Let's Encrypt won its Comodo trademark battle – but now fan tools must rename
Why the popular letsencrypt.sh is now known as Dehydrated
Popular Bash shell script LetsEncrypt.sh, which is used to manage free SSL/TLS certificates from the Let's Encrypt project, has renamed this week to avoid a trademark row.
This comes in the wake of Let's Encrypt successfully fending off Comodo, which tried to cynically snatch "Let's Encrypt" for itself.
LetsEncrypt.sh, written by Germany-based Lukas Schauer, is now known as Dehydrated. If you have scripts or apps that rely on pulling in his code and running it, they may stop working as a result of the name change. Dehydrated is developed independently by Schauer and is not officially affiliated with Let's Encrypt.
"This project was renamed from letsencrypt.sh because the original name was violating Let's Encrypt's trademark policy. I know that this results in quite a lot of installations failing but I didn't have a choice," reads the new Dehydrated README.
Schauer told El Reg this week that the Let's Encrypt project sent him "a very friendly email, asking me very kindly to change the name" of LetsEncrypt.sh, while referencing "their trademark policy and that they didn't want confusion on what really belongs to Let's Encrypt."
"There was no direct threat, but it was very clear that I couldn't keep the name for much longer," Schauer added.
Let's Encrypt issues free security certificates for HTTPS websites, is backed by various big names, and recommends people use the Python-based Certbot to deploy its SSL/TLS certs. Certbot, developed by the EFF, was previously called the Let's Encrypt Client.
In June this year, the Let's Encrypt project was fighting off Comoodo, a paid-for SSL/TLS certificate issuer that was trying to trademark "Let's Encrypt" for itself, presumably so it could snuff out its free-for-all competition.
This is despite the Let's Encrypt project first using the term way back in 2014, and that Comodo has never, er, used the words "let's encrypt" in its product branding.
In July, the Let's Encrypt project prevailed and registered "Let's Encrypt" as a trademark with the US Patent and Trademark Office: it is now mark number 87096675 and belongs to San Francisco's Internet Security Research Group, which runs the organization. It even owns the pseudo mark "Let Us Encrypt" for anyone who hates apostrophe contractions.
With that win comes extra responsibility: trademark holders must use and defend their marks or lose them. If you allow other businesses and groups to use your trademark willy-nilly, it may be considered abandoned by a court.
Thus, the Let's Encrypt project is working on getting as many of the third-party Let's Encrypt tools – like LetsEncrypt.sh – renamed if they feature the words Let's Encrypt in order to actively protect its trademark.
"I did ask [Lukas Schauer] to change the name," Let's Encrypt chief Josh Aas confirmed to The Register this week.
"It's something we need to do in order to protect our trademarks and avoid creating confusion as to where the software comes from. Also, we use an open protocol that we're encouraging other certificate authorities to adopt, and when that happens we want it to be clear that ACME clients can be used with CAs besides Let's Encrypt.
"These are all of the same reasons that we had the name of the official Let's Encrypt client changed to Certbot when it moved to the EFF, and we've been talking to other client projects with similar trademark issues."
"All of that said, we're really grateful for Lukas's contribution to our client ecosystem," Aas added. ®
Full disclosure: This article's author uses Let's Encrypt to provide HTTPS encryption for his personal websites. And you should use it too.
Sponsored: Becoming a Pragmatic Security Leader