4 ms·

a regular certificate. For example you could buy a Sectigo (previously Comodo) certificate for 2 years for like 17$ or so. Wildcard for 2 years is like 100$.

a regular certificate. For example you could buy a Sectigo (previously Comodo) certificate for 2 years for like 17$ or so. Wildcard for 2 years is like 100$. Its worth less than a broken certificate.

ridhoq 7y ago
I’ve had a pretty terrible experience with Sectigo/Comodo over the last few months, especially thru their acquisition. At the moment, I have certificates that are managed in two different portals, one for their previous brand and one for their new brand. Customer support told me that there is no migration path to manage my certs all in one place. We are going to repurchase all of our certs in Digicert this year with which I’ve had a much much better experience. They are well integrated with Azure Key Vault which allows us to automate certificate renewal and our AKS clusters will automatically get the new certs without us doing anything.
- sandGorgon 7y ago
  sure - i will take temporary usability issues (as comodo transitioned into sectigo), over fundamental security issues. https://www.theregister.co.uk/2018/03/01/trustico_digicert_symantec_spat/ https://www.theregister.co.uk/2018/03/01/trustico_digicert_s... if you are using your cloud certificates (built into lb, etc), then this is a moot point. You dont even need letsencrypt then.
krenel 7y ago
Those prices look promising. I don't seem to find where those prices are in their webpage[1]. All I'm seeing is 359/719 USD a year for a wildcard certificate. Am I looking in the wrong place? [1] https://www.comodoca.com/ssl-certificate-comparison?key5sk1=c147eebcd9fd6d57566e0c69838a2d324ceb2f01 https://www.comodoca.com/ssl-certificate-comparison?key5sk1=...
- sandGorgon 7y ago
  i usually buy from https://www.namecheap.com/security/ssl-certificates/ https://www.namecheap.com/security/ssl-certificates/ or https://www.gogetssl.com/wildcard-ssl/ https://www.gogetssl.com/wildcard-ssl/
devrand 7y ago
What do you use to automatically rotate the certificates from Sectigo? This doesn't seem to be a set it and forget it solution. Also, with Sectigo you're more likely to get an actual broken certificate. They misissued nearly every certificate starting from 2002 until late 2019 [1]. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1593776 https://bugzilla.mozilla.org/show_bug.cgi?id=1593776
- sandGorgon 7y ago
  We rotate them manually once every two years. It works. No need for a certbot. Simpler infrastructure Sure about the broken, but the alternatives are worse with possible leaked private keys.
  - devrand 7y ago
    How is that simpler? That seems like it doesn't scale and incredibly error prone. If you only have one certificate you may get away with it. But if once you have hundreds or thousands this is absolutely going to break down the human factor. And even if you do have a single (or few) certificate(s), there are other factors that are going to complicate maintaining this system: * What if a certificate needs to be revoked by your CA? Generally CAs are obligated to revoke certificates within tight deadlines (ex. 24hr for key compromise). That doesn't give a human a lot of time to replace the certificate. * What's going to happen when 2-year certs are no long available? Ballot SC-22 failed, but it would've reduced certificate lifetimes to 1 year. Some CAs are moving in this direction anyway, and it's worth noting that Sectigo supported this ballot. * What happens when the person responsible for renewing them leaves the company and forgets to hand-off the responsibility? I almost see the infrequency of certificate rotation as a negative since it means the process is infrequently tested and easy to forget about. Sure tools like cerbot can break, but if you know that it's renewing certificates 30 days out then setup alerting for whenever a certificate expires in less than 30 days. You should have this alerting anyway in case the human responsible for manual rotation forgets. If you ended up in a state where you were serving an expired certificate then the key issue is your alerting.
    - 7y ago

a regular certificate. For example you could buy a Sectigo (previously Comodo) certificate for 2 years for like 17$ or so. Wildcard for 2 years is like 100$. Its worth less than a broken certificate.

ridhoq 7y ago

I’ve had a pretty terrible experience with Sectigo/Comodo over the last few months, especially thru their acquisition. At the moment, I have certificates that are managed in two different portals, one for their previous brand and one for their new brand. Customer support told me that there is no migration path to manage my certs all in one place. We are going to repurchase all of our certs in Digicert this year with which I’ve had a much much better experience. They are well integrated with Azure Key Vault which allows us to automate certificate renewal and our AKS clusters will automatically get the new certs without us doing anything.

sandGorgon 7y ago
sure - i will take temporary usability issues (as comodo transitioned into sectigo), over fundamental security issues. https://www.theregister.co.uk/2018/03/01/trustico_digicert_symantec_spat/ https://www.theregister.co.uk/2018/03/01/trustico_digicert_s... if you are using your cloud certificates (built into lb, etc), then this is a moot point. You dont even need letsencrypt then.

krenel 7y ago

Those prices look promising. I don't seem to find where those prices are in their webpage[1]. All I'm seeing is 359/719 USD a year for a wildcard certificate. Am I looking in the wrong place? [1] https://www.comodoca.com/ssl-certificate-comparison?key5sk1=c147eebcd9fd6d57566e0c69838a2d324ceb2f01 https://www.comodoca.com/ssl-certificate-comparison?key5sk1=...

sandGorgon 7y ago
i usually buy from https://www.namecheap.com/security/ssl-certificates/ https://www.namecheap.com/security/ssl-certificates/ or https://www.gogetssl.com/wildcard-ssl/ https://www.gogetssl.com/wildcard-ssl/

devrand 7y ago

What do you use to automatically rotate the certificates from Sectigo? This doesn't seem to be a set it and forget it solution. Also, with Sectigo you're more likely to get an actual broken certificate. They misissued nearly every certificate starting from 2002 until late 2019 [1]. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1593776 https://bugzilla.mozilla.org/show_bug.cgi?id=1593776

sandGorgon 7y ago
We rotate them manually once every two years. It works. No need for a certbot. Simpler infrastructure Sure about the broken, but the alternatives are worse with possible leaked private keys.
- devrand 7y ago
  How is that simpler? That seems like it doesn't scale and incredibly error prone. If you only have one certificate you may get away with it. But if once you have hundreds or thousands this is absolutely going to break down the human factor. And even if you do have a single (or few) certificate(s), there are other factors that are going to complicate maintaining this system: * What if a certificate needs to be revoked by your CA? Generally CAs are obligated to revoke certificates within tight deadlines (ex. 24hr for key compromise). That doesn't give a human a lot of time to replace the certificate. * What's going to happen when 2-year certs are no long available? Ballot SC-22 failed, but it would've reduced certificate lifetimes to 1 year. Some CAs are moving in this direction anyway, and it's worth noting that Sectigo supported this ballot. * What happens when the person responsible for renewing them leaves the company and forgets to hand-off the responsibility? I almost see the infrequency of certificate rotation as a negative since it means the process is infrequently tested and easy to forget about. Sure tools like cerbot can break, but if you know that it's renewing certificates 30 days out then setup alerting for whenever a certificate expires in less than 30 days. You should have this alerting anyway in case the human responsible for manual rotation forgets. If you ended up in a state where you were serving an expired certificate then the key issue is your alerting.
  - 7y ago