4 ms·

Microsoft adds free root certificate authority to Windows

30 points by johns 17y ago

wizard_2 17y ago
Does this mean we don't have to pay for ssl certs anymore? If ie, firefox, and safari support this company's free certs - what's the problem?
- there 17y ago
  did you read the article? Granted Firefox and Safari has supported many of the certificate authorities issuing free certificates for some time, Microsoft has not, until now.
  - euccastro 17y ago
    Did you notice the "anymore"?
wmf 17y ago
Are they pushing this patch out? The article gives the impression that XP/Vista users would have to patch manually, which isn't going to happen.
- sid0 17y ago
  On XP, through Windows Update. On Vista, automatically the first time you visit a StartCom-signed site.
dfranke 17y ago
These stories make me cringe. The security of SSL is as good as the verification practices of the laziest CA. We need fewer of them, not more, and any CA that can give certificates away for free is guaranteed to have atrocious practices. It appears that this company authenticates you by verifying that you can receive email at the domain that you want the certificate for. In addition to completely defeating the purpose of SSL by sending secrets in the clear over SMTP, ability to receive email at a certain address is no proof of ownership of that domain. Unfortunately, though, StartCom didn't invent this stupidity. I already discovered a few months ago that I can get Thawte to issue me an SSL certificate for hushmail.com.
- wmf 17y ago
  Look at it the other way: The CAs who are charging hundreds of dollars have atrocious practices, so StartCom is actually an improvement.
  - deleted 17y ago
    [deleted]
- there 17y ago
  We need fewer of them, not more, and any CA that can give certificates away for free is guaranteed to have atrocious practices. i have used startcom for a free ssl certificate for my personal site for many years and their verification process is more involved than godaddy's, which i also use for a wildcard ssl certificate and have to pay $199/year for. startcom requires client-side ssl certificates to login to their site, and then does verification with email and, if i remember correctly, a dns record or file placed somewhere on the current domain's site. just because they're free doesn't mean they won't take the time to do verification, and conversely, just because another company extorts lots of money from its customers every year doesn't mean they do any better validation.
zokier 17y ago
Could we just throw current CA's out and get some sensible, working organization instead. Basically anyone can get certificate for any domain nowdays, CA's care only about money. That kinda defeats the whole purpose of having CA's in the first place. Okay, maybe applying for *.google.com certificate could be noticed in the current system, but thats about it. Why couldn't eg domain registrars grant certificates for the domains they have sold? Wouldn't that kinda simplify and be a lot more secure than the current mess.
- invisible 17y ago
  I wasn't aware it was that easy. I thought, at the simplest, they verify the whois information of the domain and you must be an admin contact for the domain. What would you suggest they do beyond that or besides that? How can I get *.ycombinator.com for example?

30 points by johns 17y ago

Does this mean we don't have to pay for ssl certs anymore? If ie, firefox, and safari support this company's free certs - what's the problem?

there 17y ago
did you read the article? Granted Firefox and Safari has supported many of the certificate authorities issuing free certificates for some time, Microsoft has not, until now.
- euccastro 17y ago
  Did you notice the "anymore"?

wmf 17y ago

Are they pushing this patch out? The article gives the impression that XP/Vista users would have to patch manually, which isn't going to happen.

sid0 17y ago
On XP, through Windows Update. On Vista, automatically the first time you visit a StartCom-signed site.

dfranke 17y ago

These stories make me cringe. The security of SSL is as good as the verification practices of the laziest CA. We need fewer of them, not more, and any CA that can give certificates away for free is guaranteed to have atrocious practices. It appears that this company authenticates you by verifying that you can receive email at the domain that you want the certificate for. In addition to completely defeating the purpose of SSL by sending secrets in the clear over SMTP, ability to receive email at a certain address is no proof of ownership of that domain. Unfortunately, though, StartCom didn't invent this stupidity. I already discovered a few months ago that I can get Thawte to issue me an SSL certificate for hushmail.com.

wmf 17y ago
Look at it the other way: The CAs who are charging hundreds of dollars have atrocious practices, so StartCom is actually an improvement.
- deleted 17y ago
  [deleted]
there 17y ago
We need fewer of them, not more, and any CA that can give certificates away for free is guaranteed to have atrocious practices. i have used startcom for a free ssl certificate for my personal site for many years and their verification process is more involved than godaddy's, which i also use for a wildcard ssl certificate and have to pay $199/year for. startcom requires client-side ssl certificates to login to their site, and then does verification with email and, if i remember correctly, a dns record or file placed somewhere on the current domain's site. just because they're free doesn't mean they won't take the time to do verification, and conversely, just because another company extorts lots of money from its customers every year doesn't mean they do any better validation.

zokier 17y ago

Could we just throw current CA's out and get some sensible, working organization instead. Basically anyone can get certificate for any domain nowdays, CA's care only about money. That kinda defeats the whole purpose of having CA's in the first place. Okay, maybe applying for *.google.com certificate could be noticed in the current system, but thats about it. Why couldn't eg domain registrars grant certificates for the domains they have sold? Wouldn't that kinda simplify and be a lot more secure than the current mess.

invisible 17y ago
I wasn't aware it was that easy. I thought, at the simplest, they verify the whois information of the domain and you must be an admin contact for the domain. What would you suggest they do beyond that or besides that? How can I get *.ycombinator.com for example?