Can anyone who knows more than me say - is this the beginning of the end of the SSL cert selling business? Is there still value to buying an expensive cert from another vendor?
I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4:
* CloudFlare https://www.cloudflare.com/ssl
* StartSSL https://startssl.com
* WoSign https://buy.wosign.com/free
* Let's Encrypt https://letsencrypt.org
For people reading this comment dozens of months in the future, a maintained list will be kept at https://paragonie.com/white-paper/2015-secure-php-data-encry...
* CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to.
* StartSSL free tier is for non-commerical use only.
* Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction when it comes to security products.)
Let's Encrypt is a big step forward in having a legitimate, actual, user-friendly, free TLS certificate issuer without restrictions for usage scenarios.
This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL.
You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want.
Only drawback is that the certificates are only valid for one year.
As a service to the community, could you name some places where you can do that?
I wouldn't bother with StartSSL with that many catches and hassles.
How do I know? I've got two of them in the past in two occasions.
They only allow one-year certs to be generated, but you can renew them and get as many of them as you want. I've got class one certs from them for two different domains, and I've replaced both those certs twice as they've expired.
Then again, maybe they've changed their policies in the past six months.
> requires a valid U.S. physical non-commercial address for registration
Does it? I'm based in Ireland, and I haven't had to provide the with a valid US physical address, unless this is something new that they've brought in during the last half a year or so.
> and is subject to $79 for revocation fee.
Yup, that's the most annoying thing about dealing with them.
> Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process.
I can't say I've had that issue myself. They're not as fast as I'd like, but I've never had any major problems with them.
I could say the same for most countries.
Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates.
Total money spent on SSL: $0.
https://blog.cloudflare.com/universal-ssl-encryption-all-the...
Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.
Also note that free single domain certificates have been available from StartSSL for a very long time, but this didn't destroy the certificate industry.
[1] https://sandstorm.io [2] https://docs.sandstorm.io/en/latest/using/security-practices...
There are a few existing Nginx configs for that (search for "nginx dynamic ssl cert").
Anyway, Sandstorm developers told me that they wouldn't plan on using Let's Encrypt while it doesn't offer wildcards, so I think we are missing out on supporting this use case.
Given the occasional implementation weakness, and key recoveries, I would much rather bind only one key to a name.
And from the client perspective is makes pinning much easier.
I'm not a fan of one-wildcard-to-rule-them either but keeping active certs to a handful through the judicious use of wildcards is a real boon.
That server would be used to keep track of your domains and certificate status and which servers are authorized to work with which domains, etc... Also easier to backup.
One year passed, and I checked my backups. Yup, there it was.
If you take security seriously, you should actually read what's on the page instead of clicking "next, next, next" like some driveby malware-installing Windows-installer. And then this shouldn't be an issue.
I guess this is StartSSL's way of not having to deal with people who don't take security as seriously as they do.
Having a login cert is fine if the "user" is an organisation. It is a broken model for individuals or small businesses.
StartSSL doesn't take security serious. They'll happily accept breaches to their terms of use, as long as you pay up.
This level of proof of control is standard for DV certs, although other providers haven't automated it to the extent Let's Encrypt has, at least not with as high-quality software. One hole in this verification of course, is that 'control' may not actually be 'ownership', it could be someone who's hacked the host or DNS. But that's not unique to Let's Encrypt, it's a side issue, proof of control is standard and accepted for verification for DV certs.
So anyway, that kind of automated proof of control is a lot harder to apply to all of *.example.com, not just an individual host a.example.com. There are likely ways to do it well, but it's harder to do and harder to get right. Is probably why Let's Encrypt, at least for now, is not doing it.
If you control the domain `example.com`, sure. if you just control the single host that `example.com` points to, that doesn't neccesarily mean you control the domain, and in fact DNS contortions are needed to even have example.com point to a host.
Another benefit of this is ownership can be validated on an ongoing basis (is the TXT record still there? yup, still valid) without requiring any software to be running on any hosts at that domain. And you can validate a domain without even having an A record if you want (say, if you're getting all your ducks in a row before exposing your server to the world).
I ended up paying $10 on namecheap instead.
At least it used to work like that.
Do you really know the difference between Citi Bank and Citibank? No? Then EV hasn't saved you from being phished.
Section 9.2.1 (Page 9): https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf
In addition to using & verifying the legally registered name, it must be verified that there is a physical address for the business, if that address doesn't match the registered location, additional verification is required. There are additional provisions of verification as well. See section 11 of the same document.
I don't know if it's worth the money per se, but you can pin a couple of trusted CA root EV certs via HPKP and know it's much more difficult for someone to "accidentally" issue a valid cert for your site.
If you do that, users won't see a lock instead of a green bar, they'll be blocked from accessing the site at all (if it's not their first visit and they're using a modern browser).
The only security feature EV certs have over regular ones right now is the use of certificate transparency, but that should be extended to non-EV certs within 1-2 years.
You could pin your own cert, but that makes it difficult to rotate keys in a heartbleed type situation.
Though it would not protect from factoring because most EV roots are the same key length/hash.
For anyone else reading, this works because the root programs give authority to issue EV certs separately from other certs. To keep the authority separate (most, perhaps all) CAs use separate roots for EVs.
If you are running a commercial, high-traffic website, then yes, there is.
For example, EV (extended validation) certificates is currently the only way to quickly build and maintain a "reputation" with 3rd party website ranking systems such as Microsoft's SmartScreen and, based on anecdotal evidence, with Symantec SafeWeb and Google SafeBrowsing services. Needless to say that SmartScreen is on by default in IE/Edge and SafeBrowsing is on in Chrome and, in part, Firefox.
I run https://certsimple.com. We only do EV certificates, and we do it much faster than any of the existing companies, which normally quote 7-10 days to complete the validation process. I waited around a month for GoDaddy earlier this year, which is how I ended up making CertSimple.
CertSimple do EV certificates in an average of 5 hours.
- We check the customers info against the required government information sources (as well as a number of other places) before customers pay us.
- After we take the order, we provide a specific set of instructions based on a number of characteristics of the customer's actual business to make the validation process as fast as possible.
- We have a real focus on UX: there's no software to install or command line questions, our validation UI updates live, and we manually follow up with every customer to iterate our product.
I'm mike@certsimple.com, or @mikemaccana on Twitter.
They are generally good. There was one case when they started pulling a Comodo thing on us - the lawyer's signature was unintelligible, go and redo the paper - for some secondary document. But each email includes a note to email their support head if something's off, which is what we did and he had the cert issued in an hour after that. So the tops do care about their service levels and there's an easy way to escalate issues.