8 ms·
SSLMate – Buy SSL certs from the command line
- dankohn1 12y agoTake a look at https://letsencrypt.org/ https://letsencrypt.org/ which will (mid-year) let you get a cert from the command, for free!, and automatically renew it as well.
- deleted 12y ago[deleted]
- shawabawa3 12y ago> but i'm not sure if this would be a reasonable option for commercial use Why not?
- muhpirat 12y agoMhhhh I think he mean EV certs.
- deleted 12y ago[deleted]
- EwanToo 12y agoYou mean like OpenSSL...?
- deleted 12y ago[deleted]
- leo_santagada 12y agoI see what you did there :)
- muhpirat 12y agoEV -> extendetvalidition like PayPal or a bank
- deleted 12y ago[deleted]
- ownagefool 12y agoI believe it's supposed to be open source, thus you don't really need the daemon, you can probably make the service calls yourself. The daemon however, will ensure that your cert is replaced on auto-renewal, so for something fairly hands off, that be pretty cool.
- schoen 12y agoYep! Right now the "daemon" is planned to be another Python script run from /etc/cron.daily to examine your certs to see if any of them need to be renewed, and then try to renew them automatically. If you don't want the autorenewal, you can turn it off in what will probably be /etc/letsencrypt/renewal.conf, or with a command-line option when you obtain the cert, or use the standalone configurator (which won't enroll the cert in the renewal database), or write your own client for the ACME protocol that doesn't do autorenewal at all.
- lordbusiness 12y agoIf ever there was proof that "someone out there has the same idea as you" is true, this is it; I've been conceiving an open to audit public, free CA for the past couple of weeks. It looks like my dream is coming true!
- WaxProlix 12y agoIs this live? It says it's coming 'mid 2015', and the standard (Ubuntu 12.04 LTS, I believe) repos don't seem to have any mention of it. Edit for anyone else curious about this: No, the letsencrypt CA isn't ready yet; there are test builds available for all of the software, but any certs you get will not be properly signed, and your users will get nasty browser warnings. Something to keep an eye on in the future, I guess.
- tokenizerrr 12y agoNo, it is not mid 2015 yet.
- WaxProlix 12y agoHence the edit, man.
- michaelmior 12y agoWhy do you consider Ubuntu 12.04 standard? 14.04 is the most current LTS release.
- WA 12y agoThis looks interesting. Couldn't figure it out right from the FAQ: If SSLMate is a single-command buy & install, where do the certificate details (company name etc.) come from? From my profile on the website?
- r1ch 12y agoFor domain validated certificates those details are often ignored, only the domain name is part of the final certificate.
- nailer 12y agoIf you want a company name, you need an EV certificate. Domain Validated (DV) certificates (the free ones, or cheap in sslmate's case) are just proof someone - we don't know who they are - has control of a domain. Hence Domain Validated - someone did something to prove they had control of the domain and was given a DV certificate. They don't include your company name, company ID or physical address in the subject because there is no requirement for the CA to verify those things. Here's HN's DV certificate: https://certsimple.com/images/blog/non-ev-subject.png https://certsimple.com/images/blog/non-ev-subject.png Now visit http://github.com http://github.com - who have an EV certificate. It shows 'GitHub Inc' in a green bar on every web browser. Click the green bar, and compare the certificate details: https://certsimple.com/images/blog/ev-subject.png https://certsimple.com/images/blog/ev-subject.png - you can actually see GitHub's registered in Delaware, with company ID 5157550, which matches their state registration: http://businessprofiles.com/details/github-inc/US-DE-5157550 http://businessprofiles.com/details/github-inc/US-DE-5157550 - you can also see GitHub's office in San Francisco That info has been manually verified by a CA - that's the extended validation in 'EV' - and that's why browsers show 'GitHub Inc' in green. You can also see the difference using openssl: openssl x509 -in example.com.crt -noout -text | grep Subject DV cert: Subject: OU=Domain Control Validated, CN=billing.example.com DNS:billing.example.com, DNS:www.billing.example.com EV (green bar with company name) cert: openssl x509 -in example.com.crt -noout -text | grep Subject Subject: 1.3.6.1.4.1.311.60.2.1.3=GB/businessCategory=Private Organization/serialNumber=09378892, C=GB, ST=City of London, L=London, O=example Limited, CN=billing.example.com, DNS:billing.example.com, DNS:www.billing.example.com Disclaimer: I sell EV certs at https://certsimple.com https://certsimple.com. I specifically /don't/ sell DV certs, and we send people to https://letsencrypt.org https://letsencrypt.org if they really want a DV cert.
- bontoJR 12y agoThis is really interesting. It's very annoying to always fire the browser the renew/buy a certificate. I would definitely git it a shot for a standard one, the wildcard looks quite expensive honestly. In other sources you can find it at half-price with promo codes.
- BetaMechazawa 12y agoThis looks pretty cool. Although I do not understand why I would have to sign up on the website. The demo makes it look like it's a minimal-config command line tool. Instead the website makes it look like it's a service and there is no clear indication who stores my creditcard info etc. on the front page. This is explained in the FAQ though. A quick notice about stripe processing payments on the front page would be nice.
- agwa 12y agoTrue, the demo doesn't show the sign up process, but you only have to sign up once and after that, buying certs is as simple as in the demo. (And the sign up process is itself very quick.) Thanks for the feedback about the credit card processing information. I'll think about how to make that information more prominent.
- tomjen3 12y agoAny reason you couldn't just have me enter the credit card info in the app?
- deleted 12y ago[deleted]
- ynak 12y agoWhy are wildcard SSL certs so expensive? I want to use SSL certs on my personal subdomains, but they are usually priced at around $150/year at least. I hope let's encrypt will support multi or subdomains.
- nisa 12y agoStartSSL offers as many wildcard certs as you want for a low fixed yearly fee (50$)?
- dspillett 12y agoMultiple name certificates are included in that too, which is handy if you have several distinct domain names, limited IPv4 addresses, are worried about ancient browsers that don't support SNI. I have a single certificate that covers a couple of domains that way. Saves on admin too (though could be a pain if the PK were ever compromised as every service would need to be updated - if you have separate certs for everything and one is compromised you don't have that complication).
- creshal 12y agoStartSSL is very much "you get what you pay for", though. Their web interface is sporadically unreachable, and their validation is rather sloppy – as long as you pay up, you can happily break their terms of service and still be re-validated.
- StavrosK 12y agoI never understood how that matters, though. My visitors will see a green bar, job done. Breaking the ToS or not, I don't care as long as my address bar is green. How is Verisign any different from StartSSL, in that regard?
- creshal 12y ago> I never understood how that matters, though. It will matter if StartCom is abused to print certificates for foreign domains. Even if your domain isn't targeted, browsers and OS vendors will probably react by invalidating all StartCom CA certs. That means no green bar.
- falcolas 12y agoI'm the paranoid type; I would have a very hard time trusting a certificate key which was downloaded over the internet. Where is the SSL key generated? If I create my own certificate and key, can I pass the signing request over sslmate to get it signed? I couldn't find the answers to these questions on your FAQ or in the documentation.
- fulafel 12y agoTheir FAQ implies they do it the usual way: "The sslmate command generates a 2048 bit RSA key." Which is good, as sending you a key would be egregious incompetence from a cert vendor.
- sleepyhead 12y agohttps://github.com/SSLMate/sslmate/blob/master/bin/sslmate https://github.com/SSLMate/sslmate/blob/master/bin/sslmate
- falcolas 12y agoUseful (and confirms that it makes the cert locally), but we shouldn't have to read through the source code to get the overview of how the cert is created and signed.
- sleepyhead 12y ago
- kolev 12y agoPrices are much higher compared to Namecheap and their SSLs.com [0]. [0] https://www.ssls.com/ https://www.ssls.com/
- agwa 12y agoMany of our customers realize that fact, but are nonetheless extremely happy to use SSLMate. We're not a normal certificate vendor, and the ease and automation of SSLMate sets us far apart. If these features aren't important to you, Namecheap is a fine choice - I used them myself before creating SSLMate.
- kolev 12y agoI understand, but during times when you can buy a decent whole web servers for just $60 per year with traffic and all, the SSL certificate prices are just outrageously high!
- T3RMINATED 12y agoworst idea ever... did you graduate high school mate?
- 0x0 12y agoWow, that's half the price of the same certificates they sell on their main namecheap.com domain. But they are both Namecheap sites? Why would they sell for less on a different label? Really makes me lose confidence in them even after having been a mostly satisfied customer on their main domain for years. Turns out they have been ripping me off!
- T3RMINATED 12y agostupidest idea ever.
- tomjen3 12y agoApparently you still have to create an account on their website... And at 15usd/year that is infinitively more expensive than lets encrypt. So while I might use it today, I don't see how they plan to have much of a future.