<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 24, 2020, at 3:15 PM, Robert Goldman <<a href="mailto:rpgoldman@sift.info" class="">rpgoldman@sift.info</a>> wrote:</div><div class=""><div class=""><blockquote type="cite" class="">David Reitter</blockquote><blockquote type="cite" class=""> Suggest disabling HTTPS on the website for now.<br class=""></blockquote><br class="">I'm not a big fan of using HTTP, especially not for getting software I trust.<br class=""></div></div></blockquote><div><br class=""></div>We had this discussion a few weeks ago, but. I fully understand your point, but in this case I wouldn’t worry about it much, because the software itself is signed. The whole point of that mechanism is that you don’t have to secure the channel because the s/w itself is crypto-validated.</div><div><br class=""></div><div>That said,</div><div><br class=""></div><div><blockquote type="cite" class=""><div class=""><div class="">Can't we add the Let's Encrypt CA to the set of CAs we will accept?<br class=""></div></div></blockquote><div><br class=""></div>I was wondering about this too. LE certs trace back to two separate rather well-known roots - see <a href="https://letsencrypt.org/certificates/" class="">https://letsencrypt.org/certificates/</a> for full details. If Aquamacs is maintaining it’s own root CA store (not great), then adding one of these should be simple enough. OTOH, what it should really be doing is using Apple’s built-in certificate management functions and root store. But if it was doing that, this would all be working, I would expect. So I assume it’s not..</div><div><br class=""></div><div>John</div><div><br class=""></div></body></html>