2 ms·

> I suspect your problem is the "third level domain" That's one of the problems for me at the moment. A friend in a similar situation (but with regular .net do

by pdkl95 12y ago

> I suspect your problem is the "third level domain" That's one of the problems for me at the moment. A friend in a similar situation (but with regular .net domain) triggered one of their "must pay now" criteria (ref: the StartSSL business model). They have worked in the past, and are sometimes an option, but a "second source" is unfortunately necessary. > That certainly isn't the intention of the security community I don't really intend to make any accusations - take any harsh tone in my post to be a general annoyance at the current situation. I appreciate the ideas about technical workarounds. They are similar to some things I've considered already, and might yet try. I'm more concerned about a general solution to this PKI/cert problem - XMPP and HTTP simply being the common examples. In reference to the manifesto linked at the top of this thread, the time to encrypt everything is "now". This is a great idea, but it can't happen everywhere until the money-issue needs to be solved.

dspillett 12y ago
> A friend in a similar situation (but with regular .net domain) triggered one of their "must pay now" criteria (ref: the StartSSL business model). One thing that surprises some who have been using SlartSSL for a some time is that a while ago a "non commercial use only" clause was added to the free certificates. I don't know how they police that if they do at all, but if your friend's site was taking money for services that may explain the change from his/her account's PoV. I've stopped using the free certificates for a couple of sites I administer for that reason. This doesn't apply to any of the other certificates they offer (though for a single domain it is cheaper to buy elsewhere).
dspillett 12y ago
> I don't really intend to make any accusations Your tone was actually fine, I put that there as a preface to the next statement (which was essentially "but that is the way things sometimes work out"). > I appreciate the ideas about technical workarounds. Another suggestion you might try if you know enough reliable people in a similar position as you find yourself in (happy to have a third level domain but needing a certificate potentially for commercial use) who you trust enough to do business with: club together, and rent a normal domain and wildcard certificate with it. Of course someone will have to take responsability handling the money, for technical admin, and for enforcing certain rules such as "nothing illegal otherwise we are all at risk" (this person will need to be trusted by the other parties, it goes without saying), and if a two-or-three $ per year is the maximum you can stretch to each then you would need a small number of tens of people in (more if you can each spare less) (domain + wildcard from StartSSL ~= $75/2yr ~= $2/year each for 20 people, still not free but an order of magnitude closer), and there is the support "risk" of not particulary technically minded peopel joining and needing hekp to setup/maintain things, so the idea might be completely impractical but nonetheless there is a chance it might be worth considering.

by pdkl95 12y ago

dspillett 12y ago

> A friend in a similar situation (but with regular .net domain) triggered one of their "must pay now" criteria (ref: the StartSSL business model). One thing that surprises some who have been using SlartSSL for a some time is that a while ago a "non commercial use only" clause was added to the free certificates. I don't know how they police that if they do at all, but if your friend's site was taking money for services that may explain the change from his/her account's PoV. I've stopped using the free certificates for a couple of sites I administer for that reason. This doesn't apply to any of the other certificates they offer (though for a single domain it is cheaper to buy elsewhere).

dspillett 12y ago

> I don't really intend to make any accusations Your tone was actually fine, I put that there as a preface to the next statement (which was essentially "but that is the way things sometimes work out"). > I appreciate the ideas about technical workarounds. Another suggestion you might try if you know enough reliable people in a similar position as you find yourself in (happy to have a third level domain but needing a certificate potentially for commercial use) who you trust enough to do business with: club together, and rent a normal domain and wildcard certificate with it. Of course someone will have to take responsability handling the money, for technical admin, and for enforcing certain rules such as "nothing illegal otherwise we are all at risk" (this person will need to be trusted by the other parties, it goes without saying), and if a two-or-three $ per year is the maximum you can stretch to each then you would need a small number of tens of people in (more if you can each spare less) (domain + wildcard from StartSSL ~= $75/2yr ~= $2/year each for 20 people, still not free but an order of magnitude closer), and there is the support "risk" of not particulary technically minded peopel joining and needing hekp to setup/maintain things, so the idea might be completely impractical but nonetheless there is a chance it might be worth considering.