9 ms·

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

dogma1138 11y ago
Insurance if something happens, beyond that nothing.
alfredxing 11y ago
Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").
- UnoriginalGuy 11y ago
  They couldn't possibly issue EV certificates without charging. The verification requirements are too high. You need actual staff to verify.
- itistoday2 11y ago
  EV certs are a total waste of money. Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar.
  - aianus 11y ago
    > Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar. I don't know if it's worth the money per se, but you can pin a couple of trusted CA root EV certs via HPKP and know it's much more difficult for someone to "accidentally" issue a valid cert for your site. If you do that, users won't see a lock instead of a green bar, they'll be blocked from accessing the site at all (if it's not their first visit and they're using a modern browser).
    - jnbiche 11y ago
      You can pin any certs via HPKP, including self-signed ones. The only security feature EV certs have over regular ones right now is the use of certificate transparency, but that should be extended to non-EV certs within 1-2 years.
      - aianus 11y ago
        No, the security feature is that if you only pin, say, Verisign EV root and Digicert EV root then an attacker would have to pass EV validation at those vendors. Which is much more difficult to do than to get any cert anywhere. You could pin your own cert, but that makes it difficult to rotate keys in a heartbleed type situation.
        vtlynch 11y ago
        Wow, I never thought of that before! Though it would not protect from factoring because most EV roots are the same key length/hash. For anyone else reading, this works because the root programs give authority to issue EV certs separately from other certs. To keep the authority separate (most, perhaps all) CAs use separate roots for EVs.
  - nailer 11y ago
    Firefox, Safari and Edge also use a grey lock for domain validation certificates.
- bandrami 11y ago
  Probably because EV certs are a stupid idea. Do you really know the difference between Citi Bank and Citibank? No? Then EV hasn't saved you from being phished.
  - mike_hearn 11y ago
    EV certs are expensive because they have people in the loop, and so getting a cert for an obviously misleading name should be much harder. You'd have to pass an eyeballed sanity check.
    - bandrami 11y ago
      You have much greater faith in the CAs' probity and competence than I think is warranted.
  - Gregordinary 11y ago
    Well, you can't just order an EV cert for "Citi Bank" unless you have "Citi Bank" registered as a legal entity. Section 9.2.1 (Page 9): https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf In addition to using & verifying the legally registered name, it must be verified that there is a physical address for the business, if that address doesn't match the registered location, additional verification is required. There are additional provisions of verification as well. See section 11 of the same document.
    - bandrami 11y ago
      Obviously the Citi example was a joke, but most actual certificates I see are to "R L Media Enterprises" or whatever the D&B name of the business is, which is opaque to me anyways.
yokohummer7 11y ago
Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.
- mastax 11y ago
  An argument can be made that Let's Encrypt doesn't need wildcard certificates since new certs can be generated automatically every time a subdomain is added.
  - toomuchtodo 11y ago
    True! But wildcards make cert management so much easier. If I have a handful of subdomains, that's fine. If I have thousands, I want a wildcard cert.
    - chipperyman573 11y ago
      It would be relatively easy to write a simple bash script to automate it. Granted, it might take a bit of time to generate a few thousand certs, but it wouldn't take more than a day if you only have a thousand or so.
      - dingaling 11y ago
        It's not just creating the certs that is the challenge but also managing them; back-up, revocation, re-testing after expiry and across different development environments etc And from the client perspective is makes pinning much easier. I'm not a fan of one-wildcard-to-rule-them either but keeping active certs to a handful through the judicious use of wildcards is a real boon.
        Natanael_L 11y ago
        If you use the Cloudflare style delegation of SSL authentication signing to a trusted auth server, it can be simplified. The individual servers only holds the public cert and a private internal secret, one server holds your certificate private keys. That server would be used to keep track of your domains and certificate status and which servers are authorized to work with which domains, etc... Also easier to backup.
hackerboos 11y ago
There will always be a market for EV but that seems reasonable considering the manually verification required.
sarciszewski 11y ago
Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl * StartSSL https://startssl.com https://startssl.com * WoSign https://buy.wosign.com/free https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept at https://paragonie.com/white-paper/2015-secure-php-data-encryption https://paragonie.com/white-paper/2015-secure-php-data-encry...
- mehrdada 11y ago
  They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction when it comes to security products.) Let's Encrypt is a big step forward in having a legitimate, actual, user-friendly, free TLS certificate issuer without restrictions for usage scenarios.
  - icelancer 11y ago
    > user-friendly This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
    - david-given 11y ago
      StartSSL is so painfully obtuse and difficult to use that I eventually just gave up and paid someone to do it for me.
    - b3lvedere 11y ago
      I'm quite pleased with StartSSL. Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL. You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want. Only drawback is that the certificates are only valid for one year.
huhtenberg 11y ago
> Is there still value to buying an expensive cert from another vendor? If you are running a commercial, high-traffic website, then yes, there is. For example, EV (extended validation) certificates is currently the only way to quickly build and maintain a "reputation" with 3rd party website ranking systems such as Microsoft's SmartScreen and, based on anecdotal evidence, with Symantec SafeWeb and Google SafeBrowsing services. Needless to say that SmartScreen is on by default in IE/Edge and SafeBrowsing is on in Chrome and, in part, Firefox.
- jonah 11y ago
  Do you have any recommendations on which CA is good for EV certs (that work in Chrome)?
  - nailer 11y ago
    Hi Jonah, I run https://certsimple.com https://certsimple.com. We only do EV certificates, and we do it much faster than any of the existing companies, which normally quote 7-10 days to complete the validation process. I waited around a month for GoDaddy earlier this year, which is how I ended up making CertSimple. CertSimple do EV certificates in an average of 5 hours. - We check the customers info against the required government information sources (as well as a number of other places) before customers pay us. - After we take the order, we provide a specific set of instructions based on a number of characteristics of the customer's actual business to make the validation process as fast as possible. - We have a real focus on UX: there's no software to install or command line questions, our validation UI updates live, and we manually follow up with every customer to iterate our product. I'm mike@certsimple.com, or @mikemaccana on Twitter.
    - chmike 11y ago
      Dis you hear about the CIA AOL mail box hacked ? Watch out for "social" intelligence. Other people could get the info you are checking and pretending to be the company.
  - huhtenberg 11y ago

Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?

dogma1138 11y ago

Insurance if something happens, beyond that nothing.

alfredxing 11y ago

Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").

UnoriginalGuy 11y ago
They couldn't possibly issue EV certificates without charging. The verification requirements are too high. You need actual staff to verify.
itistoday2 11y ago
EV certs are a total waste of money. Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar.
- aianus 11y ago
  > Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar. I don't know if it's worth the money per se, but you can pin a couple of trusted CA root EV certs via HPKP and know it's much more difficult for someone to "accidentally" issue a valid cert for your site. If you do that, users won't see a lock instead of a green bar, they'll be blocked from accessing the site at all (if it's not their first visit and they're using a modern browser).
  - jnbiche 11y ago
    You can pin any certs via HPKP, including self-signed ones. The only security feature EV certs have over regular ones right now is the use of certificate transparency, but that should be extended to non-EV certs within 1-2 years.
    - aianus 11y ago
      No, the security feature is that if you only pin, say, Verisign EV root and Digicert EV root then an attacker would have to pass EV validation at those vendors. Which is much more difficult to do than to get any cert anywhere. You could pin your own cert, but that makes it difficult to rotate keys in a heartbleed type situation.
      - vtlynch 11y ago
        Wow, I never thought of that before! Though it would not protect from factoring because most EV roots are the same key length/hash. For anyone else reading, this works because the root programs give authority to issue EV certs separately from other certs. To keep the authority separate (most, perhaps all) CAs use separate roots for EVs.
- nailer 11y ago
  Firefox, Safari and Edge also use a grey lock for domain validation certificates.
bandrami 11y ago
Probably because EV certs are a stupid idea. Do you really know the difference between Citi Bank and Citibank? No? Then EV hasn't saved you from being phished.
- mike_hearn 11y ago
  EV certs are expensive because they have people in the loop, and so getting a cert for an obviously misleading name should be much harder. You'd have to pass an eyeballed sanity check.
  - bandrami 11y ago
    You have much greater faith in the CAs' probity and competence than I think is warranted.
- Gregordinary 11y ago
  Well, you can't just order an EV cert for "Citi Bank" unless you have "Citi Bank" registered as a legal entity. Section 9.2.1 (Page 9): https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf In addition to using & verifying the legally registered name, it must be verified that there is a physical address for the business, if that address doesn't match the registered location, additional verification is required. There are additional provisions of verification as well. See section 11 of the same document.
  - bandrami 11y ago
    Obviously the Citi example was a joke, but most actual certificates I see are to "R L Media Enterprises" or whatever the D&B name of the business is, which is opaque to me anyways.

yokohummer7 11y ago

Not yet, because Let's Encrypt doesn't provide wildcard certificates as of now. This may change in the near future, though. Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.

mastax 11y ago
An argument can be made that Let's Encrypt doesn't need wildcard certificates since new certs can be generated automatically every time a subdomain is added.
- toomuchtodo 11y ago
  True! But wildcards make cert management so much easier. If I have a handful of subdomains, that's fine. If I have thousands, I want a wildcard cert.
  - chipperyman573 11y ago
    It would be relatively easy to write a simple bash script to automate it. Granted, it might take a bit of time to generate a few thousand certs, but it wouldn't take more than a day if you only have a thousand or so.
    - dingaling 11y ago
      It's not just creating the certs that is the challenge but also managing them; back-up, revocation, re-testing after expiry and across different development environments etc And from the client perspective is makes pinning much easier. I'm not a fan of one-wildcard-to-rule-them either but keeping active certs to a handful through the judicious use of wildcards is a real boon.
      - Natanael_L 11y ago
        If you use the Cloudflare style delegation of SSL authentication signing to a trusted auth server, it can be simplified. The individual servers only holds the public cert and a private internal secret, one server holds your certificate private keys. That server would be used to keep track of your domains and certificate status and which servers are authorized to work with which domains, etc... Also easier to backup.

hackerboos 11y ago

There will always be a market for EV but that seems reasonable considering the manually verification required.

sarciszewski 11y ago

Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl * StartSSL https://startssl.com https://startssl.com * WoSign https://buy.wosign.com/free https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept at https://paragonie.com/white-paper/2015-secure-php-data-encryption https://paragonie.com/white-paper/2015-secure-php-data-encry...

mehrdada 11y ago
They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction when it comes to security products.) Let's Encrypt is a big step forward in having a legitimate, actual, user-friendly, free TLS certificate issuer without restrictions for usage scenarios.
- icelancer 11y ago
  > user-friendly This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
  - david-given 11y ago
    StartSSL is so painfully obtuse and difficult to use that I eventually just gave up and paid someone to do it for me.
  - b3lvedere 11y ago
    I'm quite pleased with StartSSL. Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL. You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want. Only drawback is that the certificates are only valid for one year.

huhtenberg 11y ago

> Is there still value to buying an expensive cert from another vendor? If you are running a commercial, high-traffic website, then yes, there is. For example, EV (extended validation) certificates is currently the only way to quickly build and maintain a "reputation" with 3rd party website ranking systems such as Microsoft's SmartScreen and, based on anecdotal evidence, with Symantec SafeWeb and Google SafeBrowsing services. Needless to say that SmartScreen is on by default in IE/Edge and SafeBrowsing is on in Chrome and, in part, Firefox.

jonah 11y ago
Do you have any recommendations on which CA is good for EV certs (that work in Chrome)?
- nailer 11y ago
  Hi Jonah, I run https://certsimple.com https://certsimple.com. We only do EV certificates, and we do it much faster than any of the existing companies, which normally quote 7-10 days to complete the validation process. I waited around a month for GoDaddy earlier this year, which is how I ended up making CertSimple. CertSimple do EV certificates in an average of 5 hours. - We check the customers info against the required government information sources (as well as a number of other places) before customers pay us. - After we take the order, we provide a specific set of instructions based on a number of characteristics of the customer's actual business to make the validation process as fast as possible. - We have a real focus on UX: there's no software to install or command line questions, our validation UI updates live, and we manually follow up with every customer to iterate our product. I'm mike@certsimple.com, or @mikemaccana on Twitter.
  - chmike 11y ago
    Dis you hear about the CIA AOL mail box hacked ? Watch out for "social" intelligence. Other people could get the info you are checking and pretending to be the company.
- huhtenberg 11y ago