2

Agreement: https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf

Section of interest:

BY WAY OF FURTHER EXPLANATION REGARDING THE SCOPE OF THE DISCLAIMER, AND WITHOUT WAIVING OR LIMITING THE FOREGOING IN ANY WAY, ISRG DOES NOT MAKE, AND ISRG EXPRESSLY DISCLAIMS, ANY WARRANTY REGARDING ITS RIGHT TO USE ANY TECHNOLOGY, INVENTION, TECHNICAL DESIGN, PROCESS, OR BUSINESS METHOD USED IN EITHER ISSUING LET’S ENCRYPT CERTIFICATES OR PROVIDING ANY OF ISRG’S SERVICES. YOU AFFIRMATIVELY AND EXPRESSLY WAIVE THE RIGHT TO HOLD ISRG RESPONSIBLE IN ANY WAY, OR SEEK INDEMNIFICATION AGAINST ISRG, FOR ANY INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, INCLUDING PATENT, TRADEMARK, TRADE SECRET, OR COPYRIGHT.

It sounds like if I use a Let's Encrypt certificate, then they can steal my Intellectual Property on the site and I have no recourse. Certainly that cannot be true.

Can you help me understand how to properly read this section?

4

First, lets look at the entire section:

4.4 IMPORTANT DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITY

EXCEPT AS EXPRESSLY SET FORTH IN ISRG’S CERTIFICATE POLICY AND CERTIFICATE PRACTICE STATEMENT, LET’S ENCRYPT CERTIFICATES AND SERVICES ARE PROVIDED “AS-IS” AND ISRG DISCLAIMS ANY AND ALL WARRANTIES OF ANY TYPE, WHETHER EXPRESS OR IMPLIED, INCLUDING AND WITHOUT LIMITATION ANY IMPLIED WARRANTY OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE, IN CONNECTION WITH ANY ISRG SERVICE OR LET’S ENCRYPT CERTIFICATE.

BECAUSE LET’S ENCRYPT CERTIFICATES ARE ISSUED FREE-OF-CHARGE AS A PUBLIC SERVICE, ISRG CANNOT ACCEPT ANY LIABILITY FOR ANY LOSS, HARM, CLAIM, OR ATTORNEY’S FEES IN CONNECTION WITH SUCH CERTIFICATES. ACCORDINGLY, YOU AGREE THAT ISRG WILL NOT BE LIABLE FOR ANY DAMAGES, ATTORNEY’S FEES, OR RECOVERY, REGARDLESS OF WHETHER SUCH DAMAGES ARE DIRECT, CONSEQUENTIAL, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR COMPENSATORY, EVEN IF ISRG HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION ON LIABILITY APPLIES IRRESPECTIVE OF THE THEORY OF LIABILITY, I.E., WHETHER THE THEORY OF LIABILITY IS BASED UPON CONTRACT, WARRANTY, INDEMNIFICATION, CONTRIBUTION, TORT, EQUITY, STATUTE OR REGULATION, COMMON LAW, OR ANY OTHER SOURCE OF LAW, STANDARD OF CARE, CATEGORY OF CLAIM, NOTION OF FAULT OR RESPONSIBILITY, OR THEORY OF RECOVERY. THE PARTIES AGREE THAT THIS DISCLAIMER IS INTENDED TO BE CONSTRUED TO THE FULLEST EXTENT ALLOWED BY APPLICABLE LAW.

BY WAY OF FURTHER EXPLANATION REGARDING THE SCOPE OF THE DISCLAIMER, AND WITHOUT WAIVING OR LIMITING THE FOREGOING IN ANY WAY, ISRG DOES NOT MAKE, AND ISRG EXPRESSLY DISCLAIMS, ANY WARRANTY REGARDING ITS RIGHT TO USE ANY TECHNOLOGY, INVENTION, TECHNICAL DESIGN, PROCESS, OR BUSINESS METHOD USED IN EITHER ISSUING LET’S ENCRYPT CERTIFICATES OR PROVIDING ANY OF ISRG’S SERVICES. YOU AFFIRMATIVELY AND EXPRESSLY WAIVE THE RIGHT TO HOLD ISRG RESPONSIBLE IN ANY WAY, OR SEEK INDEMNIFICATION AGAINST ISRG, FOR ANY INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, INCLUDING PATENT, TRADEMARK, TRADE SECRET, OR COPYRIGHT.

The first part that you notice is that in the first section is this sentence:

LET’S ENCRYPT CERTIFICATES AND SERVICES ARE PROVIDED “AS-IS” AND ISRG DISCLAIMS ANY AND ALL WARRANTIES OF ANY TYPE, WHETHER EXPRESS OR IMPLIED, INCLUDING AND WITHOUT LIMITATION ANY IMPLIED WARRANTY OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE,

Which basically says that "we won't provide any statement to guarantee that our services/certificates don't infringe on another work, or that they are fit for your particular use".

The real point of this indemnification section is in the second paragraph:

BECAUSE LET’S ENCRYPT CERTIFICATES ARE ISSUED FREE-OF-CHARGE AS A PUBLIC SERVICE, ISRG CANNOT ACCEPT ANY [...]

They are too poor to afford lawyers, so they are saying that you must agree not to sue them if you suffer any damages as a result of using the service/certificates. This is not a license granted by you to steal anything you don't expressly give them license to do so.

Let's take an example:

Let's Encrypt (LE) gives you (Customer) a certificate. That certificate, knowingly or unknowingly, infringes upon a patent owned by XYZ. XYZ sues LE and the judge orders LE to revoke all certificates using XYZ technology. Your site is now shown as unsafe and your payment process doesn't work. You lose $100k in revenue getting your site back up with another certificate company. According to this agreement, you cannot sue LE for that.

XYZ could go even further and sue you, even though you unknowingly had been using that patent. Again you can't turn around and sue LE to recover anything XYZ recovers from you (or even the fees you spend to win).

What you are not granting to LE is a right to "steal" any technology on any site/system that the certificate or service is used on. This agreement, in its entirety, is between LE and you for the use of LE services/certificates. Even if LE somehow steals from you, this would not indemnify them for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.