4 ms·

Anyone can create a certificate with any duration they like. Getting others to trust that certificate is the tricky bit. These "large companies" put restrictio

Anyone can create a certificate with any duration they like. Getting others to trust that certificate is the tricky bit. These "large companies" put restrictions on what certificate authorities are allowed to do so that they can keep their users safe.

aestetix 2y ago
Safety at the expense of personal freedom to choose for yourself? What if I do not want the "safety" that these "large companies" claim to provide?
- nolist_policy 2y ago
  Spin up your own (possibly private) CA.
- nightpool 2y ago
  You're welcome to compile your own Firefox or Chromium build if you disagree with the trust decisions the default ones make.
rightbyte 2y ago
[flagged]
- aestetix 2y ago
  Also in this case, "safety" can be defined as protecting American companies from lawsuits while ensuring they continue to make lots of money from extorting SSL certificate sales.
  - gruez 2y ago
    >while ensuring they continue to make lots of money from extorting SSL certificate sales. Which IaaS/PaaS providers are doing this? Most of the popular ones I know (ie. not some shady shared hosting reseller using whmcs solutions) lets you upload whatever certificate you want, or has certificates for free/included in the monthly price. In other words they're not going to benefit from shorter lived certificates. In the worst case you can set up cloudflare "flexible SSL" in front of your site and get it for free.
  - deleted 2y ago
    [deleted]
- Dylan16807 2y ago
  > Shorter expiration gives more power to the SaaS vendors. Please explain how.
  - rightbyte 2y ago
    You'd need to communicate with some CA more often. I feel there is some sort of push for more and more complexity by Google et al. which in the end hurts the users. It is about control. Like Google's failed amp-push. On a unrelated note encryption seem to be pushed to hide what my or the families devices do from me. E.g. encrypted HTTP and DNS to prevent me from snooping on the devices on my own network. Only Google and the gov. can do that, etc.
    - SahAssar 2y ago
      A lot of CAs are non-american. Also not sure how encrypted HTTP and DNS allows google to snoop on your traffic? If you don't trust google then don't use their eDNS service?
    - Dylan16807 2y ago
      I don't really see how this argument applies to SaaS in general, though.

aestetix 2y ago

Safety at the expense of personal freedom to choose for yourself? What if I do not want the "safety" that these "large companies" claim to provide?

nolist_policy 2y ago
Spin up your own (possibly private) CA.
nightpool 2y ago
You're welcome to compile your own Firefox or Chromium build if you disagree with the trust decisions the default ones make.

rightbyte 2y ago

[flagged]

aestetix 2y ago
Also in this case, "safety" can be defined as protecting American companies from lawsuits while ensuring they continue to make lots of money from extorting SSL certificate sales.
- gruez 2y ago
  >while ensuring they continue to make lots of money from extorting SSL certificate sales. Which IaaS/PaaS providers are doing this? Most of the popular ones I know (ie. not some shady shared hosting reseller using whmcs solutions) lets you upload whatever certificate you want, or has certificates for free/included in the monthly price. In other words they're not going to benefit from shorter lived certificates. In the worst case you can set up cloudflare "flexible SSL" in front of your site and get it for free.
- deleted 2y ago
  [deleted]
Dylan16807 2y ago
> Shorter expiration gives more power to the SaaS vendors. Please explain how.
- rightbyte 2y ago
  You'd need to communicate with some CA more often. I feel there is some sort of push for more and more complexity by Google et al. which in the end hurts the users. It is about control. Like Google's failed amp-push. On a unrelated note encryption seem to be pushed to hide what my or the families devices do from me. E.g. encrypted HTTP and DNS to prevent me from snooping on the devices on my own network. Only Google and the gov. can do that, etc.
  - SahAssar 2y ago
    A lot of CAs are non-american. Also not sure how encrypted HTTP and DNS allows google to snoop on your traffic? If you don't trust google then don't use their eDNS service?
  - Dylan16807 2y ago
    I don't really see how this argument applies to SaaS in general, though.