4 ms·

'The web' isn't using HTTPS since SSL is a nice yearly 'tax' on the domain owner. It seems to me we have a nice centralized monopoly here with the existing Cer

'The web' isn't using HTTPS since SSL is a nice yearly 'tax' on the domain owner. It seems to me we have a nice centralized monopoly here with the existing Certificate Authorities (most US-centric) for something as decentralized as the internet. Why can't the domain name registrar give me a SSL cert for free? I mean, if I did buy a domain name, and I'm able to change the records, it's pretty clear I own the thing. Certificate info should just be a DNS record imho. Regarding identity checks, there are other stupidities I see here: for example, my company has to send monthly/yearly papers to the government entities (some of which get publishes into some official government papers). Why can't I publish my public key there? I mean, if anything, it's very bureaucratic to do anything involving public institutions so each paper is stamped, checked, etc. I would trust more a local clerk to check for identity then some US guy that has never in his life actually seen a deed of incorporation for a Romanian entity. So, yeah, I would love to have my site with HTTPS and to sign all my JARs and emails but until this becomes more sane or my customers actually start demanding it, I'm not going to waste money on that.

bsdbuddy 16y ago
Although I absolutely agree with your whole comment, I would just like to add one point. If you doing online business, and successfully, the yearly charge shouldn't be such an issue. However, for non-profit websites its absolutely out of the question. I'm curious - as your customers aren't demanding SSL what industry are you in?
- fierarul 16y ago
  Well, the yearly charge isn't such an issue, but I cringe knowing I could pay a small server for an year of uptime with the money I pay for an SSL cert, which is essentially an official stamp of a member of the CA oligarchy. I mostly do contract work so I don't need SSL on my front-facing sites. We do use sites that have SSL to send deliverables and such, but I just pay for their service, not for the cert itself. Internally we've also used self-signed certs, our own CA or just SSH port forwarding. As an industry we should move towards encription but away from the current CA model. Somehow everybody portrays it as if it's the same thing.
  - T-hawk 16y ago
    Encryption in itself does little good without a certification authority model. Without a mathematically robust CA chain, you never know if you're sending your encrypted traffic to your intended target or to a man-in-the-middle attacker pretending to be your target. Encryption protects against a passive sniffer but not a party capable of intercepting messages.
JonnieCache 16y ago
>Why can't the domain name registrar give me a SSL cert for free? http://www.startssl.com/ http://www.startssl.com/ will give you a free class one SSL cert that works in all major browsers. They will also sell you a class 2 cert with wildcard support for $49 a year. These can cost $800+ in other places IIRC. They are trying valiantly to destroy the entrenched price structure of the SSL cert market and I wish them the best of luck.
- mooism2 16y ago
  Their website says their certs work in all major browsers, but I can't find anywhere where it says which versions of those major browsers it works with. E.g. it works with Internet Explorer. Does that include IE6? They don't say.
  - JonnieCache 16y ago
    They're free, why not try it and find out? ;) But yes, as far as I remember, they do work on IE6. The root certs dont really change between browser versions I think, its more a matter of the the different vendors.
    - yuhong 16y ago
      To be more precise, IE uses the SSL libs built-in to Windows since 2000. As a result the list of trusted root CAs is built-in too. MS added StartCom to the list in 2009.
mukyu 16y ago
The EFF[1] mapped out the CA structure of the internet and it is easy to see it is anything but a monopoly or US-centric. [2] DNS is not used for key storage as DNS is not authenticated. There is nothing stopping your registrar from being a CA and issuing you certificates. SSL certs are assigned to specific domain names. The CA really doesn't need to care if you are a Fooian Industries registered as a Romanian company. They are only interested in if you are the proper owner of fooian-ind.com. That your local government official knows that you are fierarul is of no value in determining if the cert someone sent me for fooian-ind.com is the correct one for fooian-ind.com. The infrastructure to support SSL is the result of a large number of smart people sitting down together and working out solutions. Chances are that any deficiencies or alternative solutions you may think of were considered or result from your lack of understanding. It is clearly arrogant to think otherwise. [1] http://www.eff.org/observatory http://www.eff.org/observatory [2] http://www.eff.org/files/colour_map_of_CAs.pdf http://www.eff.org/files/colour_map_of_CAs.pdf
- fierarul 16y ago
  I think I've stumbled upon that EFF link at some point, but I didn't study it very much. The CA graph they list there is nice, but it doesn't say much since many of the CAs there don't actually sell to consumers certificates, no? Looking at this PDF[1] I see on page 23 that there are about 30 root CAs that have signed more that 1000 certificates. And (from page 21) it seems to me that the providers are very much US centric. With regard to what does the SSL cert contain, I don't know much about this field, but I do know that the certificate may present and organization name and address/state/country. Hence I assume, identity also matters for some besides just domain ownership. Anyhow, I'm not claiming I've found a better solution than the smart guys sitting down and working out solutions, but I do find annoying that the solution they found is so expensive for commoners. As an armchair discussion, I still think that certificate info seems best to belong into a DNS record. DNSSEC perhaps could help with this? 1. https://www.eff.org/files/DefconSSLiverse.pdf https://www.eff.org/files/DefconSSLiverse.pdf

bsdbuddy 16y ago

Although I absolutely agree with your whole comment, I would just like to add one point. If you doing online business, and successfully, the yearly charge shouldn't be such an issue. However, for non-profit websites its absolutely out of the question. I'm curious - as your customers aren't demanding SSL what industry are you in?

fierarul 16y ago
Well, the yearly charge isn't such an issue, but I cringe knowing I could pay a small server for an year of uptime with the money I pay for an SSL cert, which is essentially an official stamp of a member of the CA oligarchy. I mostly do contract work so I don't need SSL on my front-facing sites. We do use sites that have SSL to send deliverables and such, but I just pay for their service, not for the cert itself. Internally we've also used self-signed certs, our own CA or just SSH port forwarding. As an industry we should move towards encription but away from the current CA model. Somehow everybody portrays it as if it's the same thing.
- T-hawk 16y ago
  Encryption in itself does little good without a certification authority model. Without a mathematically robust CA chain, you never know if you're sending your encrypted traffic to your intended target or to a man-in-the-middle attacker pretending to be your target. Encryption protects against a passive sniffer but not a party capable of intercepting messages.

JonnieCache 16y ago

>Why can't the domain name registrar give me a SSL cert for free? http://www.startssl.com/ http://www.startssl.com/ will give you a free class one SSL cert that works in all major browsers. They will also sell you a class 2 cert with wildcard support for $49 a year. These can cost $800+ in other places IIRC. They are trying valiantly to destroy the entrenched price structure of the SSL cert market and I wish them the best of luck.

mooism2 16y ago
Their website says their certs work in all major browsers, but I can't find anywhere where it says which versions of those major browsers it works with. E.g. it works with Internet Explorer. Does that include IE6? They don't say.
- JonnieCache 16y ago
  They're free, why not try it and find out? ;) But yes, as far as I remember, they do work on IE6. The root certs dont really change between browser versions I think, its more a matter of the the different vendors.
  - yuhong 16y ago
    To be more precise, IE uses the SSL libs built-in to Windows since 2000. As a result the list of trusted root CAs is built-in too. MS added StartCom to the list in 2009.

mukyu 16y ago

The EFF[1] mapped out the CA structure of the internet and it is easy to see it is anything but a monopoly or US-centric. [2] DNS is not used for key storage as DNS is not authenticated. There is nothing stopping your registrar from being a CA and issuing you certificates. SSL certs are assigned to specific domain names. The CA really doesn't need to care if you are a Fooian Industries registered as a Romanian company. They are only interested in if you are the proper owner of fooian-ind.com. That your local government official knows that you are fierarul is of no value in determining if the cert someone sent me for fooian-ind.com is the correct one for fooian-ind.com. The infrastructure to support SSL is the result of a large number of smart people sitting down together and working out solutions. Chances are that any deficiencies or alternative solutions you may think of were considered or result from your lack of understanding. It is clearly arrogant to think otherwise. [1] http://www.eff.org/observatory http://www.eff.org/observatory [2] http://www.eff.org/files/colour_map_of_CAs.pdf http://www.eff.org/files/colour_map_of_CAs.pdf

fierarul 16y ago
I think I've stumbled upon that EFF link at some point, but I didn't study it very much. The CA graph they list there is nice, but it doesn't say much since many of the CAs there don't actually sell to consumers certificates, no? Looking at this PDF[1] I see on page 23 that there are about 30 root CAs that have signed more that 1000 certificates. And (from page 21) it seems to me that the providers are very much US centric. With regard to what does the SSL cert contain, I don't know much about this field, but I do know that the certificate may present and organization name and address/state/country. Hence I assume, identity also matters for some besides just domain ownership. Anyhow, I'm not claiming I've found a better solution than the smart guys sitting down and working out solutions, but I do find annoying that the solution they found is so expensive for commoners. As an armchair discussion, I still think that certificate info seems best to belong into a DNS record. DNSSEC perhaps could help with this? 1. https://www.eff.org/files/DefconSSLiverse.pdf https://www.eff.org/files/DefconSSLiverse.pdf