sleevi's response to Alec Muffett asking the same question:

"- At Google, we were (and are) concerned with the cryptographic strength of the .onion naming scheme, which employs both SHA-1 and RSA-1024."

"- Related to that first point, the choice of EV discourages attackers making such cryptographic attacks against sites operating .onion sites, as it requires some form of identity validation of who the attacker is, even if they have the cryptographic resources to mount such an attack."

"- While this is a position that we (Google) generally disagree with, many CAs feel that it should be their responsibility to police subscriber's content and revoke certificates whose content they (or their governments) disagree with."

Further reading: "onion address support", "Letsencrypt for .onion?"

Your Answer

