5 ms·

Does anyone else feel like SSL certificates are a giant scam? Companies like Microsoft are king-makers so they essentially get to pick and choose who gets to b

Does anyone else feel like SSL certificates are a giant scam? Companies like Microsoft are king-makers so they essentially get to pick and choose who gets to be a "trusted" certificate authority, and therefore we wind up with a competition-less market. Many of these companies claim this excess cost (over the technical costs which are low) are the result of having to verify people are who they say they are. But in my experience, from buying certificates, certificate authorities never do this (or at least don't manually do it). In fact Amazon did far more verification when I signed up to AWS than any certificate authority ever has... They also charge more for different kinds of certificates (e.g. like this "sale") even if their costs are identical. This is just a nonsense way to up-sell a product that already has a markup likely in the thousands of percentage. Honestly any SSL certificate which costs more than $5~10 is a rip-off.

darklajid 14y ago
Yes. Most Linux distributions I've used recently come with a pre-configured self-signed certificate called 'snakeoil'. I'm not sure if the 5-10 number is really okay for a _decent_ validation process, but I'd argue that it's really, really a sign of a crappy industry if only StartSSL offers a free/cheap way to get a simple, low-trust certificate for your site. If we leave the scope of ssl and enter code-signing I'm even less happy with the trend.. There was a nice write-up on the Windows 8 'market' a while ago which complained about that stuff, among other things.
ck2 14y ago
We need to replace certs with DANE DANE is basically SSL authentication via the cert in DNS Get rid of third parties. https://datatracker.ietf.org/wg/dane/charter/ https://datatracker.ietf.org/wg/dane/charter/ Problem is it needs DNSSEC, but we are going to need that sooner or later anyway.
- sneak 14y ago
  For this to be truly safe, we need DANE and to stop using .com/.net/.org as the US government will (demonstrably) hijack those as required without due process. DANE + DNSSEC + soverign TLDd might solve this problem - emphasis on might.
- drostie 14y ago
  In the meantime, for SSL on team projects which are not yet released-to-the-public, there is a web-of-trust certificate issuer called CAcert.org which can be installed on relevant machines and used. At one point they were trying to pass an audit and get into Firefox, so perhaps someday they can become a default for web browsers. If they cannot, then perhaps a sufficiently motivated group could set up a similar authority. Ideally, the flow would be much simpler than even CACert has made it; you ask for a certificate for drostie.org, the CA does a WHOIS for the administrative contact for that domain; the CA sends an email to that domain name containing a link to confirm the request; if you visit the link then you can upload a public key and perhaps even generate a private key (via client-side javascript, of course -- you don't want to send such things to the server). I don't know whether you could make it pass a security audit and get into major browsers -- but I like the idea that this could be much more user-friendly than it is.
- geofft 14y ago
  Moxie Marlinspike has an excellent argument that DANE doesn't make the problem better, it makes it worse, by concentrating all power in the hands of a single third party. http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...
nickf 14y ago
Companies like Microsoft are king-makers so they essentially get to pick and choose who gets to be a "trusted" certificate authority, and therefore we wind up with a competition-less market. Not really. Each browser and OS has it's own benchmark to be included as a root CA, and it's certainly not a 'pick and choose' thing. There are clearly defined rules for each, most of them relying on an independent audit to either WebTrust or an ETSI standard - neither of which are particularly 'easy' or 'cheap'. You're welcome to go and get an audit, set up your CA infrastructure and apply to MS and become a 'trusted' CA. Then you just have to repeat that for all the other big software/OS vendors, and then wait a few years till those versions in which you're included are in wide distribution (or not, as things like Windows have an auto-update mechanism and the auto-update of Firefox and the like are making the process much easier!). Many of these companies claim this excess cost There is an inherent cost in the verification of some certificates. Sometimes, it's just an automated domain-verification. Certificates are often sold on the level of verification performed - and in some cases the browsers treat these differently and display different UI chrome as a result. (over the technical costs which are low) Again, not really. It's certainly not a low cost to have an infrastructure to pass one of the aforementioned audits. Not only that, there are some significant costs in supporting the revocation infrastructure - especially if you happen to have a certificate on a high-traffic site (think Twitter, any of Apple/Microsoft/Amazon etc.) You'll have to support both a CRL infrastructure (TB a day of transfer) and an OCSP infrastructure (not as much transfer, but not 'just' static files). We're taking tens to hundreds of thousands of hits/second. But in my experience, from buying certificates, certificate authorities never do this Ignoring that the plural of 'anecdote' is not 'evidence', I'd say that there certainly are certificates where the ordering process is very simple and has nothing more than a domain-ownership confirmation. There's probably more verification in the payment end. However, getting an EV certificate does contain a significant verification process that sadly isn't the easiest. Code-signing certs tend to require a bit more in the way of ID verification also. Honestly any SSL certificate which costs more than $5~10 is a rip-off If you don't want to pay 'extortionate' costs for a certificate, try offers like this - or as someone else suggested below, StartCom - Eddy runs a great company and gives away a lot of certificates and charges minimal costs for the rest. 'Course, we should always buy things based on what we think they should cost, not what they actually do... Disclaimer: I work for a CA. Just wanting to add a viewpoint from the 'other side'. I won't disagree we're a reasonably un-liked industry in places (HN especially!). There are a few misconceptions, though.
Jamiecon 14y ago
Yes I do, although in fairness my experience has been that Verisign and Thawte at least will ring the number you provide at some stage. I guess they also do a Companies House[0] lookup in the UK as they request related details IIRC. What's more of a scandal is that Verisign at least 'license' their EV certificates to be used on a given number of servers [1]. Now if the 'service' provided is identity verification, that practice is the real scam. [0] http://www.companieshouse.gov.uk/ http://www.companieshouse.gov.uk/ [1] http://www.verisign.co.uk/ssl/ssl-information-center/ssl-basics/index.html#a16 http://www.verisign.co.uk/ssl/ssl-information-center/ssl-bas...

darklajid 14y ago

Yes. Most Linux distributions I've used recently come with a pre-configured self-signed certificate called 'snakeoil'. I'm not sure if the 5-10 number is really okay for a _decent_ validation process, but I'd argue that it's really, really a sign of a crappy industry if only StartSSL offers a free/cheap way to get a simple, low-trust certificate for your site. If we leave the scope of ssl and enter code-signing I'm even less happy with the trend.. There was a nice write-up on the Windows 8 'market' a while ago which complained about that stuff, among other things.

ck2 14y ago

We need to replace certs with DANE DANE is basically SSL authentication via the cert in DNS Get rid of third parties. https://datatracker.ietf.org/wg/dane/charter/ https://datatracker.ietf.org/wg/dane/charter/ Problem is it needs DNSSEC, but we are going to need that sooner or later anyway.

sneak 14y ago
For this to be truly safe, we need DANE and to stop using .com/.net/.org as the US government will (demonstrably) hijack those as required without due process. DANE + DNSSEC + soverign TLDd might solve this problem - emphasis on might.
drostie 14y ago
In the meantime, for SSL on team projects which are not yet released-to-the-public, there is a web-of-trust certificate issuer called CAcert.org which can be installed on relevant machines and used. At one point they were trying to pass an audit and get into Firefox, so perhaps someday they can become a default for web browsers. If they cannot, then perhaps a sufficiently motivated group could set up a similar authority. Ideally, the flow would be much simpler than even CACert has made it; you ask for a certificate for drostie.org, the CA does a WHOIS for the administrative contact for that domain; the CA sends an email to that domain name containing a link to confirm the request; if you visit the link then you can upload a public key and perhaps even generate a private key (via client-side javascript, of course -- you don't want to send such things to the server). I don't know whether you could make it pass a security audit and get into major browsers -- but I like the idea that this could be much more user-friendly than it is.
geofft 14y ago
Moxie Marlinspike has an excellent argument that DANE doesn't make the problem better, it makes it worse, by concentrating all power in the hands of a single third party. http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

nickf 14y ago

Companies like Microsoft are king-makers so they essentially get to pick and choose who gets to be a "trusted" certificate authority, and therefore we wind up with a competition-less market. Not really. Each browser and OS has it's own benchmark to be included as a root CA, and it's certainly not a 'pick and choose' thing. There are clearly defined rules for each, most of them relying on an independent audit to either WebTrust or an ETSI standard - neither of which are particularly 'easy' or 'cheap'. You're welcome to go and get an audit, set up your CA infrastructure and apply to MS and become a 'trusted' CA. Then you just have to repeat that for all the other big software/OS vendors, and then wait a few years till those versions in which you're included are in wide distribution (or not, as things like Windows have an auto-update mechanism and the auto-update of Firefox and the like are making the process much easier!). Many of these companies claim this excess cost There is an inherent cost in the verification of some certificates. Sometimes, it's just an automated domain-verification. Certificates are often sold on the level of verification performed - and in some cases the browsers treat these differently and display different UI chrome as a result. (over the technical costs which are low) Again, not really. It's certainly not a low cost to have an infrastructure to pass one of the aforementioned audits. Not only that, there are some significant costs in supporting the revocation infrastructure - especially if you happen to have a certificate on a high-traffic site (think Twitter, any of Apple/Microsoft/Amazon etc.) You'll have to support both a CRL infrastructure (TB a day of transfer) and an OCSP infrastructure (not as much transfer, but not 'just' static files). We're taking tens to hundreds of thousands of hits/second. But in my experience, from buying certificates, certificate authorities never do this Ignoring that the plural of 'anecdote' is not 'evidence', I'd say that there certainly are certificates where the ordering process is very simple and has nothing more than a domain-ownership confirmation. There's probably more verification in the payment end. However, getting an EV certificate does contain a significant verification process that sadly isn't the easiest. Code-signing certs tend to require a bit more in the way of ID verification also. Honestly any SSL certificate which costs more than $5~10 is a rip-off If you don't want to pay 'extortionate' costs for a certificate, try offers like this - or as someone else suggested below, StartCom - Eddy runs a great company and gives away a lot of certificates and charges minimal costs for the rest. 'Course, we should always buy things based on what we think they should cost, not what they actually do... Disclaimer: I work for a CA. Just wanting to add a viewpoint from the 'other side'. I won't disagree we're a reasonably un-liked industry in places (HN especially!). There are a few misconceptions, though.

Jamiecon 14y ago

Yes I do, although in fairness my experience has been that Verisign and Thawte at least will ring the number you provide at some stage. I guess they also do a Companies House[0] lookup in the UK as they request related details IIRC. What's more of a scandal is that Verisign at least 'license' their EV certificates to be used on a given number of servers [1]. Now if the 'service' provided is identity verification, that practice is the real scam. [0] http://www.companieshouse.gov.uk/ http://www.companieshouse.gov.uk/ [1] http://www.verisign.co.uk/ssl/ssl-information-center/ssl-basics/index.html#a16 http://www.verisign.co.uk/ssl/ssl-information-center/ssl-bas...