5 ms·

What is she talking about that you have to pay for certs if you want more than 3? Am I about to get a bill for the past 5 years or did she just misunderstand?

by dwedge 1y ago

deleted 1y ago
[deleted]
belorn 1y ago
to quote the article (or rather, the 2023 article which is the one mentioning the number 3). "Somehow, a couple of weeks ago, I found this other site which claimed to be better than LE and which used relatively simple HTTP requests without a bunch of funny data types." "This is when the fine print finally appeared. This service only lets you mint 90 day certificates on the free tier. Also, you can only do three of them. Then you're done. 270 days for one domain or 3 domains for 90 days, and then you're screwed. Isn't that great? " She don't mention what this "other site" is.
- jchw 1y ago
  FWIW, it is ZeroSSL. I want there to be more major ACME providers than just LE, but I'm not sure about ZeroSSL, personally. It seems to have the same parent company as IdenTrust (HID Global Corporation). Probably a step up from Honest Achmed but recently I recall people complaining that their EV code signing certificates were not actually trusted by Windows which is... Interesting.
  - killjoywashere 1y ago
    IdenTrust participates in the US Federal PKI ecosystem, so they likely have strong incentives to charge exorbitantly. Those free certs are probably meant to facilitate development of gov-specific capabilities by random subcontractors long enough to figure out how to structure a contract mod that passes the anticipated cost onto the government. Don’t hate the player, hate the game.
  - AStonesThrow 1y ago
    > Honest Achmed I had to stop and Google that, wondering if it was a pastiche of “Akbar & Jeff’s Certificate Hut”... https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959
    - jchw 1y ago
      I'm glad to give you an xkcd 1053 moment. Honest Achmed is one for the books.
  - nickf 1y ago
    ZeroSSL is owned by Identrust, but the infra is operated by another CA. Also Microsoft killed EV codesigning early last year - not stopping it working, just making it identical to ‘normal’ codesigning certs.
    - mkup 1y ago
      Could you please provide more info on this topic, e.g. a link? I intended to buy EV code signing certificate as a sole proprietor to fix long-standing problem with my software when Windows Defender pops up every time I release a new version. Is EV code signing certificate no longer a viable solution to this problem? Is there no longer a difference between EV and non-EV code signing certificate?
      - nickf 1y ago
        Sure: https://learn.microsoft.com/en-us/security/trusted-root/program-requirements#3-program-technical-requirements https://learn.microsoft.com/en-us/security/trusted-root/prog... 3.D.3 covers the details about EV CS.
      - Moni_Mac 1y ago
        After Microsoft's March 2024 update, EV Code signing certs don't offer instant Microsoft Defender reputation. Now, OV and EV both code signing certificates can be installed and stored on FIPS 140 Level 2 or Common Criteria EAL 4+ certified HSM, tokens, or cloud HSMs. So, you can consider EV Code Signing as higher security and higher validation with no more difference. If u want to buy code signing at affordable cost, I recommend: https://signmycode.com/cheap-code-signing-certificates https://signmycode.com/cheap-code-signing-certificates
  - arccy 1y ago
    Google's CA offers them for free via ACME https://pki.goog/ https://pki.goog/
    - jchw 1y ago
      That's pretty cool, though it does seem that you need to authenticate with a GCP account. A little bit less convenient. I do think there are actually a few other providers of ACME out there that require registration beforehand, ZeroSSL actually offers it without pre-registration like Let's Encrypt.
  - rmetzler 1y ago
    A while ago I saw that acme.sh now uses ZeroSSL by default. https://github.com/acmesh-official/acme.sh/blob/42bbd1b44af48a5accce07fa51740644b1c5f0a0/acme.sh#L38 https://github.com/acmesh-official/acme.sh/blob/42bbd1b44af4...
    - _hyn3 1y ago
      "We now have another confirmation on Twitter that remote code is executed and a glimpse into what the script is... it appears to be benign." https://github.com/acmesh-official/acme.sh/issues/4659 https://github.com/acmesh-official/acme.sh/issues/4659 It was not. Don't use acme.sh.
      - rsync 1y ago
        I went down the acme/HiCA/RCE rabbit hole a year or so ago and, while I don't remember the specifics, my feeling was that the RCE was not that dangerous and was put into place by greedy scammers thwarting the rules of cert (re)selling and not by shadowy actors trying to infiltrate sensitive infra ... Is there new information ? Was my impression wrong ?
  - birktj 1y ago
    Buypass provides ACME certificates as well [1]. The usage limits are not quite as generous as LE, but they work pretty well in my experience. [1] https://www.buypass.com/products/tls-ssl-certificates/read-more-go-ssl-acme https://www.buypass.com/products/tls-ssl-certificates/read-m...

What is she talking about that you have to pay for certs if you want more than 3? Am I about to get a bill for the past 5 years or did she just misunderstand?

by dwedge 1y ago

What is she talking about that you have to pay for certs if you want more than 3? Am I about to get a bill for the past 5 years or did she just misunderstand?

deleted 1y ago

[deleted]

belorn 1y ago

to quote the article (or rather, the 2023 article which is the one mentioning the number 3). "Somehow, a couple of weeks ago, I found this other site which claimed to be better than LE and which used relatively simple HTTP requests without a bunch of funny data types." "This is when the fine print finally appeared. This service only lets you mint 90 day certificates on the free tier. Also, you can only do three of them. Then you're done. 270 days for one domain or 3 domains for 90 days, and then you're screwed. Isn't that great? " She don't mention what this "other site" is.

jchw 1y ago
FWIW, it is ZeroSSL. I want there to be more major ACME providers than just LE, but I'm not sure about ZeroSSL, personally. It seems to have the same parent company as IdenTrust (HID Global Corporation). Probably a step up from Honest Achmed but recently I recall people complaining that their EV code signing certificates were not actually trusted by Windows which is... Interesting.
- killjoywashere 1y ago
  IdenTrust participates in the US Federal PKI ecosystem, so they likely have strong incentives to charge exorbitantly. Those free certs are probably meant to facilitate development of gov-specific capabilities by random subcontractors long enough to figure out how to structure a contract mod that passes the anticipated cost onto the government. Don’t hate the player, hate the game.
- AStonesThrow 1y ago
  > Honest Achmed I had to stop and Google that, wondering if it was a pastiche of “Akbar & Jeff’s Certificate Hut”... https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959
  - jchw 1y ago
    I'm glad to give you an xkcd 1053 moment. Honest Achmed is one for the books.
- nickf 1y ago
  ZeroSSL is owned by Identrust, but the infra is operated by another CA. Also Microsoft killed EV codesigning early last year - not stopping it working, just making it identical to ‘normal’ codesigning certs.
  - mkup 1y ago
    Could you please provide more info on this topic, e.g. a link? I intended to buy EV code signing certificate as a sole proprietor to fix long-standing problem with my software when Windows Defender pops up every time I release a new version. Is EV code signing certificate no longer a viable solution to this problem? Is there no longer a difference between EV and non-EV code signing certificate?
    - nickf 1y ago
      Sure: https://learn.microsoft.com/en-us/security/trusted-root/program-requirements#3-program-technical-requirements https://learn.microsoft.com/en-us/security/trusted-root/prog... 3.D.3 covers the details about EV CS.
    - Moni_Mac 1y ago
      After Microsoft's March 2024 update, EV Code signing certs don't offer instant Microsoft Defender reputation. Now, OV and EV both code signing certificates can be installed and stored on FIPS 140 Level 2 or Common Criteria EAL 4+ certified HSM, tokens, or cloud HSMs. So, you can consider EV Code Signing as higher security and higher validation with no more difference. If u want to buy code signing at affordable cost, I recommend: https://signmycode.com/cheap-code-signing-certificates https://signmycode.com/cheap-code-signing-certificates
- arccy 1y ago
  Google's CA offers them for free via ACME https://pki.goog/ https://pki.goog/
  - jchw 1y ago
    That's pretty cool, though it does seem that you need to authenticate with a GCP account. A little bit less convenient. I do think there are actually a few other providers of ACME out there that require registration beforehand, ZeroSSL actually offers it without pre-registration like Let's Encrypt.
- rmetzler 1y ago
  A while ago I saw that acme.sh now uses ZeroSSL by default. https://github.com/acmesh-official/acme.sh/blob/42bbd1b44af48a5accce07fa51740644b1c5f0a0/acme.sh#L38 https://github.com/acmesh-official/acme.sh/blob/42bbd1b44af4...
  - _hyn3 1y ago
    "We now have another confirmation on Twitter that remote code is executed and a glimpse into what the script is... it appears to be benign." https://github.com/acmesh-official/acme.sh/issues/4659 https://github.com/acmesh-official/acme.sh/issues/4659 It was not. Don't use acme.sh.
    - rsync 1y ago
      I went down the acme/HiCA/RCE rabbit hole a year or so ago and, while I don't remember the specifics, my feeling was that the RCE was not that dangerous and was put into place by greedy scammers thwarting the rules of cert (re)selling and not by shadowy actors trying to infiltrate sensitive infra ... Is there new information ? Was my impression wrong ?
- birktj 1y ago
  Buypass provides ACME certificates as well [1]. The usage limits are not quite as generous as LE, but they work pretty well in my experience. [1] https://www.buypass.com/products/tls-ssl-certificates/read-more-go-ssl-acme https://www.buypass.com/products/tls-ssl-certificates/read-m...