Hacker News Reader

Comment by ck2 | Hacker News Reader

While I despise the SSL cartel, there are many problems with this attempt at a solution.

Let's Encrypt began testing their free SSL certificates this week and will formally launch November 16th (two months from now)

https://letsencrypt.org/2015/08/07/updated-lets-encrypt-laun...

However they have no plans for wildcards and you have to renew every 90 days (automation possible).

They also do not have their intermediate certificate working yet (but will have to by November).

But if you do not need wildcards, the StartSSL free certificate has been an option for a long time:

http://www.startssl.com/?app=33

(startssl works in all browsers and has a 1 year renewal)

View on HN

> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time:

In fact, the free StartSSL Class 1 DV certificates are only available for non-commercial purposes. They DO enforce this, I have had a cert turned down by their "CertMaster" because they considered it part of a commercial operation.

That is why Let's Encrypt is doubly cool - it is not (at least, in any obvious way) motivated by $$.

WoSign issue free certs with up to 100 altnames, which is almost as good as a wildcard cert for many purposes, valid for up to 3 years. They also revoke for free.

They're the best option at the moment if, like me, you don't want want to put a penny in to the CA industry.

I was not aware of this option. However, it seems to be operating out of China. How does that affect security and availability in the long run?

Maybe availability but as long as you generate the private key part and paste your CSR on the website they can at worst revoke your certificate. So from a security perspective they're not worse then the others.

You already trust them. They're in all the major browser trust stores

It doesn't affect security, they're already in browsers' trust stores. It does affect availability, but only because (the last time I checked) WoSign's OCSP responders operated from China only. To address network latency issues with your users located far away, make sure you have OCSP stapling configured on your servers.

They lowered that to 10 lately. I was also surprised but I guess they pissed of others in the biz. Usually I see it limited to 40 by the comercial options.

On the server side you've to make sure you run a decent nginx/apache with OCSP stapling support. Their responders are slow.

Reminds me of GApps. First it was free (without support) for 50 users, then 10, now the free option is gone and they aren't even competitive if you just want quality personal or family webmail @yourdomain.com

If you're in the market for a certificate I'd jump on board now before it sails, and you're left 'stuck' with whatever automated hoop-jumping crapola Mozilla wheel out in 2 months.

> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time

And if you need a wildcard cert, startssl will give you any number of those for just 50$.

gee how benevolent of them

while I in general also disagree with the whole CA thing one has to admit that running a CA is not for free. That setting up the auditing, buying a HSM, running the interfaces and so on. And last but not least running the CRL/OCSP infrastructure. From my point of view the main part you pay a good CA for is that they run the OCSP service. Though with OCSP stapling that burden is a bit relaxed.

startssl covers the cost of their labor, not the cost of a 'license' to use the certificate. Their cost is validating your identity, which is a one time thing. They call you, ask a few questions and that's it. 10 minutes of their and your time. After that you are entitled to create as many certificates as you want. There's one caveat: the validation is only for one year, you have to renew it when your certificates are about to expire. Even if you have just one domain, it's cheaper than the alternatives. If you have multiple domains, startssl is much cheaper.

Actually it is $60 now - and the signup process for wildcards requires heavy duty validation - IDs, passports, corporation documents and other things are sometimes requested.

I wouldn't call that heavy duty. Sending them a scan of your passport or ID (which you already have somewhere on file...) is hardly too much to ask for. It didn't take me more than 10 minutes. And they'll even call you back to validate the information on a sunday! (which I think is impressive)

Reply on news.ycombinator.com