6 ms·
>All Symantec issued certificates. GeoTrust and Thawte are CAs operated by Symantec, simply afforded different branding. >While this list may need to be update
by sandGorgon 10y ago
>All Symantec issued certificates. GeoTrust and Thawte are CAs operated by Symantec, simply afforded different branding.
>While this list may need to be updated for some recently created roots, https://chromium.googlesource.com/chromium/src/+/master/net/data/ssl/symantec/README.md https://chromium.googlesource.com/chromium/src/+/master/net/... may accurately capture the state of impact
Damn. There goes my certificate (Rapidssl). Anybody know what are the remaining, trustworthy certificate issuers ?
No we cannot use LetsEncrypt for convenience reasons (we bake our certificate pub key in many places)
- Ajedi32 10y ago> No we cannot use LetsEncrypt for convenience reasons (we bake our certificate pub key in many places) Why does that matter? Pretty sure you don't have to change your public key to get or renew a Let's Encrypt cert.
- sandGorgon 10y agowe spawn our servers and scale them up and down. We terminate ssl internally to our applications which are on Docker. Letsencrypt is painful on docker. I dont mind paying 40$ per year for a wildcard ssl certificate.
- gcr 10y agoWhy not keep `/etc/ssl` inside a volume mounted by each docker container and run letsencrypt outside of docker? Each docker container doesn't need its own instance of letsencrypt; it just needs access to your key.
- fomojola 10y agoIf you use the DNS auth, its actually not bad: you can securely issue the certs on a different machine and just copy the PEM files to the right place. I used this with Route 53's API and it works quite well and is (in my opinion) superior to having to place files.
- user5994461 10y agoUse self signed certificate with your own CA. There is no reason for these apps to have a public cert. An app shouldn't be publicly exposed.
- newman314 10y agoxenolf/lego in DNS mode FTW.
- justusw 10y agoCan confirm, Lego on k8s is really pain-free to use. Following the official documentation meant that I was able to have HTTPS running on our Google Cloud load balancer within 30 minutes.
- geofft 10y agoYou can get a Let's Encrypt certificate manually; you don't have to automate it. There are a few options, including https://gethttpsforfree.com/ https://gethttpsforfree.com/ by 'diafygi, which involves running some openssl commands and pasting public keys and signatures into the web form (which in turn send API requests to Let's Encrypt). Or you can find or build a client yourself. The only hard part is you'll have to find a way to prove ownership other than email ownership. But if these are public-facing web servers, implementing a response for the HTTP challenge shouldn't be hard, and as the website points out, you can configure all your servers to send an HTTP redirect for the challenge to some other single URL, which you can configure manually. https://letsencrypt.org/docs/integration-guide/#picking-a-challenge-type https://letsencrypt.org/docs/integration-guide/#picking-a-ch... This process is significantly less painful, especially on renewals, than the traditional certificate renewal process. If you're already planning on spending an hour of someone's time a year to request a renewal, pay for it, click a link in an email, etc., plan on spending 10 minute of someone's time every two months, instead. (And an hour is optimistic based on my experience.) Your public and private keys don't change, since these are renewals. You're just updating the certificates themselves. And certificates are public data (they're sent in their entirety when you make an HTTPS connection), so you can just put them in a git repo or an S3 bucket or whatever else is convenient for your deploy process.
- sandGorgon 10y agoYou think it is the same to setup renewal for Letsencrypt and a vanilla cert, but it's not. We buy 3 year wildcard certs - Rapidssl was about 80$. From about a month before renewal, they start sending you emails and make sure you don't forget. Letsencrypt is a good idea for larger setups with dedicated devops. For a start-up, it's the exact same argument as Gitlab vs Github.
- QUFB 10y agoYou can use an existing CSR with Let's Encrypt, so you wouldn't have to change your public key.
- looklittlejohn 10y agoWell, Comodo's had an okay track-record, if I recall correctly. But I also don't recall them being cheap.
- sandGorgon 10y agoi have been seriously considering comodo. Their wildcard is not priced all that bad.
- looklittlejohn 10y agoAccording to the this survey I'm ruthlessly stealing from another comment, they have the biggest market share right now: https://w3techs.com/technologies/history_overview/ssl_certificate https://w3techs.com/technologies/history_overview/ssl_certif...
- lukegb 10y agoThat might be because they're the CA underlying Cloudflare's automated SSL issuance - at least for free tier customers.
- deleted 10y ago[deleted]
- tdumitrescu 10y agoComodo, as in the Comodo which tried to trademark "Let's Encrypt" last year? https://arstechnica.com/tech-policy/2016/06/800-pound-comodo-tries-to-trademark-upstart-rivals-lets-encrypt-name/ https://arstechnica.com/tech-policy/2016/06/800-pound-comodo...
- tobltobs 10y ago> Comodo's had an okay track-record, I am not sure what standards apply to companies in this segment, but Comodo has an awful track record imho. Just looking at the Wikipedia article gives me a shill. And those are only the cases where Comodo couldn't deny any wrongdoing or failure.
- 10y ago
- tobltobs 10y ago> Anybody know what are the remaining, trustworthy certificate issuers ? You could take a look at Gandi.net. I don't have any experience with their Certificates, but I trust them with the all their other offerings.
- mastax 10y agoI have heard lots of good things about Digicert, FWIW. No personal experience as my use case can be covered by LetsEncrypt.
- protomyth 10y agoDigicert works for us. Wouldn't mind switching to LetsEncrypt but vendors are the issue (oh, the joy of approved lists).
- scrollaway 10y agoSeconding Digicert. They're expensive, but the most solid and trustworthy option when it comes to "old school" cert providers. EV, Wildcard, code signing.
- compuguy 10y agoWhat about Globalsign?
- yuhong 10y agoThe fun thing is that RapidSSL was the biggest problem when they were trying to kill 1024-bit roots for example.
- soperj 10y agoAlso wondering this, as I'm about to buy a new cert.
- nikcub 10y agoDigiCert https://www.digicert.com/ https://www.digicert.com/ Great company and good people involved in CA/B Forum who advocate on behalf of user security. They'll never pull some of the nonsense the other CA's attempt and I can't recommend them enough. edit: to add, DigiCert were one of the only CA's to support Google's motion to reduce max cert validity period to 12 months, which didn't pass[0] DigiCert were also the CA that helped us get Tor onion addresses validated which eventually became a standard [0] https://cabforum.org/pipermail/public/2017-January/009374.html https://cabforum.org/pipermail/public/2017-January/009374.ht...
- sandGorgon 10y agoVery cool, thanks for that. Their prices are super super super expensive though. Almost 10x as expensive as Comodo for wildcard .
- castillar76 10y agoAs others have said, Digicert is good, as is IdenTrust (though neither are cheap). You might also look at HydrantID, which is rooted to QuoVadis, who've been around a good long time.