4 ms·

Signing up for a SSL certificate using your own credentials and then letting a third-party distribute and use your private key on an arbitrary number of systems

Signing up for a SSL certificate using your own credentials and then letting a third-party distribute and use your private key on an arbitrary number of systems you have no control over is bordering on fraud.

alecco 18y ago
We are talking about a cloud service and the same company's CDN system. They already would have said certificates running possibly in multiple hosts. How do you get to "bordering on fraud" from there? FAIL (Because of your reply tone, please try to be more civilized next time, shame on your up-voters too.)
- briansmith 18y ago
  If I give my certificate that says "this is Brian Smith" to Amazon, and then Amazon uses it to claim to be me, then that is very misleading. It is very similar to me giving my driver's license to my underage brother so he can buy me beer. If CloudShare used its own "this is Amazon.com's Cloudshare Service" certificate then it might be okay, except (1) they would be using it to sign content that they haven't verified the authenticity of, which is misleading (like notarizing something without any authentication), and (2) you almost always need to mix those static assets with dynamic assets or HTML forms and that all has to happen on the same domain--the domain that receives the POST requests, not the CDN's domain--in order for things to work reliably. As for tone: the tone with which I wrote my reply is apparently not the same as the tone with which you read it.
  - alecco 18y ago
    No (x3)
- icey 18y ago
  FAIL (Because of your reply tone, please try to be more civilized next time, shame on your up-voters too.) Not everyone is interested in making sure your feelings don't get hurt on the internet. The sooner you realize that, the better off you'll be.
  - deleted 18y ago
    [deleted]
zmimon 18y ago
Hold on, who says you are handing over the private key? I would definitely like to use a CDN with SSL sites. I am happy for the domain to be amazon's (or cloudfront, whatever) signed with their cert, I just don't want the browser security to be broken by having non-SSL content on the page. Is there something wrong with this?
- briansmith 18y ago
  Mixing objects signed by different certs works the same way as having non-SSL content on the page.

alecco 18y ago

We are talking about a cloud service and the same company's CDN system. They already would have said certificates running possibly in multiple hosts. How do you get to "bordering on fraud" from there? FAIL (Because of your reply tone, please try to be more civilized next time, shame on your up-voters too.)

briansmith 18y ago
If I give my certificate that says "this is Brian Smith" to Amazon, and then Amazon uses it to claim to be me, then that is very misleading. It is very similar to me giving my driver's license to my underage brother so he can buy me beer. If CloudShare used its own "this is Amazon.com's Cloudshare Service" certificate then it might be okay, except (1) they would be using it to sign content that they haven't verified the authenticity of, which is misleading (like notarizing something without any authentication), and (2) you almost always need to mix those static assets with dynamic assets or HTML forms and that all has to happen on the same domain--the domain that receives the POST requests, not the CDN's domain--in order for things to work reliably. As for tone: the tone with which I wrote my reply is apparently not the same as the tone with which you read it.
- alecco 18y ago
  No (x3)
icey 18y ago
FAIL (Because of your reply tone, please try to be more civilized next time, shame on your up-voters too.) Not everyone is interested in making sure your feelings don't get hurt on the internet. The sooner you realize that, the better off you'll be.
- deleted 18y ago
  [deleted]

zmimon 18y ago

Hold on, who says you are handing over the private key? I would definitely like to use a CDN with SSL sites. I am happy for the domain to be amazon's (or cloudfront, whatever) signed with their cert, I just don't want the browser security to be broken by having non-SSL content on the page. Is there something wrong with this?

briansmith 18y ago
Mixing objects signed by different certs works the same way as having non-SSL content on the page.