2

Is it possible to register my onion with LetsEncrypt? I'm using Arch.

If no, why not?

Thanks!

Improve this question

4 Answers 4

Reset to default
2

You cannot.

Currently only EV certs that are valid for both some canonicle domain and an onion address are able to have TLS certificates issued but not an onion address alone, and not non-EV certificates.

This is essentially a policy thing internal to the CA/Browser forum.

From Ryan Sleevi's response to Alec Muffett asking the same question:

"- At Google, we were (and are) concerned with the cryptographic strength of the .onion naming scheme, which employs both SHA-1 and RSA-1024."

"- Related to that first point, the choice of EV discourages attackers making such cryptographic attacks against sites operating .onion sites, as it requires some form of identity validation of who the attacker is, even if they have the cryptographic resources to mount such an attack."

"- While this is a position that we (Google) generally disagree with, many CAs feel that it should be their responsibility to police subscriber's content and revoke certificates whose content they (or their governments) disagree with."

Further reading: "onion address support", "Letsencrypt for .onion?"

Improve this answer
2
  • fortunately, this is no longer accurate.
    – Michael Altfield
    Commented Nov 28, 2020 at 18:47
  • Onion services can now register SSL certificates for Onion services.
    – Swangie
    Commented Mar 16, 2021 at 22:16
2

As of February 2020, this is now technically possible, but it has yet to be implemented by Let's Encrypt.

Why https for .onion domains?

First, I think it's necessary to point out that there are non-security-related, logistical reasons for why you'd want to add a valid TLS cert for a website served on an onion service: there are many tools/protocols that are designed to stubbornly refuse to work over http.

Even though a service is securely hosted through a .onion on http, it may not be possible to get existing services working over an onion service domain without using https and a valid cert.

Moreover, it can be non-trivial to point a .onion at existing websites without serving them over https, and just getting a cert for your .onion sites may be the easiest way to bring your existing websites up on the tor network.

Ballot SC27v3: Version 3 Onion Certificates

In early 2020, a proposal (Ballot SC27v3: Version 3 Onion Certificates) was presented to the CA/Browser Forum, requesting CAs to be able to issue EV & OV certificates for v3 .onion domains. It passed unanimously in February 2020.

ETA for Let's Encrypt?

At the time of writing, Let's Encrypt's ACME protocol does not support issuing certificates for the .onion domain, but there is a ticket open to add this feature.

The ticket linked-above specifically mentions that they aren't sure if there's enough demand for this feature to warrant allocating resources to implement issuing certs for .onion domains. So, if this is important to you, then I recommend adding a +1 to the ticket linked above ;)

...And maybe add a comment on why this is important to you if you have another use-case that hasn't yet been considered.

Non-free CAs

You can view a list of all the Onion Services with https certificates here:

Notable Certificate Authorities that sell certificates with support for .onion sites include:

  1. DigiCert
  2. Hellenic Academic and Research Institutions CA
  3. Commercié Extended Validation Server CA
Improve this answer
1

As of March 2021, it appears the HARICA, a certificate authority based in Greece, also allows you to obtain an SSL certificate for a .onion domain. While HARICA offers them cheaper,

To quote their website, one of the types of certificates they offer is listed as

SSL DV Onion (Domain Validated - Onion): SSL/TLS Server Certificate that includes one or more RFC 7686 ".onion" special-use Domain Names (e.g. www.4gmrlefxkq4mtan6a2lqwfwa7un4brjlatka75nwdczemqqwn3wznnad.onion, mysite.4gmrlefxkq4mtan6a2lqwfwa7un4brjlatka75nwdczemqqwn3wznnad.onion)

I would still buy a certificate from DigiCert if you need to prove your organization's ownership of an onion site as HARICA does not appear to offer EV certificates for .onion sites.

Note: I would have added this answer as a comment to @Michael Altfield's great answer above, but I do not have sufficient reputation to do so.

Improve this answer
0

It's an open question: is it good that you can't have a SSL certificate for your onion? The truth is that the organizations selling you them now are regulated and can be enforced to shut them down, so - IMHO - only a decentralized CA can do the job properly. Try looking at EmerSSL - it's an Emercoin built-in technology that can do this in a correct way: you're issuing your certificate and publishing it's public data in a decentralized manner, so no one can shut it down

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .