Hacker News Reader

Comment by jgrahamc | Hacker News Reader

It already is free. Just use CloudFlare.

I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring “iran”. Seriously[0].

[0]: https://twitter.com/matiaskorhonen/status/561063104596172800

I had the a similar problem, they refused to issue a certificate because the domain had a trademarked word in it. Seems strange they would be the ones to enforce trademarks, but I guess it could be considered as an anti-phishing measure or something.

This is a relic of the CA/B Forum (https://cabforum.org/) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holding up anything for manual review that may violate another's trademark or be used for phishing (e.g., "pavpal" with a 'v' rather than a 'y'), etc.

Each CA has their procedures but most look at data sources like the Alexa Top 1000, and specific requests from high value targets like Microsoft, Google, etc. In some cases, e.g., Microsoft, the CAs must actually reach out to specific contacts at those firms before they can issue. In other cases, they manually review and release to us.

So 20 years later we are still stuck with this: https://en.wikipedia.org/wiki/Scunthorpe_problem ?

It's always going to be around in some form, it's a clbuttic problem.

A daily saga for anyone who is stuck administering censorship.

Did CF follow up after that?

Seems like CF didn't respond for 24 days after the initial exchange, and they haven't responded to his final tweet either.

While we often make announcements there, Twitter isn't an official support channel. Requests should be filed at https://support.cloudflare.com where they can be tracked and responded to directly.

Nothing since then. I moved on and aren't inclined to go back to CloudFlare.

Unfortunately, the CAs have their policies and we must adhere to those. We're working, however, on ways to better (and automatically) communicate with them when we encounter false positives. In this particular case, yes, some have very basic string matching for keywords like "iran" -- but in these scenarios we can (and do) request them to recheck by hand.

Your particular request should have been handled in less than 24 hours (or shorter, if non-free plan). The process for some of them is more manual than we'd like, but a support request can be filed to expedite if this happens again.

- CloudFlare's PM for TLS

Two caveats with Cloudflare, not really criticisms, more just that this is the deal:

First, it's a shared certificate (several hundred other domains will share the cert with you). This has occasionally led to some awkwardness and misunderstanding in the non-tech world [1] and a few times has led to a site being blocked as "porn/inappropriate" by content filters as it gets identified with other sites.

Second, in many cases it's not full browser to server encryption.

Browser --(SSL)--> Cloudflare --(Not SSL)--> Server

1 - http://arstechnica.com/information-technology/2015/03/ted-cr...

"Several hundred other domains" is factually inaccurate. At most, there are ~40 other zones on the certificate (typically, far fewer).

The challenge here is IPv4 address space; we don't require SNI for paid plans -- cert will be returned even if server_name is omitted from the TLS ClientHello -- so we must assign these customers dedicated IP pools. We're actually in the progress of migrating all paid customers to their own certificates, so this issue will go away soon.

The article already mentions existing free providers like StartSSL and Let's Encrypt - if you really like I can add CF in there too John ;^) - but that's not news.

Perfect illustration of 'free as in speech or free as in beer?'. Wonder who I should contact at CloudFlare for my 'free' DV cert that I can use on my server...

Does CloudFlare provide free certs for anyone, or do you have to actually use their CDN?

I just used this feature with them the other day. The way it works is that if you enable SSL on a site passing through them, they'll auto-generate the front-end cert. I believe you can add your own cert for a premium. The back-end cert can be set to validated/unvalidated/unencrypted.

If you have to use their CDN to get the free cert, then it's completely wrong to bring it up as "already is free" in this context.

It seems like you need to use their CDN to get it, so that sounds to me a bit like those "free" gifts you receive with a purchase. Not truly free.

Free gift for a free services.. seems free?

It's free, but not the same as what's described in the article. The article is talking about free certs you can use with your own servers.

True, I don't understand how setting up CloudFlare and getting a cert are the same. They are not.

From their page on SSL [0], it's only for CloudFlare customers.

Also, it's not end-to-end encryption, but from client to CloudFlare - so "your" certificate may have 20+ other CloudFlare clients' domains included.

If you are using CloudFlare it makes it easy to set up, and +1 to them for making it available on all their plans. However, they're not a CA (they use Comodo?) nor a place to get free DV SSL certs (on its own).

On a personal note, I'm not surprised at all by this news. I received and installed a LetsEncrypt DV over the weekend on my Ubuntu/nginx/node DigitalOcean Droplet. So easy - no way a CA can justify selling DVs anymore.

[0]https://www.cloudflare.com/ssl/

Yeah, CloudFlare definitely deserves some praise for supporting SSL on all of their plans. It's just not a case of a free SSL cert for general use.

And indeed, no surprise. Competition causes companies to compete! Shocking. But good to see just the same.

How was your experience with LetsEncrypt?

Really smooth - my only two concerns are:

1. not implemented the auto client yet for nginx (which meant stopping the service)

2. the opaque-ness of when my domains would be whitelisted

Both of which will be fixed for public beta/release (I believe).

Highly recommend webroot mode with something similar to this[1]. Put that into a cronjob together with service nginx reload and automated zero-downtime renewal is up and running.

[1]: https://community.letsencrypt.org/t/using-the-webroot-domain...

Thanks - I'll check this out.

Good to hear. I'm hoping to start using them once they go public.

Regarding #2, do I understand correctly that domain whitelisting is just about which domains can be used with the current closed beta?

I presume so.

There may be some regulation (or suggested guidelines) about high-trust sites (like banks) that are vulnerable to phishing requiring EVs. Otherwise using the Google Safe Browsing API (as they plan on doing[1]) will probably work and is automated.

[0]https://letsencrypt.org/2015/10/29/phishing-and-malware.html

I can't wait to test it out when the Public beta will start. I am currently in the process of deploying a new webserver at work so I will certainly give this a go.

>so "your" certificate may have 20+ other CloudFlare clients' domains included

Just to clarify here, "your" certificate will definitely have around 90 or so other domains listed in it as SANs.

Which is in part what they are competing with to drive the need for them to take this direction.

This will make it free without using cloudflare (which isn't desirable/suitable or all circumstances).

It is free via StartSSL too, though some people have issues with that option.

This shouldn't be flagged. It is a viable solution. The mechanics of which can be debated, but you do get a valid cert.

Reply on news.ycombinator.com