Violation of CA/B Forum Baseline Requirements

[Bradatletsencrypt]

Hello,

The key that is linked to at https://traefik.me/privkey.pem has been blocked and the certificates associated with it revoked. Please note that sharing private keys is not acceptable use of our (Let's Encrypt) service and violates both Let's Encrypt policies as well as the policies of the CA/B forum.

For reference, please see the CA/Browser Forum Baseline Requirements -- Section 9.6.3 states:

The Subscriber Agreement or Terms of Use MUST contain provisions imposing on the Applicant itself (or made by the Applicant on behalf of its principal or agent under a subcontractor or hosting service relationship) the following obligations and warranties:
[...]
2. Protection of Private Key: An obligation and warranty by the Applicant to take all reasonable measures to assure control of, keep confidential, and properly protect at all times the Private Key that corresponds to the Public Key to be included in the requested Certificate(s) (and any associated activation data or device, e.g. password or token);
[...]

If we determine a subscriber is ignoring relevant policies we will block issuance for the domain in question.

Thanks!
Brad

[everflux]

I seriously love traefik.me especially for the TLS certificate benefit.
I love LE as well and understand that they might be under pressure to enforce the rules in order to stay the great CA we all love.

So I wonder, could this requirement be met while keeping traefik me as a provider of this great service. (And yeah, show the trolls, that kept reporting traefik.me, a finger.)

Section 9.6.3 only talks about the private key, not about letting people use the certificate. At least this is how I read the language.

Implementation details, like the requirement to host a dynamic backend, bandwidth and provide support in traefik, aside: What do you think about Keyless SSL as a solution?

• https://developers.cloudflare.com/ssl/keyless-ssl/
• https://blog.cloudflare.com/announcing-keyless-ssl-all-the-benefits-of-cloudflare-without-having-to-turn-over-your-private-ssl-keys/
• https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/

Cloudflare opensourced the server and client implementation: https://github.com/cloudflare/gokeyless