5 ms·

> total ripoff and also insecure I pay less for SSL certificates per year than I do for the domains I use them on. You can get a free certificate from StartSSL

by kijin 14y ago

> total ripoff and also insecure I pay less for SSL certificates per year than I do for the domains I use them on. You can get a free certificate from StartSSL if you're just playing, or an $8 certificate from Comodo if you're more serious. Some registrars (cough Gandi cough) even include a free SSL certificate with every domain. So the "total ripoff" thing has been all but solved by market competition (unless you prefer to splurge on a $800 certificate that doesn't do anything a $8 certificate can't do). It's really just the "insecure" part that needs to be addressed.

rubbingalcohol 14y ago
It makes sense that the more CA's you allow into the market the less of a "total ripoff" you'd have due to competition, but intuitively there would be more of a problem on the "insecure" side due to fly-by-night companies with weak security. I don't see this as the main problem though. In practice I feel like the whole CA system is flawed because you're trusting the CA based on the authority assigned to it by a higher governing body, a governing body you can't necessarily be sure isn't getting some blank-check signing superpowers from the CA and doing man-in-the-middle attacks on persons of interest with bogus certs. I can't necessarily trust that the authorities have my best interests in mind so I can't trust the CA signing system. I look forward to the author's proposed solution(s) to this problem.
pzb 14y ago
In what way is a StartSSL certificate any different from a Comodo certificate? What makes StartSSL only usable for "playing"?
- chmike 14y ago
  Free StartSSL are for non commercial usage. This is, I guess, what he means by "for playing", I don't know for comodo, if their certificates can be use for commercial applications.
- kijin 14y ago
  StartSSL is recognized by OS X 10.5 or later, and Windows 7 or later. Older OSes might not recognize it if the user has missed any updates. I'm OK with showing IE6/7 users a polite suggestion to upgrade, but a certificate error looks unprofessional. In addition, Chrome on XP is also affected (if the user has missed the CA update) because Chrome doesn't carry its own list of trusted CAs.
  - caf 14y ago
    If someone's browsing the internet with unpatched XP then they've got bigger problems than some certificate warnings appearing.
    - kijin 14y ago
      That's their problem, not yours. Remember, we're talking about Chrome here, not IE6/7.
kaoD 14y ago
> on a $800 certificate that doesn't do anything a $8 certificate can't do Unless you need *.domain.tld certificates.
- DoubleMalt 14y ago
  You can get unlimited *.domain.tld certificates from StartSSL after inexpensive verfication step. But don't tell anyone.
  - kaoD 14y ago
    AFAIK those are $60, not free.
    - wereHamster 14y ago
      You pay that fee, and then can generate unlimited wildcard certificates for a year.
      - kaoD 14y ago
        Which is > $8... and specially > free. You can get a free Lamborghini for an inexpensive $400,000 one-time fee!
        wereHamster 14y ago
        If you have >7 domains and want wildcard certificates, it is the cheapest option. Edit: also, if I can get an unlimited number of Lamborghinis for just 400k, where do I sign up??
        kaoD 14y ago
        > If you have >7 domains and want wildcard certificates, it is the cheapest option. Thanks for the info but I just tried to refute the fact that free/$8 certificates do the same as $800, which they clearly don't. Don't get me wrong: it's great! But completely irrelevant for the argument. > if I can get an unlimited number of Lamborghinis for just 400k, where do I sign up?? You only get a single certificate for $60, not an unlimited number of them. EDIT: see child comment, I'm wrong and you do get unlimited certificates.
skrause 14y ago
Where can I find those $8 certificate? https://www.positivessl.com/ https://www.positivessl.com/ only shows me "from €49.00/ year".
- james-skemp 14y ago
  Name cheap has them. http://www.namecheap.com/ssl-certificates/comodo/positivessl-certificate.aspx http://www.namecheap.com/ssl-certificates/comodo/positivessl... Might be thinking of that.

by kijin 14y ago

rubbingalcohol 14y ago

It makes sense that the more CA's you allow into the market the less of a "total ripoff" you'd have due to competition, but intuitively there would be more of a problem on the "insecure" side due to fly-by-night companies with weak security. I don't see this as the main problem though. In practice I feel like the whole CA system is flawed because you're trusting the CA based on the authority assigned to it by a higher governing body, a governing body you can't necessarily be sure isn't getting some blank-check signing superpowers from the CA and doing man-in-the-middle attacks on persons of interest with bogus certs. I can't necessarily trust that the authorities have my best interests in mind so I can't trust the CA signing system. I look forward to the author's proposed solution(s) to this problem.

pzb 14y ago

In what way is a StartSSL certificate any different from a Comodo certificate? What makes StartSSL only usable for "playing"?

chmike 14y ago
Free StartSSL are for non commercial usage. This is, I guess, what he means by "for playing", I don't know for comodo, if their certificates can be use for commercial applications.
kijin 14y ago
StartSSL is recognized by OS X 10.5 or later, and Windows 7 or later. Older OSes might not recognize it if the user has missed any updates. I'm OK with showing IE6/7 users a polite suggestion to upgrade, but a certificate error looks unprofessional. In addition, Chrome on XP is also affected (if the user has missed the CA update) because Chrome doesn't carry its own list of trusted CAs.
- caf 14y ago
  If someone's browsing the internet with unpatched XP then they've got bigger problems than some certificate warnings appearing.
  - kijin 14y ago
    That's their problem, not yours. Remember, we're talking about Chrome here, not IE6/7.

kaoD 14y ago

> on a $800 certificate that doesn't do anything a $8 certificate can't do Unless you need *.domain.tld certificates.

DoubleMalt 14y ago
You can get unlimited *.domain.tld certificates from StartSSL after inexpensive verfication step. But don't tell anyone.
- kaoD 14y ago
  AFAIK those are $60, not free.
  - wereHamster 14y ago
    You pay that fee, and then can generate unlimited wildcard certificates for a year.
    - kaoD 14y ago
      Which is > $8... and specially > free. You can get a free Lamborghini for an inexpensive $400,000 one-time fee!
      - wereHamster 14y ago
        If you have >7 domains and want wildcard certificates, it is the cheapest option. Edit: also, if I can get an unlimited number of Lamborghinis for just 400k, where do I sign up??
        kaoD 14y ago
        > If you have >7 domains and want wildcard certificates, it is the cheapest option. Thanks for the info but I just tried to refute the fact that free/$8 certificates do the same as $800, which they clearly don't. Don't get me wrong: it's great! But completely irrelevant for the argument. > if I can get an unlimited number of Lamborghinis for just 400k, where do I sign up?? You only get a single certificate for $60, not an unlimited number of them. EDIT: see child comment, I'm wrong and you do get unlimited certificates.

skrause 14y ago

Where can I find those $8 certificate? https://www.positivessl.com/ https://www.positivessl.com/ only shows me "from €49.00/ year".

james-skemp 14y ago
Name cheap has them. http://www.namecheap.com/ssl-certificates/comodo/positivessl-certificate.aspx http://www.namecheap.com/ssl-certificates/comodo/positivessl... Might be thinking of that.