Is it possible to register my onion with LetsEncrypt? I'm using Arch.
If no, why not?
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.Sign up to join this community
Currently only EV certs that are valid for both some canonicle domain and an onion address are able to have TLS certificates issued but not an onion address alone, and not non-EV certificates.
This is essentially a policy thing internal to the CA/Browser forum.
"- At Google, we were (and are) concerned with the cryptographic strength of the .onion naming scheme, which employs both SHA-1 and RSA-1024."
"- Related to that first point, the choice of EV discourages attackers making such cryptographic attacks against sites operating .onion sites, as it requires some form of identity validation of who the attacker is, even if they have the cryptographic resources to mount such an attack."
"- While this is a position that we (Google) generally disagree with, many CAs feel that it should be their responsibility to police subscriber's content and revoke certificates whose content they (or their governments) disagree with."
As of February 2020, this is now technically possible, but it has yet to be implemented by Let's Encrypt.
First, I think it's necessary to point out that there are non-security-related, logistical reasons for why you'd want to add a valid TLS cert for a website served on an onion service: there are many tools/protocols that are designed to stubbornly refuse to work over http.
Even though a service is securely hosted through a
.onion on http, it may not be possible to get existing services working over an onion service domain without using https and a valid cert.
Moreover, it can be non-trivial to point a
.onion at existing websites without serving them over https, and just getting a cert for your
.onion sites may be the easiest way to bring your existing websites up on the tor network.
In early 2020, a proposal (Ballot SC27v3: Version 3 Onion Certificates) was presented to the CA/Browser Forum, requesting CAs to be able to issue EV & OV certificates for v3
.onion domains. It passed unanimously in February 2020.
At the time of writing, Let's Encrypt's ACME protocol does not support issuing certificates for the
.onion domain, but there is a ticket open to add this feature.
The ticket linked-above specifically mentions that they aren't sure if there's enough demand for this feature to warrant allocating resources to implement issuing certs for
.onion domains. So, if this is important to you, then I recommend adding a +1 to the ticket linked above ;)
...And maybe add a comment on why this is important to you if you have another use-case that hasn't yet been considered.
As far as I know, the only way to get an https cert for a
.onion domain at this time is with DigiCert.
As of March 2021, it appears the HARICA, a certificate authority based in Greece, also allows you to obtain an SSL certificate for a .onion domain. While HARICA offers them cheaper,
To quote their website, one of the types of certificates they offer is listed as
SSL DV Onion (Domain Validated - Onion): SSL/TLS Server Certificate that includes one or more RFC 7686 ".onion" special-use Domain Names (e.g. www.4gmrlefxkq4mtan6a2lqwfwa7un4brjlatka75nwdczemqqwn3wznnad.onion, mysite.4gmrlefxkq4mtan6a2lqwfwa7un4brjlatka75nwdczemqqwn3wznnad.onion)
I would still buy a certificate from DigiCert if you need to prove your organization's ownership of an onion site as HARICA does not appear to offer EV certificates for .onion sites.
Note: I would have added this answer as a comment to @Michael Altfield's great answer above, but I do not have sufficient reputation to do so.