4 ms·

Obligatory comment pointing out that SSL certificates are a racket and it's appalling that we have to pay for an SSL certificate.

by finnn 11y ago

brobinson 11y ago
If you're okay with not having "authenticated pulls" (i.e., the request from the CF edge to your server being unencrypted), Cloudflare gives you SSL for free. Their SSL config gets an A+ on SSLLabs tester, too. Far from a solution to the SSL problem, but an interesting and free option for a lot of sites that otherwise would not bother with SSL.
- 0x0 11y ago
  But then you end up visibly sharing a certificate with "nigerian-prince.com" - http://www.slate.com/blogs/future_tense/2015/03/23/ted_cruz_presidential_campaign_weird_tech_moments.html http://www.slate.com/blogs/future_tense/2015/03/23/ted_cruz_...
  - brobinson 11y ago
    This is great. I guess that is indeed a con of the CF approach!
- MichaelGG 11y ago
  I wonder why Cloudflare doesn't sign certs for their users to be used just for CF connecting to them. Seems like an obvious step to take.
  - brobinson 11y ago
    That would go against their "setup only takes five minutes!" mantra. It's an interesting idea, though.
  - jlgaddis 11y ago
    They do. It's a part of their "Universal SSL" [0] called "Strict Mode". [0]: https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...
    - MichaelGG 11y ago
      Well I feel silly. I looked in the dashboard several times, but the "valid cert required" was a CA-issued one, I thought. Cool!
    - brobinson 11y ago
      Oh, this is awesome. Thanks for the link! No excuse not to SSL all your sites now.
jamiesonbecker 11y ago
The article was only about Extended Validation, which by definition require extra validation (which is, to some extent, actual manual work by the issuer). Although some might argue that extremely high pricing makes it a 'racket', people generally don't do boring manual labor for fee, especially for the companies that are using EV to make money. (Individuals cannot get EV.)
- 0x0 11y ago
  The problem with EV is that getting one doesn't prevent other CAs from issuing illegitimate (non-EV) certificates for the same domain. I'd be much more willing to pay for EV if that somehow could simultaneously make it technically impossible for parallel certs to be issued. That would provide actual value. But not when all you are paying for is just a bitflag that causes browser chrome to change slightly.
  - jamiesonbecker 11y ago
    That's true, but EV on its own does provide real value as well. When you see the green bar, it's proof that it's at least nominally certified to be served from the entity displayed (barring key theft etc). Barring parallel certs, even if it was possible, wouldn't necessarily be a good idea, since there's a lot of legitimate uses for them. For instance, we also have a wildcard (non-EV) certificate for the same domain, covering *.userify.com that we currently use for customer subdomains. I'm far from an apologist for CA's. I think the entire system is broken. It's ridiculous that my browser trusts a Chinese govt CA with the same level of trust as the best US or EU CA, and it's ridiculous that it's so hard for me to customize that level of trust. Still, it's what we have right now. EV does represent some actual effort for every single issued certificate on the part of the CA's, and they do deserve to get paid for that. Whether that payment should cost many hundreds or even thousands of dollars is debatable, however!
    - 0x0 11y ago
      EV is kinda what the CAs should have done from the beginning anyways for any certificate. :-/ Btw, for parallel certs on customer subdomains, that sounds like a very niche use cache. Maybe you could have used a different base domain for user content. (Isn't that best practice anyways, to avoid xss'ing cookies onto the main site?)
noinsight 11y ago
Without OCSP stapling, every time someone connects to your server via HTTPS their client will check with the CA's OCSP server to verify that the certificate is still valid. They maintain CRL's for certificates etc. For DV certificates less so and EV certificates more so, the CA also verifies your information before issuing certificates. This infrastructure is not free. But yes, technically CA's could issue certificates for absolutely everyone for near-zero cost and they would be just as good as the ones that cost more.

Obligatory comment pointing out that SSL certificates are a racket and it's appalling that we have to pay for an SSL certificate.

by finnn 11y ago

Obligatory comment pointing out that SSL certificates are a racket and it's appalling that we have to pay for an SSL certificate.

brobinson 11y ago

If you're okay with not having "authenticated pulls" (i.e., the request from the CF edge to your server being unencrypted), Cloudflare gives you SSL for free. Their SSL config gets an A+ on SSLLabs tester, too. Far from a solution to the SSL problem, but an interesting and free option for a lot of sites that otherwise would not bother with SSL.

0x0 11y ago
But then you end up visibly sharing a certificate with "nigerian-prince.com" - http://www.slate.com/blogs/future_tense/2015/03/23/ted_cruz_presidential_campaign_weird_tech_moments.html http://www.slate.com/blogs/future_tense/2015/03/23/ted_cruz_...
- brobinson 11y ago
  This is great. I guess that is indeed a con of the CF approach!
MichaelGG 11y ago
I wonder why Cloudflare doesn't sign certs for their users to be used just for CF connecting to them. Seems like an obvious step to take.
- brobinson 11y ago
  That would go against their "setup only takes five minutes!" mantra. It's an interesting idea, though.
- jlgaddis 11y ago
  They do. It's a part of their "Universal SSL" [0] called "Strict Mode". [0]: https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...
  - MichaelGG 11y ago
    Well I feel silly. I looked in the dashboard several times, but the "valid cert required" was a CA-issued one, I thought. Cool!
  - brobinson 11y ago
    Oh, this is awesome. Thanks for the link! No excuse not to SSL all your sites now.

jamiesonbecker 11y ago

The article was only about Extended Validation, which by definition require extra validation (which is, to some extent, actual manual work by the issuer). Although some might argue that extremely high pricing makes it a 'racket', people generally don't do boring manual labor for fee, especially for the companies that are using EV to make money. (Individuals cannot get EV.)

0x0 11y ago
The problem with EV is that getting one doesn't prevent other CAs from issuing illegitimate (non-EV) certificates for the same domain. I'd be much more willing to pay for EV if that somehow could simultaneously make it technically impossible for parallel certs to be issued. That would provide actual value. But not when all you are paying for is just a bitflag that causes browser chrome to change slightly.
- jamiesonbecker 11y ago
  That's true, but EV on its own does provide real value as well. When you see the green bar, it's proof that it's at least nominally certified to be served from the entity displayed (barring key theft etc). Barring parallel certs, even if it was possible, wouldn't necessarily be a good idea, since there's a lot of legitimate uses for them. For instance, we also have a wildcard (non-EV) certificate for the same domain, covering *.userify.com that we currently use for customer subdomains. I'm far from an apologist for CA's. I think the entire system is broken. It's ridiculous that my browser trusts a Chinese govt CA with the same level of trust as the best US or EU CA, and it's ridiculous that it's so hard for me to customize that level of trust. Still, it's what we have right now. EV does represent some actual effort for every single issued certificate on the part of the CA's, and they do deserve to get paid for that. Whether that payment should cost many hundreds or even thousands of dollars is debatable, however!
  - 0x0 11y ago
    EV is kinda what the CAs should have done from the beginning anyways for any certificate. :-/ Btw, for parallel certs on customer subdomains, that sounds like a very niche use cache. Maybe you could have used a different base domain for user content. (Isn't that best practice anyways, to avoid xss'ing cookies onto the main site?)

noinsight 11y ago

Without OCSP stapling, every time someone connects to your server via HTTPS their client will check with the CA's OCSP server to verify that the certificate is still valid. They maintain CRL's for certificates etc. For DV certificates less so and EV certificates more so, the CA also verifies your information before issuing certificates. This infrastructure is not free. But yes, technically CA's could issue certificates for absolutely everyone for near-zero cost and they would be just as good as the ones that cost more.