9 ms·

Free SSL Certificate for Open Source Projects

165 points by iancarroll 12y ago

finnn 12y ago
Free SSL certificate for pretty much anyone: https://startssl.com/ https://startssl.com/ Why do people pay for SSL certificates
- dubcanada 12y ago
  startssl free is not allowed to be used on commercial projects according to their policy (3.1.2.1). You must use Class 2 or higher for commercial.
  - 0x0 12y ago
    And even then, they might grant you a certificate for a domain one day, and the next time you renew or even pay for a revocation (think heartbleed), they may put it on the revocation list and then proceed to delay for a manual review for hours or even days, and then decide your random domain is registered by your client instead of yourself, and you cannot renew even if you can prove domain validation. They used to be cool, but recently they have become a major hassle to the point where it's faster and easier to just pay per certificate at more conventional CAs like those reselling instantssl. If your time has an hourly price, you'll probably even save money. Edit: I'm sure it's a noble goal that they do not want to certify domains they cannot prove are owned by the customer, but it doesn't really do much good in practice when the CA next door will happily issue a certificate as long as you can read administrative email for the domain.
  - simonbrown 12y ago
    Neither is this.
- dm2 12y ago
  I do not recommend StartSSL. Their $25 fee for revocation during the Heartbleed situation left many of their users who could not pay their fee vulnerable to attack. During these extenuating circumstances you would expect them to offer the revocation for a discounted price or even free, but they did not. I did not have any certificates registered with them and am very glad I didn't. I imagine that there are a huge amount of StartSSL users who cannot pay the $25 per certificate and have no choice but to leave their server vulnerable. This was pure short-sighted greed on the part of StartSSL. I'd strongly recommend https://www.namecheap.com/security/ssl-certificates/comodo.aspx https://www.namecheap.com/security/ssl-certificates/comodo.a... It's a great price and their support has been excellent in my experience. If you have an open source project then the GlobalSign free certificate is hard to beat.
  - fletchowns 12y ago
    That is a terrible reason not to recommend StartSSL. They were under no obligation to offer revocation for free. If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways.
    - scrollaway 12y ago
      > If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways. That is a terrible reason to recommend against SSL.
    - dm2 12y ago
      The parent comment recommended StartSSL, I was simply stating my opinion of the company and informing people that there is a catch when using their service. If you obtain a free certificate then $25 per certificate probably is an issue, especially since there is no guarantee that this won't happen again in the near future. Many people probably have several subdomains which needed certificates, $25 per subdomain can add up quickly if you have several. No, they were not obligated to offer revocation for free, but a significantly discounted price would have allowed a much larger percentage of people to revoke their certificates. It's not too much different than extortion, since many people who obtain free certificates are not aware of the possibility of the need to revoke a certificate, then they are basically screwed when they are forced to either pay up or have their server left insecure. Hypothetical Situation: If I start a free SSL cert service and put in my terms that there is a $1,000 revocation fee, would that be acceptable? Many people would signup without thinking they would never need to revoke a certificate, then another Heartbleed-like situation occurs and many of your users have servers that are at risk without revocation, would it be acceptable to say, "Oh well, pay up or else someone could hack your servers".
      - justincormack 12y ago
        Also its a terrible business model, unless you have a side job finding openssl vulnerabilities. Its just a windfall not predictable revenue.
middleclick 12y ago
This is a good initiative. Open source security projects could really make use of this. As a small example, the Gpg4win [1] project does not support HTTPS. Now whether this is due to a lack of funds or motivation is unclear, but a free SSL certificate might sound enticing and may motivate people to install them on their servers. [1]. http://www.gpg4win.org/ http://www.gpg4win.org/
- atmosx 12y ago
  Why should this project support 'https'? There are no user registrations taking place or sensitive informations. It's just binaries.
  - slig 12y ago
    So no one can do a MITM attack and change the binaries as you download them.
    - atmosx 12y ago
      Hm I trust the package integrity check[1], more than the SSL[2]. [1] http://www.gpg4win.org/package-integrity.html http://www.gpg4win.org/package-integrity.html [2] http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/ http://www.thoughtcrime.org/blog/authenticity-is-broken-in-s...
      - mihai_ionic 12y ago
        So no one can do a MITM attack and change the SHA1 checksum, OpenPGP Key ID, file lengths and code signing certificate fingerprints as you download package-integrity.html?
        EGreg 12y ago
        You can do a MITM attack with certificates also. In fact NSA can do it by compromising any CA in the chain. A distributed system that verifies identity would be much better. For example, namecoin based identities and checksums committed to the blockchain. In fact, any self-signed public key system with a MAC distributed to many sources would be good enough. It doesn't have to have proof of work. The only requirement is that there are enough root CAs that you can't compromise them all. This should be taken care of by browsers themselves! I wrote this 3 years ago and since then nothing has been done: https://news.ycombinator.com/item?id=2024164 https://news.ycombinator.com/item?id=2024164
jdorfman 12y ago
My company has been a globalsign partner for a little over 2 years. They are a great company and I am really happy to see them supporting the OSI. Nice to have partners that have the same vision when it comes to supporting the FOSS community.
n0body 12y ago
Startssl give them for free anyway
steven2012 12y ago
Free SSL certificates are completely undermining Internet security. The whole point of certs is that you have a certificate authority that verifies the identity of the person you are issuing the cert to. By giving it away for free and doing zero of the backend work, all you're doing is creating a false sense of security and poisoning the ability to trust https.
- akerl_ 12y ago
  Yes, because the paid cert industry has a long history of preventing people from pretending to be other entities.
- Pyramids 12y ago
  As it stands, the majority of CA's do not verify any of this information, besides a very cursory email verification. Exceptions would obviously include higher priced (OV/EV) certificates, which are no different cryptographically. Even the CA mentioned (GlobalSign) states this fairly clearly on their website.[1] [1] https://www.globalsign.com/ssl-information-center/types-of-ssl-certificate.html https://www.globalsign.com/ssl-information-center/types-of-s...
- iancarroll 12y ago
  So they should pay to make it more secure? It's not like you get to skip domain validation.
- indusface 12y ago
  The SSL protocol uses digital certificates to create a secure, confidential communications "pipe" between two entities. Data transmitted over an SSL connection cannot be tampered with or forged without the two parties becoming immediately aware of the tampering. This Free concept is really bogus. Nothing comes free! http://www.indusface.com/index.php/products/ssl-certificates http://www.indusface.com/index.php/products/ssl-certificates
alien3d 12y ago
i build software accounting ... and the term open source.Are it freely downloadable or close company but open source to customer ? Previously i use ssl for testing speed the google spdy.. but performance not much different. sorry not git hub account for downloadable accounting software but if wanted to real code and product and sell combine,access will be given.
thoughtpolice 12y ago
GlobalSign helped out Haskell.org and gave us a nice wildcard certificate quickly and easily. We really appreciated it.
dbg31415 12y ago
But aren't these like $1.99 through NameCheap?
sargun 12y ago
This is a cool initiative, but honestly, I would far prefer if open source projects started to implement DANE.
- drdaeman 12y ago
  DANE is a good idea, but almost useless in practice since it lacks browser support (addons doesn't really count since nearly noone would install them) Any ideas how we could ask Mozilla, Google, Apple and Microsoft to include DANE (and/or, maybe, TACK and/or Convergence) support into their browsers?

165 points by iancarroll 12y ago

finnn 12y ago

Free SSL certificate for pretty much anyone: https://startssl.com/ https://startssl.com/ Why do people pay for SSL certificates

dubcanada 12y ago
startssl free is not allowed to be used on commercial projects according to their policy (3.1.2.1). You must use Class 2 or higher for commercial.
- 0x0 12y ago
  And even then, they might grant you a certificate for a domain one day, and the next time you renew or even pay for a revocation (think heartbleed), they may put it on the revocation list and then proceed to delay for a manual review for hours or even days, and then decide your random domain is registered by your client instead of yourself, and you cannot renew even if you can prove domain validation. They used to be cool, but recently they have become a major hassle to the point where it's faster and easier to just pay per certificate at more conventional CAs like those reselling instantssl. If your time has an hourly price, you'll probably even save money. Edit: I'm sure it's a noble goal that they do not want to certify domains they cannot prove are owned by the customer, but it doesn't really do much good in practice when the CA next door will happily issue a certificate as long as you can read administrative email for the domain.
- simonbrown 12y ago
  Neither is this.
dm2 12y ago
I do not recommend StartSSL. Their $25 fee for revocation during the Heartbleed situation left many of their users who could not pay their fee vulnerable to attack. During these extenuating circumstances you would expect them to offer the revocation for a discounted price or even free, but they did not. I did not have any certificates registered with them and am very glad I didn't. I imagine that there are a huge amount of StartSSL users who cannot pay the $25 per certificate and have no choice but to leave their server vulnerable. This was pure short-sighted greed on the part of StartSSL. I'd strongly recommend https://www.namecheap.com/security/ssl-certificates/comodo.aspx https://www.namecheap.com/security/ssl-certificates/comodo.a... It's a great price and their support has been excellent in my experience. If you have an open source project then the GlobalSign free certificate is hard to beat.
- fletchowns 12y ago
  That is a terrible reason not to recommend StartSSL. They were under no obligation to offer revocation for free. If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways.
  - scrollaway 12y ago
    > If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways. That is a terrible reason to recommend against SSL.
  - dm2 12y ago
    The parent comment recommended StartSSL, I was simply stating my opinion of the company and informing people that there is a catch when using their service. If you obtain a free certificate then $25 per certificate probably is an issue, especially since there is no guarantee that this won't happen again in the near future. Many people probably have several subdomains which needed certificates, $25 per subdomain can add up quickly if you have several. No, they were not obligated to offer revocation for free, but a significantly discounted price would have allowed a much larger percentage of people to revoke their certificates. It's not too much different than extortion, since many people who obtain free certificates are not aware of the possibility of the need to revoke a certificate, then they are basically screwed when they are forced to either pay up or have their server left insecure. Hypothetical Situation: If I start a free SSL cert service and put in my terms that there is a $1,000 revocation fee, would that be acceptable? Many people would signup without thinking they would never need to revoke a certificate, then another Heartbleed-like situation occurs and many of your users have servers that are at risk without revocation, would it be acceptable to say, "Oh well, pay up or else someone could hack your servers".
    - justincormack 12y ago
      Also its a terrible business model, unless you have a side job finding openssl vulnerabilities. Its just a windfall not predictable revenue.

middleclick 12y ago

This is a good initiative. Open source security projects could really make use of this. As a small example, the Gpg4win [1] project does not support HTTPS. Now whether this is due to a lack of funds or motivation is unclear, but a free SSL certificate might sound enticing and may motivate people to install them on their servers. [1]. http://www.gpg4win.org/ http://www.gpg4win.org/

atmosx 12y ago
Why should this project support 'https'? There are no user registrations taking place or sensitive informations. It's just binaries.
- slig 12y ago
  So no one can do a MITM attack and change the binaries as you download them.
  - atmosx 12y ago
    Hm I trust the package integrity check[1], more than the SSL[2]. [1] http://www.gpg4win.org/package-integrity.html http://www.gpg4win.org/package-integrity.html [2] http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/ http://www.thoughtcrime.org/blog/authenticity-is-broken-in-s...
    - mihai_ionic 12y ago
      So no one can do a MITM attack and change the SHA1 checksum, OpenPGP Key ID, file lengths and code signing certificate fingerprints as you download package-integrity.html?
      - EGreg 12y ago
        You can do a MITM attack with certificates also. In fact NSA can do it by compromising any CA in the chain. A distributed system that verifies identity would be much better. For example, namecoin based identities and checksums committed to the blockchain. In fact, any self-signed public key system with a MAC distributed to many sources would be good enough. It doesn't have to have proof of work. The only requirement is that there are enough root CAs that you can't compromise them all. This should be taken care of by browsers themselves! I wrote this 3 years ago and since then nothing has been done: https://news.ycombinator.com/item?id=2024164 https://news.ycombinator.com/item?id=2024164

jdorfman 12y ago

My company has been a globalsign partner for a little over 2 years. They are a great company and I am really happy to see them supporting the OSI. Nice to have partners that have the same vision when it comes to supporting the FOSS community.

n0body 12y ago

Startssl give them for free anyway

steven2012 12y ago

Free SSL certificates are completely undermining Internet security. The whole point of certs is that you have a certificate authority that verifies the identity of the person you are issuing the cert to. By giving it away for free and doing zero of the backend work, all you're doing is creating a false sense of security and poisoning the ability to trust https.

akerl_ 12y ago
Yes, because the paid cert industry has a long history of preventing people from pretending to be other entities.
Pyramids 12y ago
As it stands, the majority of CA's do not verify any of this information, besides a very cursory email verification. Exceptions would obviously include higher priced (OV/EV) certificates, which are no different cryptographically. Even the CA mentioned (GlobalSign) states this fairly clearly on their website.[1] [1] https://www.globalsign.com/ssl-information-center/types-of-ssl-certificate.html https://www.globalsign.com/ssl-information-center/types-of-s...
iancarroll 12y ago
So they should pay to make it more secure? It's not like you get to skip domain validation.
indusface 12y ago
The SSL protocol uses digital certificates to create a secure, confidential communications "pipe" between two entities. Data transmitted over an SSL connection cannot be tampered with or forged without the two parties becoming immediately aware of the tampering. This Free concept is really bogus. Nothing comes free! http://www.indusface.com/index.php/products/ssl-certificates http://www.indusface.com/index.php/products/ssl-certificates

alien3d 12y ago

i build software accounting ... and the term open source.Are it freely downloadable or close company but open source to customer ? Previously i use ssl for testing speed the google spdy.. but performance not much different. sorry not git hub account for downloadable accounting software but if wanted to real code and product and sell combine,access will be given.

thoughtpolice 12y ago

GlobalSign helped out Haskell.org and gave us a nice wildcard certificate quickly and easily. We really appreciated it.

dbg31415 12y ago

But aren't these like $1.99 through NameCheap?

sargun 12y ago

This is a cool initiative, but honestly, I would far prefer if open source projects started to implement DANE.

drdaeman 12y ago
DANE is a good idea, but almost useless in practice since it lacks browser support (addons doesn't really count since nearly noone would install them) Any ideas how we could ask Mozilla, Google, Apple and Microsoft to include DANE (and/or, maybe, TACK and/or Convergence) support into their browsers?