4 ms·

While I despise the SSL cartel, there are many problems with this attempt at a solution. Let's Encrypt began testing their free SSL certificates this week and

by ck2 11y ago

While I despise the SSL cartel, there are many problems with this attempt at a solution. Let's Encrypt began testing their free SSL certificates this week and will formally launch November 16th (two months from now) https://letsencrypt.org/2015/08/07/updated-lets-encrypt-launch-schedule.html https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun... However they have no plans for wildcards and you have to renew every 90 days (automation possible). They also do not have their intermediate certificate working yet (but will have to by November). But if you do not need wildcards, the StartSSL free certificate has been an option for a long time: http://www.startssl.com/?app=33 http://www.startssl.com/?app=33 (startssl works in all browsers and has a 1 year renewal)

wereHamster 11y ago
> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time And if you need a wildcard cert, startssl will give you any number of those for just 50$.
- throwaway2048 11y ago
  gee how benevolent of them
  - gurrone 11y ago
    while I in general also disagree with the whole CA thing one has to admit that running a CA is not for free. That setting up the auditing, buying a HSM, running the interfaces and so on. And last but not least running the CRL/OCSP infrastructure. From my point of view the main part you pay a good CA for is that they run the OCSP service. Though with OCSP stapling that burden is a bit relaxed.
  - wereHamster 11y ago
    startssl covers the cost of their labor, not the cost of a 'license' to use the certificate. Their cost is validating your identity, which is a one time thing. They call you, ask a few questions and that's it. 10 minutes of their and your time. After that you are entitled to create as many certificates as you want. There's one caveat: the validation is only for one year, you have to renew it when your certificates are about to expire. Even if you have just one domain, it's cheaper than the alternatives. If you have multiple domains, startssl is much cheaper.
- ck2 11y ago
  Actually it is $60 now - and the signup process for wildcards requires heavy duty validation - IDs, passports, corporation documents and other things are sometimes requested.
  - wereHamster 11y ago
    I wouldn't call that heavy duty. Sending them a scan of your passport or ID (which you already have somewhere on file...) is hardly too much to ask for. It didn't take me more than 10 minutes. And they'll even call you back to validate the information on a sunday! (which I think is impressive)
regecks 11y ago
> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time: In fact, the free StartSSL Class 1 DV certificates are only available for non-commercial purposes. They DO enforce this, I have had a cert turned down by their "CertMaster" because they considered it part of a commercial operation. That is why Let's Encrypt is doubly cool - it is not (at least, in any obvious way) motivated by $$.
nly 11y ago
WoSign issue free certs with up to 100 altnames, which is almost as good as a wildcard cert for many purposes, valid for up to 3 years. They also revoke for free. They're the best option at the moment if, like me, you don't want want to put a penny in to the CA industry.
- IgorPartola 11y ago
  I was not aware of this option. However, it seems to be operating out of China. How does that affect security and availability in the long run?
  - gurrone 11y ago
    Maybe availability but as long as you generate the private key part and paste your CSR on the website they can at worst revoke your certificate. So from a security perspective they're not worse then the others.
  - nly 11y ago
    You already trust them. They're in all the major browser trust stores
  - ivanr 11y ago
    It doesn't affect security, they're already in browsers' trust stores. It does affect availability, but only because (the last time I checked) WoSign's OCSP responders operated from China only. To address network latency issues with your users located far away, make sure you have OCSP stapling configured on your servers.
- gurrone 11y ago
  They lowered that to 10 lately. I was also surprised but I guess they pissed of others in the biz. Usually I see it limited to 40 by the comercial options. On the server side you've to make sure you run a decent nginx/apache with OCSP stapling support. Their responders are slow.
  - nly 11y ago

by ck2 11y ago

wereHamster 11y ago

> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time And if you need a wildcard cert, startssl will give you any number of those for just 50$.

throwaway2048 11y ago
gee how benevolent of them
- gurrone 11y ago
  while I in general also disagree with the whole CA thing one has to admit that running a CA is not for free. That setting up the auditing, buying a HSM, running the interfaces and so on. And last but not least running the CRL/OCSP infrastructure. From my point of view the main part you pay a good CA for is that they run the OCSP service. Though with OCSP stapling that burden is a bit relaxed.
- wereHamster 11y ago
  startssl covers the cost of their labor, not the cost of a 'license' to use the certificate. Their cost is validating your identity, which is a one time thing. They call you, ask a few questions and that's it. 10 minutes of their and your time. After that you are entitled to create as many certificates as you want. There's one caveat: the validation is only for one year, you have to renew it when your certificates are about to expire. Even if you have just one domain, it's cheaper than the alternatives. If you have multiple domains, startssl is much cheaper.
ck2 11y ago
Actually it is $60 now - and the signup process for wildcards requires heavy duty validation - IDs, passports, corporation documents and other things are sometimes requested.
- wereHamster 11y ago
  I wouldn't call that heavy duty. Sending them a scan of your passport or ID (which you already have somewhere on file...) is hardly too much to ask for. It didn't take me more than 10 minutes. And they'll even call you back to validate the information on a sunday! (which I think is impressive)

regecks 11y ago

> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time: In fact, the free StartSSL Class 1 DV certificates are only available for non-commercial purposes. They DO enforce this, I have had a cert turned down by their "CertMaster" because they considered it part of a commercial operation. That is why Let's Encrypt is doubly cool - it is not (at least, in any obvious way) motivated by $$.

nly 11y ago

WoSign issue free certs with up to 100 altnames, which is almost as good as a wildcard cert for many purposes, valid for up to 3 years. They also revoke for free. They're the best option at the moment if, like me, you don't want want to put a penny in to the CA industry.

IgorPartola 11y ago
I was not aware of this option. However, it seems to be operating out of China. How does that affect security and availability in the long run?
- gurrone 11y ago
  Maybe availability but as long as you generate the private key part and paste your CSR on the website they can at worst revoke your certificate. So from a security perspective they're not worse then the others.
- nly 11y ago
  You already trust them. They're in all the major browser trust stores
- ivanr 11y ago
  It doesn't affect security, they're already in browsers' trust stores. It does affect availability, but only because (the last time I checked) WoSign's OCSP responders operated from China only. To address network latency issues with your users located far away, make sure you have OCSP stapling configured on your servers.
gurrone 11y ago
They lowered that to 10 lately. I was also surprised but I guess they pissed of others in the biz. Usually I see it limited to 40 by the comercial options. On the server side you've to make sure you run a decent nginx/apache with OCSP stapling support. Their responders are slow.
- nly 11y ago