0
I'm looking for a description how to property secure, backup, restore etc Letsencrypt certificates, and how to recover if a server containing such certificates was hacked. Does such a description exist?
Here are some of the questions I'm puzzled about:
It appears that letsencrypt has the notion of an "account" with private keys, but appears there is no problem if some other account wishes to obtain a cert for an already-existing hostname. (Then there are two different keys/certs in the wild for the same hostname at the same time.) Just what is that account for?
Then, just who exactly can revoke a certificate, and what information is needed to do so? (I have not tried to do this.) If the account private key is needed, this would mean I can't revoke a cert if my server was taken over and I have not created an off-site backup of my account credentials (does anybody ever backup Letsencrypt data?) If it isn't needed, anybody can revoke anything, which hopefully is not true. Or is the revocation security also driven by DNS resolution verification?