7 ms·

This is too soon if Google goes forward with the red exclamation point "insecure" flag before there is a free solution for wildcard certificates. What are free

by Sephr 10y ago

This is too soon if Google goes forward with the red exclamation point "insecure" flag before there is a free solution for wildcard certificates. What are free sites that give every user a subdomain for their profile/site/etc supposed to do? There are many open source multi-user site platforms that follow this pattern, and all of these platforms now effectively have a huge monetary subscription fee associated with them due to the fact that you now need to purchase a wildcard certificate in order to not scare away users. There is no free wildcard SSL certificate service, so Google is essentially forcing you to pay money to not scare users away from your site. I am all for this change eventually happening, but not until all DV SSL use cases are covered by free services. Until then, this change is inappropriate. If Google wants to punish sites that can't afford or won't pay for expensive wildcard certificates, then they should offer a solution of their own (like their own ACME CA that supports provisioning wildcard certs).

catmanjan 10y ago
>Chrome will mark HTTP pages that collect passwords or credit cards as non-secure Will probably get hated on, but you should shell out for your own domain if you're collecting this info - there are quite a few BYO domain, free hosts.
- deleted 10y ago
  [deleted]
Tushon 10y ago
Zendesk, for example, has a Let's Encrypt-based system for all those <account>.zendesk.com pages. While it wouldn't be trivial to set it up, it is free and the information is out there if the admins of those sites want to make it possible.
- kuschku 10y ago
  Not everyone can get whitelisted from the domain creation limits of LE.
  - Ajedi32 10y ago
    Unless you're creating [more than 20 new subdomains a week][1], you're not gonna hit that limit anyway. You can increase that figure to around 2,000 new subdomains a week if you're willing to include multiple subdomains per certificate; that should be more than enough for all but the largest of sites. And even if you do need more: > If you are a large hosting provider or organization working on a Let’s Encrypt integration, we have a rate limiting form that can be used to request a higher rate limit. [1]: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/
    - kuschku 10y ago
      If you want to have a signup process that takes less than 9 hours, you have a max of 20 new subdomains a week. 20 users signing up a week - likely with a retention of a few percent - is not a "large hosting provider". You might have a few hundred users max, and already will be far over the rate limits.
      - Ajedi32 10y ago
        Just start them off with HTTP and transparently upgrade to HTTPS after 9 hours. And if you're only retaining a small percentage of users who sign up, you can stretch that limit even further by only upgrading the users who you retain.
        Sephr 10y ago
        This isn't possible in a properly deployed HTTPS site, since it would already have an HSTS header with includeSubdomains.
deleted 10y ago
[deleted]
rogerdpack 10y ago
The only problem is if those subdomains have a password input field "somewhere" on their sites, AFAICT. Or are you referring to google's "later" plans to add a red exclamation point "insecure" flag to the url bar for all HTTP pages? I'll admit when I first heard of them flagging HTTP password fields, my instinct was to write a little javascript to "mimic" password input field behavior (and store the real password away somewhere else, then at submit time, it sends in the correct data). But if it's just a tiny warning on the url bar, meh, not sure if I care... Also note that https://letsencrypt.org https://letsencrypt.org appears to offer free CA certs.
- deleted 10y ago
  [deleted]
- Buge 10y ago
  Sephr was talking about wildcard certificates, which Let's Encrypt doesn't offer. But dynamically requested certificates can sometimes be used as a replacement for wildcard certificates.
- byuu 10y ago
  I doubt most will even go that far. You can pretty much expect those that won't go HTTPS (for whatever reason, and there are many) to change their input type="password" fields to input type="text" fields. That is probably what I am going to do for the internal site I maintain at work, since I can't get an SSL certificate for such a thing. All this change is going to do is make password eavesdropping in person easier.
  - rogerdpack 10y ago
    oh yeah text field, that's an interesting option and people might even use it as an easy work around [LOL]. I guess you could make the viewable size like 1 char then it won't be much worse than inputting it from a smart phone. Except for the large screen people can see from behind you LOL. I guess people could do self signed certs that expire in "100 years" but you're right, even installing those can be super painful, and people may not go that far. Of course, initially what people will do is "nothing" and just let the insecure message appear, since it doesn't actually block any functionality seemingly...
davidgerard 10y ago
> What are free sites that give every user a subdomain for their profile/site/etc supposed to do? Let's Encrypt and certbot. It's all but trivial to SSL your site and keep it up to date if you control the system. Here's how I SSLed my blogs. This was interactive, but fully scripting it would be easy: https://rocknerd.co.uk/2016/12/04/rocknerd-is-now-fully-ssl-enabled-how-to-do-this-yourself/ https://rocknerd.co.uk/2016/12/04/rocknerd-is-now-fully-ssl-... Took me literally minutes to set up, it took more time to track down the http:// http:// images to fix the mixed-content warning.
- kuschku 10y ago
  The entire argument is about sites where that is not possible. Lets Encrypt has a limit of 20 domains per week for you. So you end up with at most a few hundred users.
  - EvilTerran 10y ago
    20 certificates per week, each cert can be for up to 100 subdomains via SANs; and that limit is only for new certs, renewals don't count towards it - so if you can batch your requests (eg, with an "it may take up to 12 hours for your site to become available over HTTPS" notice, then twice a day make one big cert request for all your new domains), you can get up to 2000 per week; and there's no hard limit to the number you can accumulate over time. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ If that's not enough for your use case, you're probably big enough that a wildcard cert is a negligible expense.
    - Dylan16807 10y ago
      No site should require a day's delay on an automated software thing that can be done in seconds. The limit remains at 20 per week if you want to provide a good experience. And that's not big.
      - EvilTerran 10y ago
        Sure, it's not ideal... but does it really matter? Just register your domain with this hypothetical service while you're still preparing the content for it, so there's time for the cert to go through before you need it. Or they could let you provide your own cert if you're in that much of a hurry. We're talking about edge-cases within edge-cases at this point: a service that (1) offers HTTPS subdomains (2) hasn't been able to get a rate-limit increase from Let's Encrypt (3) is unwilling to buy a wildcard cert (4) either is growing by hundreds of subdomains a day, or has a significant amount of clients who can't wait a few hours for a cert but won't buy their own. That's so oddly specific, I'm not surprised people aren't going out of their way to cater to it.
xg15 10y ago
> What are free sites that give every user a subdomain for their profile/site/etc supposed to do? Couldn't you include an ACME request for a new subdomain certificate into the "create account" script? This would certainly add some complexity (especially with automatically fulfilling the "proof-of-ownership" challanges and properly renewing all the subdomain certificates) but it seems doable with less running cost than a wildcart cert subscription. Edit: On second thought, this does leak some interesting data to the CA - such as, how many users you have, what their usernames are and how your rate of new signups is.
- garblegarble 10y ago
  >Couldn't you include an ACME request for a new subdomain certificate into the "create account" script? If you're using Let's Encrypt that'd also limit you to 20 new users per week so I think you'd need a more complicated approach than that (or a different CA). Batching into groups might work but then user provisioning time increases. Wildcard certs do seem like the right way to go here, and the cost is pretty minimal
- clinta 10y ago
  And that leak isn't constrained to the CA. Due to certificate transparency, that information is visible to anyone who cares to look for it.
raesene6 10y ago
I'm not sure I'd call ~$50/year ( e.g. https://cheapsslsecurity.co.uk/comodo/positivessl-wildcard.html https://cheapsslsecurity.co.uk/comodo/positivessl-wildcard.h...) a "huge monetary subscription fee"....
- byuu 10y ago
  I would. That's the same price as a year of hosting an entire VPS instance with 1TB bandwidth a month, 40GB SSD storage, and 512MB of RAM. And for what? A completely automated process that loads a page on your site, verifies a META tag is present, runs an openssl command, and prints the output to a webpage for you. So for that $50, you can double all the specs on your server, or get a little green lock in your URL bar. And don't forget, we're not all in the US. I know a guy in Venezuela that doesn't have $50USD to spend on an SSL certificate. I understand it costs money to run a CA. But if Let's Encrypt can run one for free, then surely so can Google, if they're so gung-ho on 100% of the web being over HTTPS. If you want that to be a reality too, you need to back free wildcard certificates. Otherwise you'll never be able to deprecate HTTP.
  - raesene6 10y ago
    If you're running a commercial entity and $50/year is a problem for you, then I'd suggest that your business may have its challenges. Obviously it is (in most cases) possible to automate the cert creation process using let's encrypt for free, so it's a trade-off on whether the time it takes to do that is worth more or less than the $50 it'd cost to purchase a wildcard cert. As to the compute power you can buy for that, it could be that says more about the cheapness of compute power than it does about the expense of SSL certs. As to Let's encrypt running for free, well the post I was referring to indicated they didn't want to go that route, also you do know they're actively soliciting donations at the moment because, guess what, you can't run a CA for free...
    - Kadin 10y ago
      > If you're running a commercial entity Making the web open only to commercial entities is a huge problem by itself. I definitely would not want to make that a premise or assumption to participate in the Internet as an equal player.
bjacobel 10y ago
AWS Certificate Manager will give you a free wildcard if your site is hosted behind Cloudfront or on an ELB.
Latty 10y ago
I mean, those sites are insecure. Google has a responsibility to the user of the browser, not the site owner. If you want people to trust your site, you have to provide them the security to do so.

by Sephr 10y ago

catmanjan 10y ago

>Chrome will mark HTTP pages that collect passwords or credit cards as non-secure Will probably get hated on, but you should shell out for your own domain if you're collecting this info - there are quite a few BYO domain, free hosts.

deleted 10y ago
[deleted]

Tushon 10y ago

Zendesk, for example, has a Let's Encrypt-based system for all those <account>.zendesk.com pages. While it wouldn't be trivial to set it up, it is free and the information is out there if the admins of those sites want to make it possible.

kuschku 10y ago
Not everyone can get whitelisted from the domain creation limits of LE.
- Ajedi32 10y ago
  Unless you're creating [more than 20 new subdomains a week][1], you're not gonna hit that limit anyway. You can increase that figure to around 2,000 new subdomains a week if you're willing to include multiple subdomains per certificate; that should be more than enough for all but the largest of sites. And even if you do need more: > If you are a large hosting provider or organization working on a Let’s Encrypt integration, we have a rate limiting form that can be used to request a higher rate limit. [1]: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/
  - kuschku 10y ago
    If you want to have a signup process that takes less than 9 hours, you have a max of 20 new subdomains a week. 20 users signing up a week - likely with a retention of a few percent - is not a "large hosting provider". You might have a few hundred users max, and already will be far over the rate limits.
    - Ajedi32 10y ago
      Just start them off with HTTP and transparently upgrade to HTTPS after 9 hours. And if you're only retaining a small percentage of users who sign up, you can stretch that limit even further by only upgrading the users who you retain.
      - Sephr 10y ago
        This isn't possible in a properly deployed HTTPS site, since it would already have an HSTS header with includeSubdomains.

deleted 10y ago

[deleted]

rogerdpack 10y ago

The only problem is if those subdomains have a password input field "somewhere" on their sites, AFAICT. Or are you referring to google's "later" plans to add a red exclamation point "insecure" flag to the url bar for all HTTP pages? I'll admit when I first heard of them flagging HTTP password fields, my instinct was to write a little javascript to "mimic" password input field behavior (and store the real password away somewhere else, then at submit time, it sends in the correct data). But if it's just a tiny warning on the url bar, meh, not sure if I care... Also note that https://letsencrypt.org https://letsencrypt.org appears to offer free CA certs.

deleted 10y ago
[deleted]
Buge 10y ago
Sephr was talking about wildcard certificates, which Let's Encrypt doesn't offer. But dynamically requested certificates can sometimes be used as a replacement for wildcard certificates.
byuu 10y ago
I doubt most will even go that far. You can pretty much expect those that won't go HTTPS (for whatever reason, and there are many) to change their input type="password" fields to input type="text" fields. That is probably what I am going to do for the internal site I maintain at work, since I can't get an SSL certificate for such a thing. All this change is going to do is make password eavesdropping in person easier.
- rogerdpack 10y ago
  oh yeah text field, that's an interesting option and people might even use it as an easy work around [LOL]. I guess you could make the viewable size like 1 char then it won't be much worse than inputting it from a smart phone. Except for the large screen people can see from behind you LOL. I guess people could do self signed certs that expire in "100 years" but you're right, even installing those can be super painful, and people may not go that far. Of course, initially what people will do is "nothing" and just let the insecure message appear, since it doesn't actually block any functionality seemingly...

davidgerard 10y ago

> What are free sites that give every user a subdomain for their profile/site/etc supposed to do? Let's Encrypt and certbot. It's all but trivial to SSL your site and keep it up to date if you control the system. Here's how I SSLed my blogs. This was interactive, but fully scripting it would be easy: https://rocknerd.co.uk/2016/12/04/rocknerd-is-now-fully-ssl-enabled-how-to-do-this-yourself/ https://rocknerd.co.uk/2016/12/04/rocknerd-is-now-fully-ssl-... Took me literally minutes to set up, it took more time to track down the http:// http:// images to fix the mixed-content warning.

kuschku 10y ago
The entire argument is about sites where that is not possible. Lets Encrypt has a limit of 20 domains per week for you. So you end up with at most a few hundred users.
- EvilTerran 10y ago
  20 certificates per week, each cert can be for up to 100 subdomains via SANs; and that limit is only for new certs, renewals don't count towards it - so if you can batch your requests (eg, with an "it may take up to 12 hours for your site to become available over HTTPS" notice, then twice a day make one big cert request for all your new domains), you can get up to 2000 per week; and there's no hard limit to the number you can accumulate over time. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ If that's not enough for your use case, you're probably big enough that a wildcard cert is a negligible expense.
  - Dylan16807 10y ago
    No site should require a day's delay on an automated software thing that can be done in seconds. The limit remains at 20 per week if you want to provide a good experience. And that's not big.
    - EvilTerran 10y ago
      Sure, it's not ideal... but does it really matter? Just register your domain with this hypothetical service while you're still preparing the content for it, so there's time for the cert to go through before you need it. Or they could let you provide your own cert if you're in that much of a hurry. We're talking about edge-cases within edge-cases at this point: a service that (1) offers HTTPS subdomains (2) hasn't been able to get a rate-limit increase from Let's Encrypt (3) is unwilling to buy a wildcard cert (4) either is growing by hundreds of subdomains a day, or has a significant amount of clients who can't wait a few hours for a cert but won't buy their own. That's so oddly specific, I'm not surprised people aren't going out of their way to cater to it.

xg15 10y ago

> What are free sites that give every user a subdomain for their profile/site/etc supposed to do? Couldn't you include an ACME request for a new subdomain certificate into the "create account" script? This would certainly add some complexity (especially with automatically fulfilling the "proof-of-ownership" challanges and properly renewing all the subdomain certificates) but it seems doable with less running cost than a wildcart cert subscription. Edit: On second thought, this does leak some interesting data to the CA - such as, how many users you have, what their usernames are and how your rate of new signups is.

garblegarble 10y ago
>Couldn't you include an ACME request for a new subdomain certificate into the "create account" script? If you're using Let's Encrypt that'd also limit you to 20 new users per week so I think you'd need a more complicated approach than that (or a different CA). Batching into groups might work but then user provisioning time increases. Wildcard certs do seem like the right way to go here, and the cost is pretty minimal
clinta 10y ago
And that leak isn't constrained to the CA. Due to certificate transparency, that information is visible to anyone who cares to look for it.

raesene6 10y ago

I'm not sure I'd call ~$50/year ( e.g. https://cheapsslsecurity.co.uk/comodo/positivessl-wildcard.html https://cheapsslsecurity.co.uk/comodo/positivessl-wildcard.h...) a "huge monetary subscription fee"....

byuu 10y ago
I would. That's the same price as a year of hosting an entire VPS instance with 1TB bandwidth a month, 40GB SSD storage, and 512MB of RAM. And for what? A completely automated process that loads a page on your site, verifies a META tag is present, runs an openssl command, and prints the output to a webpage for you. So for that $50, you can double all the specs on your server, or get a little green lock in your URL bar. And don't forget, we're not all in the US. I know a guy in Venezuela that doesn't have $50USD to spend on an SSL certificate. I understand it costs money to run a CA. But if Let's Encrypt can run one for free, then surely so can Google, if they're so gung-ho on 100% of the web being over HTTPS. If you want that to be a reality too, you need to back free wildcard certificates. Otherwise you'll never be able to deprecate HTTP.
- raesene6 10y ago
  If you're running a commercial entity and $50/year is a problem for you, then I'd suggest that your business may have its challenges. Obviously it is (in most cases) possible to automate the cert creation process using let's encrypt for free, so it's a trade-off on whether the time it takes to do that is worth more or less than the $50 it'd cost to purchase a wildcard cert. As to the compute power you can buy for that, it could be that says more about the cheapness of compute power than it does about the expense of SSL certs. As to Let's encrypt running for free, well the post I was referring to indicated they didn't want to go that route, also you do know they're actively soliciting donations at the moment because, guess what, you can't run a CA for free...
  - Kadin 10y ago
    > If you're running a commercial entity Making the web open only to commercial entities is a huge problem by itself. I definitely would not want to make that a premise or assumption to participate in the Internet as an equal player.

bjacobel 10y ago

AWS Certificate Manager will give you a free wildcard if your site is hosted behind Cloudfront or on an ELB.

Latty 10y ago

I mean, those sites are insecure. Google has a responsibility to the user of the browser, not the site owner. If you want people to trust your site, you have to provide them the security to do so.