Let's Encrypt won its Comodo trademark battle – but now fan tools must rename

Why the popular letsencrypt.sh is now known as Dehydrated

Popular Bash shell script LetsEncrypt.sh, which is used to manage free SSL/TLS certificates from the Let's Encrypt project, has renamed this week to avoid a trademark row.

This comes in the wake of Let's Encrypt successfully fending off Comodo, which tried to cynically snatch "Let's Encrypt" for itself.

LetsEncrypt.sh, written by Germany-based Lukas Schauer, is now known as Dehydrated. If you have scripts or apps that rely on pulling in his code and running it, they may stop working as a result of the name change. Dehydrated is developed independently by Schauer and is not officially affiliated with Let's Encrypt.

"This project was renamed from letsencrypt.sh because the original name was violating Let's Encrypt's trademark policy. I know that this results in quite a lot of installations failing but I didn't have a choice," reads the new Dehydrated README.

Schauer told El Reg this week that the Let's Encrypt project sent him "a very friendly email, asking me very kindly to change the name" of LetsEncrypt.sh, while referencing "their trademark policy and that they didn't want confusion on what really belongs to Let's Encrypt."

"There was no direct threat, but it was very clear that I couldn't keep the name for much longer," Schauer added.

Let's Encrypt issues free security certificates for HTTPS websites, is backed by various big names, and recommends people use the Python-based Certbot to deploy its SSL/TLS certs. Certbot, developed by the EFF, was previously called the Let's Encrypt Client.

In June this year, the Let's Encrypt project was fighting off Comoodo, a paid-for SSL/TLS certificate issuer that was trying to trademark "Let's Encrypt" for itself, presumably so it could snuff out its free-for-all competition.

This is despite the Let's Encrypt project first using the term way back in 2014, and that Comodo has never, er, used the words "let's encrypt" in its product branding.

In July, the Let's Encrypt project prevailed and registered "Let's Encrypt" as a trademark with the US Patent and Trademark Office: it is now mark number 87096675 and belongs to San Francisco's Internet Security Research Group, which runs the organization. It even owns the pseudo mark "Let Us Encrypt" for anyone who hates apostrophe contractions.

With that win comes extra responsibility: trademark holders must use and defend their marks or lose them. If you allow other businesses and groups to use your trademark willy-nilly, it may be considered abandoned by a court.

Thus, the Let's Encrypt project is working on getting as many of the third-party Let's Encrypt tools – like LetsEncrypt.sh – renamed if they feature the words Let's Encrypt in order to actively protect its trademark.

"I did ask [Lukas Schauer] to change the name," Let's Encrypt chief Josh Aas confirmed to The Register this week.

"It's something we need to do in order to protect our trademarks and avoid creating confusion as to where the software comes from. Also, we use an open protocol that we're encouraging other certificate authorities to adopt, and when that happens we want it to be clear that ACME clients can be used with CAs besides Let's Encrypt.

"These are all of the same reasons that we had the name of the official Let's Encrypt client changed to Certbot when it moved to the EFF, and we've been talking to other client projects with similar trademark issues."

"All of that said, we're really grateful for Lukas's contribution to our client ecosystem," Aas added. ®

Full disclosure: This article's author uses Let's Encrypt to provide HTTPS encryption for his personal websites. And you should use it too.

Similar topics

Broader topics

Other stories you might like

  • Telegram adds paid tier as it cracks 700 million users
    Without so much as a mention of encryption, but with a pastel-hued emoji-heavy nod to ‘sustainable monetization’

    Messaging app Telegram, which came to prominence for offering end-to-end encryption that irritated governments, has celebrated passing 700 million active monthly users with a pastel-hued announcement: a paid Premium tier of service.

    A Sunday post celebrates the 700 million user milestone by announcing a $4.99/month tier. The Premium tier distinguishes itself from the freebie plebeian tier with the ability to upload 4GB files, unthrottled downloads that come as fast as users' carriers will allow, and the chance to follow up to 1000 channels, create up to 20 chat folders each containing up to 200 chats, and to run four accounts in the Telegram app.

    Paying punters will also get exclusive stickers and reactions and won't see ads once they sign up to hand over coin each month.

    Continue reading
  • Protecting data now as the quantum era approaches
    Startup QuSecure is the latest vendor to jump into the field with its as-a-service offering

    Analysis Startup QuSecure will this week introduce a service aimed at addressing how to safeguard cybersecurity once quantum computing renders current public key encryption technologies vulnerable.

    It's unclear when quantum computers will easily crack classical crypto – estimates range from three to five years to never – but conventional wisdom is that now's the time to start preparing to ensure data remains encrypted.

    A growing list of established vendors like IBM and Google and smaller startups – Quantum Xchange and Quantinuum, among others – have worked on this for several years. QuSecure, which is launching this week after three years in stealth mode, will offer a fully managed service approach with QuProtect, which is designed to not only secure data now against conventional threats but also against future attacks from nation-states and bad actors leveraging quantum systems.

    Continue reading
  • Cheers ransomware hits VMware ESXi systems
    Now we can say extortionware has jumped the shark

    Another ransomware strain is targeting VMware ESXi servers, which have been the focus of extortionists and other miscreants in recent months.

    ESXi, a bare-metal hypervisor used by a broad range of organizations throughout the world, has become the target of such ransomware families as LockBit, Hive, and RansomEXX. The ubiquitous use of the technology, and the size of some companies that use it has made it an efficient way for crooks to infect large numbers of virtualized systems and connected devices and equipment, according to researchers with Trend Micro.

    "ESXi is widely used in enterprise settings for server virtualization," Trend Micro noted in a write-up this week. "It is therefore a popular target for ransomware attacks … Compromising ESXi servers has been a scheme used by some notorious cybercriminal groups because it is a means to swiftly spread the ransomware to many devices."

    Continue reading

Biting the hand that feeds IT © 1998–2022