No worries! Every time I see a Let's Encrypt thread on HN, there's always complaining about having to trust the official client with root access, webserver configs, dependencies, or whatever. So I made my clients (letsencrypt-nosudo, gethttpsforfree.com, acme-tiny) to shut those people up. My clients are not intended to serve the wider Let's Encrypt target audience, who probably don't know what a CSR is. But for those who do, I made clients that don't ask for the access/trust that the official client needs to serve its target audience.

Thanks for making Let's Encrypt and ACME!

Maybe you can consider getting someone at Let's Encrypt review diafygi's acme-tiny code and, if approved, propose it as an alternative on the Let's Encrypt site. This will be very useful for users who get turned off by the root requirement or the number of dependencies.

The TL;DR of that is:

1. DNSSEC uses a lot of 1024-bit RSA signatures (those are relatively weak) 2. You can't monitor the certificates that CA's issue because anyone issue their own certificates.

The first issue seems valid, but fixable. The second is a weird thing to complain about because it is the entire point of DANE!

HPKP is entirely complementary to DANE.

The short story is that it's part of the root now, which is something resolvers ship with.

Let's Encrypt's closed beta is no longer accepting new applicants [0], but they are launching the public beta in just under 2 hours (6PM GMT/10AM PST)[1] at the time of this writing.

[0]: https://community.letsencrypt.org/t/beta-program-announcemen...

[1]: https://letsencrypt.status.io/pages/maintenance/55957a99e800...

I signed up for a few domains early on and they were enabled, I signed up for two more two days ago but haven't heard back yet.

I doubt they're even going to approve any more in the next hour and a half before they flip it to the public beta.

Let's Encrypt is cross-signed by IdenTrust, not Entrust.