3 ms·
It is, however, ridiculous that DigitalOcean (a quite popular VPS provider) advises innocent webmasters to generate it in the browser with no mention of how ins
by antsar 12y ago
It is, however, ridiculous that DigitalOcean (a quite popular VPS provider) advises innocent webmasters to generate it in the browser with no mention of how insecure this is.
https://www.digitalocean.com/community/tutorials/how-to-set-up-apache-with-a-free-signed-ssl-certificate-on-a-vps https://www.digitalocean.com/community/tutorials/how-to-set-...
- basher 12y agoIt's a community contributed article - shame DigitalOcean didn't audit it properly though.
- Dylan16807 12y agoIf StartSSL gets hacked you are in a bad place no matter what. And you're more likely to screw up key safety yourself than for that narrow window to be exploited. I don't think it's ridiculous.
- antsar 12y agoI agree that there's a very slim chance, realistically, of this being exploited. But StartSSL doesn't have to be hacked for a user to be MITM'ed and served malicious JS. Especially given that their site (at least the homepage) loads over plain HTTP.