3 ms·
You can get a free SSL certificate at https://www.startssl.com/ https://www.startssl.com/ , so that should not be a reason to keep you from using it. I do agre
by JennyZ 14y ago
You can get a free SSL certificate at https://www.startssl.com/ https://www.startssl.com/ , so that should not be a reason to keep you from using it.
I do agree that the extreme mistrust of browsers towards self-signed certificates is an odd thing.
- derefr 14y ago> I do agree that the extreme mistrust of browsers towards self-signed certificates is an odd thing. No, not at all; it's the whole point of SSL. The guy MITMing an SSLed website can create a cert for that site himself, but he can't get it signed by a CA. So he has to sign it himself. Thus, from the browser's perspective, all self-signed certs are possible instances of "there used to be a CA-signed cert here, but now you're being MITMed." Now, that's not to say something like self-signed certs wouldn't be nice--given some sort of distributed pin cache, we could have something closer to an SSH/PGP model where everyone's current self-signed cert "fingerprint" is on file, and alarm bells go off if you see a cert different from the one you're supposed to see. But without that, self-signing is literally no more secure than no SSL at all: anyone else can also self-sign to MITM you.
- lmm 14y agoIt's free but they charge you to revoke a certificate, which is quite unfortunate as it discourages people from revoking if they e.g. leak their private key.
- dmm 14y agoBrowsers mistrust self-signed certificates because that's what a MITM attack would look like.