1

Is it possible to use Let's Encrypt to generate a certificate for an .onion address?

From what I read, it is currently not supported, but I wonder whether there are technical reasons preventing it, or are there other (non-technical) objections against giving out certificates for a hidden service?

Improve this question
0

1 Answer 1

Reset to default
0

As far as I know, this is simply not necessary because Tor Hidden Services/Onion Services work like this: Tor connection is encrypted all the way from the user PC to the Onion Server, HTTP is only used as local loopbacks on these devices Since the HTTP is only exposed locally between the Tor client and the other application (on the same device), securing this by using HTTPS instead would not do much to improve the overall security. The entire connection between the two devices and trough the Tor network is already encrypted. Some more infos can be found at https://www.torproject.org/docs/tor-onion-service so if you haven't done so already, make sure to read that.

Improve this answer
5
  • It is true that offering https is less for security reasons as the traffic is already end-to-end encrypted between the client and the hidden service. Still, there are other benefits of supporting https. For instance, Facebook set up a certificate for its hidden service: digicert.com/blog/anonymous-facebook-via-tor
    – Philipp Claßen
    Jan 16, 2018 at 20:58
  • @PhilippClaßen As far as I understand the DigiCert Blog post you linked, the main reason to use an SSL certificate on a hidden service is to make users able to verify that they are connecting to the legitimate service they want to connect to (no typo in the url etc.). However, the most helpful approach here (and the approach Facebook has taken) is to use an Extended Validation certificate where the company's name is displayed in the address bar, but Let's Encrypt does not issue EV certificates.
    – d0min0r4bb1t
    Jan 16, 2018 at 21:28
  • 2
    Onion services need not terminate on the same system that the onion service operates from, they may traverse the internet or local network, I have seen this done on some onion services (and they didn't use HTTPS, so the plaintext traffic was exposed). There could be good reason for applying transport encryption to onion traffic.
    – cacahuatl
    Jan 16, 2018 at 22:52
  • 1
    In addition to the reasons mentioned, many web-based CMS systems one would want to host as an onion service require using HTTPS, thus leaving no room for a any HTTP-only deployment, with or without the protections of an onion service.
    – huertanix
    Oct 3, 2018 at 5:28
  • @cacahuatl if an onion service "terminates" outside of Tor, the responsibility of encrypting that traffic falls on the service operator and cannot be ensured in any way by the connection within tor being HTTPS
    – pzkpfw
    Apr 19, 2021 at 9:03

Not the answer you're looking for? Browse other questions tagged .