4 ms·
> I'm in the process of moving any Saas offerings I use off USA-affiliated companies, but it's actually more difficult than I first thought. You should try fin
by __alexs 13y ago
> I'm in the process of moving any Saas offerings I use off USA-affiliated companies, but it's actually more difficult than I first thought.
You should try finding a SSL cert retailer that's outside of the US. The only ones I could find that would actually sell me certs without a phone call charged at least $200 for a basic certificate. https://swisssign.com/en https://swisssign.com/en were the most sensible looking ones I could find.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- sneak 13y agoThis part doesn't matter. Where your cert comes from is irrelevant.
- __alexs 13y agoIt has implications for certificate pinning (like that used in Chrome) if you can only pin to CAs that operate in a single regulatory domain.
- sneak 13y agoIndeed, I hadn't considered that. Though, if you are pinning in an app and not just in-browser, you can bundle your internal CA cert in the binary and sidestep the whole mess. This is what I advise my customers that have security-sensitive stuff do. The PKI can no longer be trusted.
- nwp90 13y ago"No longer"? It could never be trusted, and many of us said so when it was first introduced. It's just taken a while for everyone else to realise that we were right.
- hnha 13y agofrom what I know you never give your private key away, they just sign your public one. so that would be irrelevant.
- gkoz 13y agoThere's StartCom (StartSSL) from Israel. Have you tried them? They even offer free SSL certs, by the way.
- junto 13y agoThey are from Israel, a good friend of the US, and for free. What part of that does not scream 'run for the hills' exactly?
- rdl 13y agoLulzily, a browser trusted CA can actually fuck a customer of that CA slightly less than a non-customer, since you'd at least be vaguely aware of multiple certs issued for the same site from the same CA with different keys (maybe). No one would know if Iran were using a pet CA to go after specific users going to sites which normally used a cert from another CA.