I'm pretty sure that the .org TLD can be shut off by the US at any point in time.

That’s not relevant though. These CAs will gladly give you a .se/.dk/.in/whatever cert as long as validation passes.

I hope so, but can we really be sure that .se or .de would still work in such a scenario? Is the TLD root management really split up vertically or is the (presumably US-based) TLD parent organization also the final authority for every country TLD?

It would be nice to at least have a very high level contingency plan because in worst case I won't be able to google it.

▲

cpach 8 hours ago | parent [-]

Not sure what the exact concern is here. So far, virtually all countries on Earth are still represented in DNS. Venezuela, Iran, Somalia, etc etc.

You can also read a lot of anti-Trump articles and comments on countless web-sites, some under .com and some under other top-domains. As lunatic as Trump is, he hasn’t shut that down.

“Is the TLD root management really split up vertically”

AFAIK, yes, it is.

But if the global DNS would somehow break down I guess you either have to find an alternative set of root servers. Or communicate outside of the regular Internet. Such an event surely would shock the global economy.

	▲	bflesch 7 hours ago \| parent [-]
		That's actually a really good point. Totally missed it.

▲

iso1631 9 hours ago | parent | prev [-]

Lets Encrypt do not control the US president.

You could argue that The Don in charge of the US is in control of letsencrypt

▲

alwillis 4 hours ago | parent | next [-]

> You could argue that The Don in charge of the US is in control of letsencrypt

He's not in control of letsencrypt or any other US-based CA.

It may not be well known, but Trump's administration loses about 80% of the time when they've been sued by companies, cities and states.

There's much more risk of state-sponsored cyber attacks against US companies.

▲

bflesch 8 hours ago | parent | prev [-]

Yeah, it's a bit far fetched but after Cloudflare CEO basically threatening to cut off Italy I was wondering what would happen if US really invades Greenland.

A simple windows to linux migration is not enough. If certificates expire without a way to refresh you'd either need to manually touch every machine to swap root certificates or have some of other contingency plan.

	▲	cpach 7 hours ago \| parent [-]
		Remember that there are lots of CAs, and quite many of them are based outside of the US. Those CAs currently do not offer ACME services for free, but there’s nothing stopping them from doing so. I would say that the WebPKI system seems to be quite resilient, even in the face of strong geopolitical tension.