3 ms·

There's also the issue that some browsers (Firefox, I'm looking at you) do their best to scare users about self-signed certificates, which means that you need t

There's also the issue that some browsers (Firefox, I'm looking at you) do their best to scare users about self-signed certificates, which means that you need to pay for a cert. Firefox is absolutely in the right, here. Self-signed certificates are worthless; if you'd like a free certificate, use StartCom or CACert. It also breaks the shared-hosting model: your entire HTTP stream is encrypted, which means that key negotiation occurs before the server has your HOST header. This is only true for older servers; modern TLS implementations support name-based certificate negotiation.

jcnnghm 16y ago
Unfortunately there is more to this than server support. IE6 and every browser on XP, including firefox and chrome, don't support the tls extension. Even apache doesn't ship with it. For all practical purposes, name based virtual hosting still doesn't work for ssl. You'll need a seperate ip address for each name, unless you can use a wildcard.
buster 16y ago
What's the benefit of using CACert when browsers don't include those? https://cacert.org https://cacert.org gives a big fat warning in chrome.
- jmillikin 16y ago
  My browsers include CACert's root certificate -- therefore, I use it for securing any of my private websites. It's just like using a self-signed certificate, except not stupid. If you need to support the general public, pay the $20 or whatever for a certificate with a widespread root.
amalcon 16y ago
They're worthless except insofar as they let you get the encryption benefit out of SSL without paying the cost necessary to get the authentication benefit.
- jmillikin 16y ago
  What's the point of encryption if you don't know what server you're connected to? Somebody could be intercepting your traffic, and you wouldn't realize it.
  - amalcon 16y ago
    The point is to stop one particular class of attacker: the one that's passively sniffing and archiving network traffic while trying to remain invisible (and thus isn't actually altering the traffic profile). This is a benefit (over in-the-clear HTTP), but Firefox and others effectively tell users that it's more dangerous than regular HTTP.

jcnnghm 16y ago

Unfortunately there is more to this than server support. IE6 and every browser on XP, including firefox and chrome, don't support the tls extension. Even apache doesn't ship with it. For all practical purposes, name based virtual hosting still doesn't work for ssl. You'll need a seperate ip address for each name, unless you can use a wildcard.

buster 16y ago

What's the benefit of using CACert when browsers don't include those? https://cacert.org https://cacert.org gives a big fat warning in chrome.

jmillikin 16y ago
My browsers include CACert's root certificate -- therefore, I use it for securing any of my private websites. It's just like using a self-signed certificate, except not stupid. If you need to support the general public, pay the $20 or whatever for a certificate with a widespread root.

amalcon 16y ago

They're worthless except insofar as they let you get the encryption benefit out of SSL without paying the cost necessary to get the authentication benefit.

jmillikin 16y ago
What's the point of encryption if you don't know what server you're connected to? Somebody could be intercepting your traffic, and you wouldn't realize it.
- amalcon 16y ago
  The point is to stop one particular class of attacker: the one that's passively sniffing and archiving network traffic while trying to remain invisible (and thus isn't actually altering the traffic profile). This is a benefit (over in-the-clear HTTP), but Firefox and others effectively tell users that it's more dangerous than regular HTTP.