When more and more webservers installs the letsencrypt client to have free letsencrypt certs, I was just thinking.
Are the letsencrypt client(s) audited? Can they have malicious code in them?
When more and more webservers installs the letsencrypt client to have free letsencrypt certs, I was just thinking.
Are the letsencrypt client(s) audited? Can they have malicious code in them?
Let's encrypt publishes an API. Anyone can write a client for that API, including one with malware. You don't have to ask permission, you can sit down and make it without asking any one.
The reccomended client, certbot, can be assumed to be reasonably vetted, and while not guaranteed to be bug free, there's very very low likelihood of intentional malware in it.
The reason it can be trusted is that it's a rather popular piece of software, with contributions from many persons, and an equal amount of persons peering at the software, and in addition EFF have a good reputation.
EDIT: I misread the original question, thinking it was talking about clients as people who use letsencrypt instead of clients as programs that retrieve letsencrypt certificates automatically.
I'll leave this here in case a future reader is similarly confused.
Original Answer:
Just because a website has https, does not guarantee their website is safe or secure.
In the case of letsencrypt, they only verify the client's ability to control the domain. (Either through http or through DNS records)
Essentially, you can think of https as only ensuring you get the person you were looking for, and ensuring that communication between you and them is encrypted.
https does nothing to protect you from maliciousness on that person's part.
As an aside, sometimes you'll see Extended Validation certificates. (The green bar ones) These are verified more, but still not to the audit stage. Only to verify that there is a legitimate company behind the URL. letsencrypt does not offer the EV service.