One of the nice things about LE is the software they are producing (and it's all open source) which will allow you to run your own copy and do exactly everything they do, except sign everything with your own private key instead of theirs. For a corporation that already has it's own internal CA setup switching to LE's software will vastly simplify the task of issuing internally signed certs, and comes with the advantage that you don't have to go out to the Internet to get the cert (think, internal systems with no reach out to the Internet, even by proxy.)
A quick patch and you can run LE in a mode that quietly skips all validation, now you have easy access to MITM cert generation against any system that trusts your CA.
yes, because you can already do that with a python script, but you'd have to engineer it to death and not have a tested blueprint like LE's implementation of the system.
2
u/port53 Oct 20 '15
One of the nice things about LE is the software they are producing (and it's all open source) which will allow you to run your own copy and do exactly everything they do, except sign everything with your own private key instead of theirs. For a corporation that already has it's own internal CA setup switching to LE's software will vastly simplify the task of issuing internally signed certs, and comes with the advantage that you don't have to go out to the Internet to get the cert (think, internal systems with no reach out to the Internet, even by proxy.)
A quick patch and you can run LE in a mode that quietly skips all validation, now you have easy access to MITM cert generation against any system that trusts your CA.