Hacker News Reader

Comment by nly | Hacker News Reader

WoSign issue free certs with up to 100 altnames, which is almost as good as a wildcard cert for many purposes, valid for up to 3 years. They also revoke for free.

They're the best option at the moment if, like me, you don't want want to put a penny in to the CA industry.

View on HN

They lowered that to 10 lately. I was also surprised but I guess they pissed of others in the biz. Usually I see it limited to 40 by the comercial options.

On the server side you've to make sure you run a decent nginx/apache with OCSP stapling support. Their responders are slow.

Reminds me of GApps. First it was free (without support) for 50 users, then 10, now the free option is gone and they aren't even competitive if you just want quality personal or family webmail @yourdomain.com

If you're in the market for a certificate I'd jump on board now before it sails, and you're left 'stuck' with whatever automated hoop-jumping crapola Mozilla wheel out in 2 months.

I was not aware of this option. However, it seems to be operating out of China. How does that affect security and availability in the long run?

Maybe availability but as long as you generate the private key part and paste your CSR on the website they can at worst revoke your certificate. So from a security perspective they're not worse then the others.

You already trust them. They're in all the major browser trust stores

It doesn't affect security, they're already in browsers' trust stores. It does affect availability, but only because (the last time I checked) WoSign's OCSP responders operated from China only. To address network latency issues with your users located far away, make sure you have OCSP stapling configured on your servers.

Reply on news.ycombinator.com