Hacker News Reader

Comment by kijin | Hacker News Reader

> total ripoff and also insecure

I pay less for SSL certificates per year than I do for the domains I use them on. You can get a free certificate from StartSSL if you're just playing, or an $8 certificate from Comodo if you're more serious. Some registrars (cough Gandi cough) even include a free SSL certificate with every domain.

So the "total ripoff" thing has been all but solved by market competition (unless you prefer to splurge on a $800 certificate that doesn't do anything a $8 certificate can't do). It's really just the "insecure" part that needs to be addressed.

View on HN

> on a $800 certificate that doesn't do anything a $8 certificate can't do

Unless you need *.domain.tld certificates.

You can get unlimited *.domain.tld certificates from StartSSL after inexpensive verfication step. But don't tell anyone.

AFAIK those are $60, not free.

You pay that fee, and then can generate unlimited wildcard certificates for a year.

Which is > $8... and specially > free.

You can get a free Lamborghini for an inexpensive $400,000 one-time fee!

If you have >7 domains and want wildcard certificates, it is the cheapest option.

Edit: also, if I can get an unlimited number of Lamborghinis for just 400k, where do I sign up??

> If you have >7 domains and want wildcard certificates, it is the cheapest option.

Thanks for the info but I just tried to refute the fact that free/$8 certificates do the same as $800, which they clearly don't.

Don't get me wrong: it's great! But completely irrelevant for the argument.

> if I can get an unlimited number of Lamborghinis for just 400k, where do I sign up??

You only get a single certificate for $60, not an unlimited number of them.

EDIT: see child comment, I'm wrong and you do get unlimited certificates.

You are wrong. At StartSSL, you can get an unlimited number once they validated your person, which costs 60$. That validation lasts for a year. During that year you can generate as many wildcard certificates as you want.

See https://www.startssl.com/?app=25#27

"The fees for Class 2 (60$) and higher are applied to the verification and not for the certificate(s), i.e. you pay for the validations we perform. Once validated there is no limit placed on the amount of certificates one can receive (This depends on other limitations such as uniqueness of the subject line for example)."

Edit: They cover exactly their costs. The cost is at validating your persona (they call you, you fax them scans of your passport/drivers license/etc, they need to check that etc.). Issuing a certificate is fully automatic so there are no costs associated with that, so they don't charge for that.

Thanks! That's good to know! (But irrelevant to the discussion anyways.) Edited the info in the parent comment for further readers.

But why do wildcard certificates need more validation in the first place?

The $60 were meant with the inexpensive verification step. Then the number of wildcard certificates is not limited.

Why does it have to be free?

Domains are not free. Servers are not free. Bandwidth is not free. Time spent confirming a domain's ownership is not free. Would you rather get free certificates from a CA whose website is littered with gaudy ads?

That's payment for green icon in the address bar, nothing more. Monopolized market of green icons.

> Why does it have to be free?

Because that's what we were talking about: free certificates from StartSSL (or $8 from Comodo) which did everything that $800 certificates do.

I just meant to refute it.

It makes sense that the more CA's you allow into the market the less of a "total ripoff" you'd have due to competition, but intuitively there would be more of a problem on the "insecure" side due to fly-by-night companies with weak security. I don't see this as the main problem though.

In practice I feel like the whole CA system is flawed because you're trusting the CA based on the authority assigned to it by a higher governing body, a governing body you can't necessarily be sure isn't getting some blank-check signing superpowers from the CA and doing man-in-the-middle attacks on persons of interest with bogus certs. I can't necessarily trust that the authorities have my best interests in mind so I can't trust the CA signing system.

I look forward to the author's proposed solution(s) to this problem.

In what way is a StartSSL certificate any different from a Comodo certificate? What makes StartSSL only usable for "playing"?

Free StartSSL are for non commercial usage. This is, I guess, what he means by "for playing", I don't know for comodo, if their certificates can be use for commercial applications.

StartSSL is recognized by OS X 10.5 or later, and Windows 7 or later. Older OSes might not recognize it if the user has missed any updates.

I'm OK with showing IE6/7 users a polite suggestion to upgrade, but a certificate error looks unprofessional. In addition, Chrome on XP is also affected (if the user has missed the CA update) because Chrome doesn't carry its own list of trusted CAs.

If someone's browsing the internet with unpatched XP then they've got bigger problems than some certificate warnings appearing.

That's their problem, not yours. Remember, we're talking about Chrome here, not IE6/7.

Where can I find those $8 certificate? https://www.positivessl.com/ only shows me "from €49.00/ year".

Name cheap has them. http://www.namecheap.com/ssl-certificates/comodo/positivessl...

Might be thinking of that.

Reply on news.ycombinator.com