6 ms·
Gives a 404. Care to say what was there?
by huskyr 11y ago
Gives a 404.
Care to say what was there?
- mholt 11y agoOops, they deleted it. It was a post from Namecheap answering somebody asking if they were going to support Let's Encrypt. Original question: https://twitter.com/matbacon89/status/667348413470650370 https://twitter.com/matbacon89/status/667348413470650370 Person's response: https://twitter.com/matbacon89/status/667348648741744640 https://twitter.com/matbacon89/status/667348648741744640 In between, they _did_ say something like "You'll have to wait and see! :)" I wonder if they deleted it in light of this blog post, which I find disingenuous: https://blog.namecheap.com/ssl-from-namecheap-whats-the-difference/ https://blog.namecheap.com/ssl-from-namecheap-whats-the-diff...
- tamar 11y agoHey - so I tweeted that...and to be very clear, nothing in that tweet should have been implied as a yes. But since it was potentially construed as a yes, it was deleted to avoid confusion.
- mholt 11y agoThanks for posting here to clear things up. (Sometimes deleting tweets can cause more confusion than it removes.) Does the blog post I linked to reflect the opinion of most of Namecheap, though, really? I like Namecheap and I would be disappointed if the majority of the company believed that all free CAs will be operated like Let's Encrypt.
- tamar 11y agoI don't think we're making a blanket statement about "all free CAs" here. Encryption is one important aspect that free SSL providers offer, validation and trust is another that isn't offered by most.
- mholt 11y agoI respect that. I hope free certs will be a boon for the EV cert industry, since businesses will need to stand out more as trusted. Perhaps, though, you could pass it along to whomever it concerns, that the blog post reflects poorly on Namecheap. It's obviously targeting Let's Encrypt, but it uses vague phrases like "SSL certs from free providers" that _do_ come across as blanket statements.
- eeZi 11y agoIn the blog post, you point out that you perform additional validation for your OV certificates while the free CAs do not. But since they are equally trusted by the browsers, how does that increase security for me? On the other key differences: - Shorter lifetimes is actually an advantage, since it reduces the risk when your keys are compromised. Revocation is a mess, the only way you can be sure that a certificate can no longer be used is when it's expired. - No wildcards is an advantage too, since you can give each service its own certificate and if one is compromised, the others are fine. If you're using an organization-wide wildcard cert, a compromise is much worse. - Limited flexibility - "you must have root access to your servers " is factually incorrect, the automated Let's Encrypt client is optional and you can request a certificate manually. - Limited support - why would I need a SLA for a certificate, anyway? The OCSP servers? - Management difficulties - while this is true now, the automation enabled by Let's Encrypt is likely to facilitate management, not the contrary. I'm currently working on a Puppet module which will automatically provision certificates for web servers, something which used to be much harder. - Build Trust with Purchased SSL - how do I increase trust by using a OV certificate? It's not like an average website user would look up the certificate details, and there's no functional difference between a OV and a DV certificate. > The levels of encryption, validation, and trust that business and commerce websites require are available only with purchased SSL. Unless you're talking about EV certificates, I don't see how. There's no "level of encryption" which isn't available with a free CA, and the additional validation and trust do not matter unless it's a EV certificate. Even an EV certificate does not protect against MitM. The real answer is key pinning. As a Namecheap customer, I'm disappointed by this blog post. It reads like an attempt to spread FUD about free DV certificates. I initially became a customer because I read good things about your business ethics, but this makes me question my choice.