9 ms·
Sslip.io: A Valid SSL Certificate for Every IP Address
- omh 11y agoFrom what I can see this uses the same public/private key for everyone using the service. So it would be easy to MITM any HTTPS connection using this if you're a network admin or hostile WiFi etc. I don't think this is a problem for the intended audience - developers and test sites. But there should perhaps be a clear warning somewhere about not using this in production. EDIT: Turns out this is actually mentioned on the FAQ page of https://sslip.io/ https://sslip.io/
- JosephRedfern 11y agoI'm not suggesting that this makes it acceptable to use in production - but am I right in thinking that you'd be unable to MITM the connection if the server/client both support perfect forward secrecy?
- brohee 11y agoSomeone that intercepts the traffic act as a proxy and will just PFS with the client and the server. Confidentiality should be ensured by PFS if the attacker is only sniffing. But so many scenarios where even an unsophisticaded attacker can do more that is is not worth thinking about.
- JosephRedfern 11y agoThat makes perfect sense - thanks.
- krikulis 11y agoIt should have NOT SECURE written in big red letters - everyone has your private key, so there is no security at all.
- deleted 11y ago[deleted]
- EngineerBetter 11y agoIt's very clearly stated on the project's website: "sslip.io's primary purpose is to assist developers who need to test against valid SSL certs, not to safeguard content." "Although there's no technical reason why you couldn't use the sslip.io SSL key and certificate for your commerce web, we strongly recommend against it: the key is publicly available; your traffic isn't secure."
- regecks 11y agoI wonder what that scenario even is, where you need a trusted certificate and are also (for some reason?) unable to use the mechanisms widely available in environments (either OS or language/API) to trust a testing certificate. This seems like a very silly service to operate, and as remarked by others, I guess the certificate will be revoked soon because the private key data is out there. Mostly surprised that this wasn't obvious to a company like Pivotal from the first moment.
- jgrahamc 11y agoSo, these guys bought a COMODO wildcard certificate and then stuck it (public and PRIVATE parts) on Github for anyone to download. Wonder how long before COMODO revokes this cert? If you have a test domain you can stick it on CloudFlare and get a certificate for free without the private part becoming public.
- brohee 11y agoThat it's nor revoked yet doesn't reflect well on COMODO at all, not that it's the first thing that doesn't...
- 0x0 11y agoCame here to say the same thing. Doesn't the CA forum baseline require a revocation if the private key is published? https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.pdf https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.p... on page 18: The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs: (...) 3. The CA obtains evidence that the Subscriber’s Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise or no longer complies with the requirements of Appendix A;
- yrro 11y agoHm, how is that compatible with Startcom's policy of charging for revocation?
- 0x0 11y agoGood question. Maybe you can skip the fee by posting your private key to pastebin and send them the link? :P Might not leave you with an account in good standing with them though ;)
- TheLoneWolfling 11y agoThat has been tried before: https://web.archive.org/web/20140412085458/https://revokame.tonylampada.com.br/ https://web.archive.org/web/20140412085458/https://revokame....
- ck2 11y agoWhile I despise the SSL cartel, there are many problems with this attempt at a solution. Let's Encrypt began testing their free SSL certificates this week and will formally launch November 16th (two months from now) https://letsencrypt.org/2015/08/07/updated-lets-encrypt-launch-schedule.html https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun... However they have no plans for wildcards and you have to renew every 90 days (automation possible). They also do not have their intermediate certificate working yet (but will have to by November). But if you do not need wildcards, the StartSSL free certificate has been an option for a long time: http://www.startssl.com/?app=33 http://www.startssl.com/?app=33 (startssl works in all browsers and has a 1 year renewal)
- wereHamster 11y ago> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time And if you need a wildcard cert, startssl will give you any number of those for just 50$.
- throwaway2048 11y agogee how benevolent of them
- gurrone 11y agowhile I in general also disagree with the whole CA thing one has to admit that running a CA is not for free. That setting up the auditing, buying a HSM, running the interfaces and so on. And last but not least running the CRL/OCSP infrastructure. From my point of view the main part you pay a good CA for is that they run the OCSP service. Though with OCSP stapling that burden is a bit relaxed.
- wereHamster 11y agostartssl covers the cost of their labor, not the cost of a 'license' to use the certificate. Their cost is validating your identity, which is a one time thing. They call you, ask a few questions and that's it. 10 minutes of their and your time. After that you are entitled to create as many certificates as you want. There's one caveat: the validation is only for one year, you have to renew it when your certificates are about to expire. Even if you have just one domain, it's cheaper than the alternatives. If you have multiple domains, startssl is much cheaper.
- digital-rubber 11y agoAnd who maintains the keyfile(s)? What is this for a scam? sslip.. security slip(ped)?
- EngineerBetter 11y agoBecause people seem to be missing it, here's a quote from the project website: "sslip.io's primary purpose is to assist developers who need to test against valid SSL certs, not to safeguard content."
- viraptor 11y agoI don't think they're missing it. It's a bad idea and you can have your own valid certificate for free from many companies. Or for test, you can create your own cert in 2 lines of bash. (and add the ca to trusted store, so it's just as valid as this one) For testing purposes you can also generate your certs valid only for a few hours/days, so you can be sure they never get used in production by accident. And with proper SAN entries.
- radiac 11y agoExactly - there's no need for a service like this when you can have self-signed certificates. Create a CA cert to distribute across your team, then use it to sign host, wildcard and SAN certs as needed. If you need to share your site with people who don't have your CA cert, it's time to get a real one. In case it helps anyone, I wrote an openssl wrapper with a simple syntax to manage self-signed CAs: https://github.com/radiac/caman https://github.com/radiac/caman
- brohee 11y agoThat statement will totally prevent bad guys from using the trusted cert to scam...
- Dylan16807 11y agoI don't see how 'bad guys' are helped by having a working cert for 1-2-3-4.weirdacronym.io Would you care to elaborate? They could get a free cert other places, and even look like a real domain.
- brohee 11y ago
- dsr_ 11y ago> RAM is not stressed: of the 1015MiB of RAM, 182MiB are free, and only 6MiB of swap is used. We typically don't worry about RAM on Linux systems until the swap space used exceeds twice the physical RAM That's a bad metric. The question is rarely "does this machine use too much swap". The problem comes when performance is degraded because pages that were evicted out to disk are now needed again, and those processes wait for I/O. swapin and swapout are the relevant figures. edit: (If you're only using 6M of swap, it doesn't really matter, of course. But if a system uses any substantial amount of swap, you want to check rate, not quantity.)
- deleted 11y ago[deleted]
- seiji 11y agoYes, that is quite a strange recommendation and the recommendation of "until the swap space used exceeds twice the physical RAM" is really crazy. The best recommendation for production servers is to disable your swap/page file completely then just let your entire system crash on OOM. Often times it's better to have a dead system (you do have HA and auto-failover, right?) than to let difficult-to-track-down "slowness" into real time systems.
- Dylan16807 11y agoIf your failover doesn't take extreme slowdowns into account, you've still screwed up. It's more complicated than just turning off swap. Even without swap, when you run extremely low on memory the page cache will be squeezed to nothing and you'll thrash. And I don't think there's a way to set a minimum page cache on Linux. So in other words, I would not rely on the OOM killer ever kicking in. In a situation with more memory use over time a small swap can act as a canary, letting you know you're nearing a performance drop, while a swapless server could suddenly hit a molasses wall without dying.
- aidenn0 11y agoThrashing the page cache is typically much less horrible than swap thrashing, so swap off is still an improvement. If you want a canary, why not just directly monitor the page cache size?
- SirFatty 11y agoHow about an IP address for every person?
- comboy 11y agoyou mean IPv6?
- BrianCunnie 11y agoI personally am very interested in IPv6, but the regular expression notation is more complex than IPv4: IPv4 has four decimals separated by dots; IPv6 has as many as 8 double-byte hex characters, sometimes as few as one (e.g. ::1). Plus, other than myself, I know few people who regularly use IPv6. It's not an intractable problem; I just wasn't ready to put the effort into it.
- eudoxus 11y agoMore like 1 IP for every atom in the universe.
- jakeogh 11y agoI got curious... looks like we need IPv8 for that... estimates put it around 10^78, so 2^256 wont even do.
- brian_cunnie 11y agoI personally am very interested in IPv6, but the regular expression notation is more complex than IPv4: IPv4 has four decimals separated by dots; IPv6 has as many as 8 double-byte hex characters, sometimes as few as one (e.g. ::1). Plus, other than myself, I know few people who regularly use IPv6. It's not an intractable problem, merely one that I suspect no one would use.
- PC-Hawk 11y agoThat didnt take long... Secure Connection Failed An error occurred during a connection to 52-0-56-137.sslip.io. Peer's Certificate has been revoked.
- jason_madigan 11y agoCert has been revoked
- joshstrange 11y agoI've tried to find this info multiple times but what cert will work for: domain.com sub1.domain.com sub2.sub1.domain.com I'd love to buy one cert for my main domain and then be able to secure "infinite" depth of subs but every place I've contacted said that doesn't work yet they seem to have done just that...
- timdorr 11y agoThere's a section in the article about how they use dashes instead of dots to separate octals in the IP. That way the wildcard cert covers those subdomains because they are only one level deep.
- joshstrange 11y agoAhh, I'm an idiot. Thank you for pointing that out to me. xip.io uses dots and so my brain just assumed dots on this one was well. I still would be very interested in finding a provider that did this or gave a reasonable number of domains on the cert. Though wildcard on subs is what I really want without having to buy one for each sub so I can do: .server1.joshstrange.com .server2.joshstrange.com etc...
- stouset 11y agoProviders can't do this, because browsers implement an RFC that doesn't allow multi-level wildcards.
- joshstrange 11y agoYeah, I've read this previously. It seems odd to me, I feel like I should be able to do this, I own the domain and I want to secure everything underneath it... sigh I guess I'll have to settle for a cert that allows for lots of domains under it and just have to create a different cert for each domain.
- teraflop 11y agoAFAIK, all major browsers follow RFC 6125 which says that only single-level wildcards are supported. https://tools.ietf.org/html/rfc6125#section-6.4.3 https://tools.ietf.org/html/rfc6125#section-6.4.3 https://bugzilla.mozilla.org/show_bug.cgi?id=646613 https://bugzilla.mozilla.org/show_bug.cgi?id=646613 https://code.google.com/p/chromium/issues/detail?id=70517 https://code.google.com/p/chromium/issues/detail?id=70517 Your best bet is probably to wait for Let's Encrypt to be generally available, so that you can automatically generate a separate certificate for every hostname.
- vog 11y agoNice hack, but: What's preventing them from resolving YOUR-IP.sslip.io to a completely different IP address that delivers some malware to you? EDIT: Changed "your users" to "you"
- swills 11y agoFurther evidence that the SSL/TLS model of combining transport security and trust is broken.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- devy 11y agosslip.io wildcard SSL certificate has been revoked! http://i.imgur.com/IyYEJNm.png http://i.imgur.com/IyYEJNm.png
- digital-rubber 11y agohttp://blog.pivotal.io/pivotal-labs/labs/ntp-server-costing-500year http://blog.pivotal.io/pivotal-labs/labs/ntp-server-costing-... the intelligence just oozes
- BrianCunnie 11y agoAs you can probably tell, Comodo revoked our certificate this morning. For those interested in rolling your own, we recommend getting your own wildcard certificate and deploying your nameservers: https://github.com/cloudfoundry-community/xip-release#deploying-a-custom-version-of-xip-to-amazon-aws https://github.com/cloudfoundry-community/xip-release#deploy... In the interim, we plan to see if there's a way we can accomplish what we want without violating the terms of agreement. Thanks for the interest,
- hoers 11y agoHow about convincing the big browser vendors (e.g. through their bugtrackers) to finally accept CACerts without warning? Such a shame that.
- minizatic 11y agoJust a heads up, @BrianCunnie, you are dead. I'm not sure why. I don't see anything in the comment history to justify shadowbanning, maybe someone with more insight into how and why people are banned can elaborate. Sorry this is top-level, you can't directly reply to dead comments.
- brian_cunnie 11y agoThanks mini. I'm not sure why they banned me (I used a link in my first post?), but they let me create another account, and am now using that one.
- dang 11y agoNot banned; your new accounts set off a spam filter. Sorry. We marked them both legit and restored all the comments. Should be fixed now.