Slashdot Mirror
Cheap SSL Certificates for Small Websites?
zaqattack911 asks: "In the workplace today it is becoming more and more common for everyday applications to be accessible over the web. Just about all the booking and tracking systems at my job are handled via web-apps these days. Along with this trend, is the increased need for secure transactions over the web. Just about all of the apps on my webserver are going to be SSL only. Some of them are for internal use only, some for the outside internet to use. Is there a cheap alternative to getting your certificates signed? Self signing my certificates works of course, but just about all browsers make a big fuss about it. Verisign asks for about 400$ initially, and 300$ to renew a certificate every year. This seems like a scam to me, and I'd love to know if anyone knows of alternatives out there? Is there a way to get around the certificate signing business? I looked at a company called RSA Security which allows a company to 'self sign' and use their accepted signature. The website doesn't mention the price, and I'm sure it's not very affordable. What else is there?"
a bunch of excellent geeks I know use entrust.
four-oh-four
They charge $199 for certificate, and have a pretty good service. I've been using them for years.
we use them for all of our commercial sites.
A year spent in artificial intelligence is enough to make one believe in God.
The stories /. has already had on the topic....
0 1/03/18/18 55230&mode=thread&tid=93
0 1/09/06/04 51218&mode=thread&tid=148
Why Are SSL Certificates So Expensive? by Cliff with 192 comments on Sunday March 18, @04:48PM
http://ask.slashdot.org/article.pl?sid=
Are FreeSSL Certs Worthwhile? by Cliff with 8 comments on Friday September 07, @11:50AM
http://ask.slashdot.org/article.pl?sid=
You can use it to create certs, and you can even add your organization to the browsers trusted organizations so the users don't get an error message.
Rackshack.net has a link to a $49 QuickSSL certificate. I haven't used them, but it sounds like a good deal.
Title says it all
There aren't really many options, because the browser has to recognize the signer, and the major browsers only recognize Verisign (and Thawte, which is also Verisign).
RSA is the company that started Verisign, so you can guarantee they'll not be of help.
If this is a situation with a limited client base, like a company, you can self-sign and send everyone your CA certificate and have them all import it into their browsers (all browsers support this, I believe). But what a pain.
I wish the news was better, but you're right -- it's a scam. The problem isn't technical; it's political.
I, for one, welcome our new Antichrist overlord.
You can even get a free 30-day trial cert.
You can purchase a ridiculously cheap ($50) 128bit SSL cert, trusted by browsers from http://www.geotrust.com
All you need a valid credit card to get a
cert. The CA key is loaded in almost all of the browsers, the notable exception being Opera.
They do send a 'auth check' by emailing the domain admin contact you can select.
The entire ordering process (including filling out forms) takes less than about 5 or ten minutes.
This should SCARE you if you're relying on the security provided by Veri$ign and the root that ship with browsers. - pablos.
You may find what you're after over at http://www.cacert.com The creator of this website believes that trusting someone should be free, and is doing his best to make this happen.
There is a nice page, http://www.whichssl.com. Through the comparison tables there I found comodo's http://www.instantssl.com. I generated a demo certificate first and after I had no problems with it, I bought it. For $49 a 128 bit, not 40. Recommended.
At $49 a piece for standard certificates they're the cheapest my company could find when we went looking last month. So far I have no problems recommending them.
sig sig sputnik
comes with openssl. It even has a nice perl script to make it easy.
What Verisign and co have that you don't is their root certificates installed with the browsers by default. For internal use you should have no problem using your own certificates. For external use, where an existing business relationship exists (ie you aren't selling to the public, but to people who can trust your cert because they know who you are) it should take little more than a quick explanation.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Sure we all hate VeriSign for all kinds of reasons.
However when you get an SSL Certificate from VeriSign and some of the other Cert signers out there, you are getting two things.
The most commonly understood thing you are getting is the encryption thats automatically accepted by just about any modern browser. However, the reason it's automatically accepted is because VeriSign is suppose to verify the identity of the business. This is why they require a Duns and Bradstreet # (It's a business credit identifier). This way you know when you're going to https://secure.yourdomain.com to enter your credit card information, that you are indeed still on yourdomain.com and that your information is encrypted, and verified to be sent to the company you intend to send it to.
So if all you are concerned about is encryption, just generate your own. It will however throw a warning in just about any browser that the identity of the site can't be verified. Other than that, cost of this service isn't going to drop very dramatically without losing its verification services.
I understand though, that browser warning annoys me too.
..There's a-dooin's a-transpirin'
There is a way to do this with ASP scripting. A good base to start with can be found at this Microsoft Knowledge base article.
It is a starting point I used to make the root certificate stick. It will present the user with a large-ish alert box asking them if they want to install the certificate. It will only do this once as long as they click 'yes'. Subsequent visits to your site will be automatic from then on out.
This is course is great for internal sites, you can educate your users to click on the box the first time, then they never have to worry again. And they know it's trusted since it came from you. One small caveat, this probably only works on IIS servers and only works in IE web browsers.
- "A non-productive mind is with absolutely zero balance."
- AC
You're going at the problem wrong. Don't worry about getting your clients to accept a self-signed cert, worry about getting them to add your own root certificate to those they trust.
This is actually straightforward - you point them to a URL that returns the root cert, with MIME type application/x-x509-ca-cert, and tell them to accept it for all uses when the broswer pops up a dialog box.
You should then use this root cert to sign your web server certs (and certs for mail servers, databases, whatever). All should be trusted immediately, assuming you have your other ducks in a row. (E.g., you need to have your web server cert's common name resolve to the IP address of the web server.)
It's a bit more work to maintain a mini-CA than to just use self-signed certs, but overall the benefits outweigh the hassles. Many of us are working on JSP tools to operate mid-range CAs, but I don't know how far most are. (The problem is Microsoft's eternally changing standards on how clients generate the cert request on their side - I can handle Netscape/Mozilla with ease, but it seems like every version of MSIE is just slightly different.)
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Have your company buy a key, then create signed keys for your domain private domain with it as the issuing key. Nobody will know, as most people still use IE, and it still has that fun bug.
The Right Reverend K. Reid Wightman,
.sig: file not found
CA links
CA links
314-15-9265
I couldn't find rackshack listed in any of the "approved" signing sources for mozzila or netscape.
"Eve of Destruction", it's not just for old hippies anymore...
... and can manage an installation of certificates on all clients, you can create your own certificate authority all by your self.
Here are some *SIMPLE* instructions for building a self-signed CA cert, and then signing SSL certs for servers. Any real implentation should probably be assessed for security (like ca-generation on an isolated machine, etc ...)
That's pretty much it. mix into your IT operations as nessecary
Why aren't you encrypting your e-mail?
That 90% is a pretty low estimate, too. Most people would estimate IE5/6 usage alone above 90%.
Kurt Seified has some good information on installing certs in I.E. Whats really cool is it lets you easily install certs for other apps like imaps/Outlook etc.
3 ,s id1_gci833806,00.html
http://searchwin2000.techtarget.com/tip/1,28948
OK, here are the CAs trusted by Mozilla ABA.ECOM AddTrust AB American Express(No, not a typo) Baltimore CyberTrust BankEngine BelSign CertEngine Deutsche Telecom Digital Signature Trust Company E-Certify Entrust.net Equifax FortEngine GTE GlobalSign MailEngine Verisign/RSA(Yes, this is what it's called!) TC TrustCenter Thawte TraderEngine United States Postal Service VISA ValiCert VeriSign Xcert beTRUSTed So, here are your choices! Choose wisely:-)
Our users are easily alarmed, so we need to use a certificate from CA that is fully trusted by all of the common browsers. This pretty much limits you to Verisign/Thawte. If you expect that most users will have mostly upgraded to more modern browsers, then your available choices increase dramatically.
I am currently considering InstantSSL... so far it's taken two days, and no signed certificate, but the price (free trial, $49/year) is right.
I do not deploy Linux. Ever.
For internal use only, there is no reason you can't be your own CA, as long as you prepare a standard client load for all of your internal users. SSL is no less secure, all the cert is used for is negotiating a session key anyway.
If you're going to enroll for more than 30 or so SSL certificates a year, you have a couple of alternatives to keep costs down. You can run a RA, which means you register the certs and a trusted CA signs them (VeriSign operates under this model), or you can get a subordinate CA that is signed by a trusted CA (RSA bought Xcert so they could offer this service).
The first company to offer a tool to let you manage your own CA was Netscape, which became iPlanet, and was bought by Sun. Their documentation is great, read this explanation of the benefits of a Self-Signed Root Versus Subordinate CA.
RSA writes very good docs too, but they're new to the CA business, and I believe the way their KCA product is positioned and pricing model will change. They are mostly interested in customers who use a lot of certs, for now.
Actually, SSL with self-signed certificates is very much like SSH. Ever noticed that the first time you connect to a given hostname, ssh makes a big fuss about how it's never dealt with that host/IP combo before and asks you explicitly if you want to trust it?
The same thing happens with SSL if your certificates aren't signed by a CA. The dialog box that appears states that no one is vouching for the identity of this host and asks you if you want to trust it anyhow. Actually I believe Mozilla now has an option where you can ignore future warnings from the site, meaning it functions much like ssh: warns you the first time if it's someone it hasn't dealt with before, and then encrypts the channel and moves on.
The reason this isn't considered ideal is that encrypted communications is only half the goal; remember SSL is about securing e-commerce, not encrypting shell sessions. So there's another objective: certifying the identity of the server you're connected to. It's all very well if your connection to the online pet food store is encrypted, but if someone has poisoned your DNS entries then what you believe is the pet food store might just be a hacker lying in wait to record credit card numbers for orders his unsuspecting victims place.
Encryption doesn't help you if you can't trust the guy on the other end of the line. Note that this is true even in the case of ssh; if someone has root access on your destination machine it is trivial to capture your password and any other information you send.
Certificates are there to solve this trust problem. How is our erstwhile pet food shopper supposed to know whether his destination is the 'real' petsfoodonline.com he has seen advertised everywhere? Well, simple: a certification authority who performs some form of identity verification has issued a certificate saying that petsfoodonline.com is in fact responsible for the server you're connected to.
Does this prevent all scams? Of course not. You still don't know if petsfoodonline is really trustworthy, nor can you be 100% sure that someone hasn't simply stolen the certificate from that server and set it up on one they control. Certification authorities are part of the security process, not the entire thing. End users and server admins still have significant responsibility.
Without CAs it would be more challenging to determine who to trust online. Some sort of distributed web-of-trust application could probably ease that burden substantially, but then companies would need to win the trust of thousands of independent webs rather than simply paying a flat fee. Thus the CAs, for online vendors, are simply one of the costs of doing business.
That said, I am sure CAs charge more than what it costs them to provide their service, as I don't think their identity checking is all too thorough. What might be preferable is if different classes of certificates existed: higher security for online shopping/banking; lower security and lower cost for general opt-in type services such as webmail. The browser padlock icon could change colors to reflect this or perhaps have a number superimposed on it, or something. Companies could pay more for a higher level of certification, and vendors could charge significantly more for their highest levels. Such a hypothetical ultra-secure rating could even involve a security audit of the target servers and a risk analysis of likelihood of intrusion, rather than merely being a "pay us this and we'll tell everyone you're awesome" option. But I don't see this happening any time soon.
Personally, I use self-signed certificates, and instruct my users to simply add my CA to their Trusted CAs (which is fairly easy to do and no one has had trouble with it.) The main problem with this is that it doesn't scale, to multiple users, whereas the main problem with CAs is that they don't scale (cost-effectively) to multiple servers.
When you make a bold claim like that, you should provide a link. I didn't believe you until I looked it up myself.
Almost instant (like 10 minute) issuance.
Trusted by 99% or so of in-use browsers (IE>=5.0, Netscape>=4.x, AOL>=5, Opera>=5).
Works great. Highly recommended.
You might need a certificate signed by a well known CA for your connections from the internet, but for all your backend server you can create your own CA. This will enable you to use a full strenght 1024/128 bit sll for nothing. There is a project called tinyca which enables you to create and signed certificates with your inhouse CA. So you create a CA for your company and add the CA to all your backend server. Once this is done, any certificate signed by your CA will be valid and fully secured.
I have tested it for Apache and Weblogic and Websphere and they work very well.
Rackshack was selling Geotrust certs for $29. Had this story been posted a day or two earlier you could have gotten in on it :). They seem to be selling them now for $49, which is still *much* better than you'll find from say Thawte/Verisign. They've worked in every browser I tried, though I believe I just saw someone say they don't work in Opera. Oh well, small price to pay to save $120+ on a cert.
Game... blouses.
I would be very hesitant to add you, someone I do not know or have a particular reason to trust, as a CA. I wouldn't mind accepting your self-signed certificate to do an SSL transaction with your site, but adding you as a CA is a much bigger security risk. If I do that, you can then sign certificates for any site, including sensitive sites like my bank's. Then you, as a potentially malicious CA, can trick me into accepting false certificates identifying my bank's site.
Thus if you don't want to use a certificate signed by the major CAs, then please just self-sign. I have no problem accepting self-signed certificates, but adding random sites you don't know as CAs is a huge security risk that no one should do (so it'd be nice if you didn't require people to do it in order to visit your site).
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
it doesn't look like they're offering an RA or subordinate CA, unfortunately.
You didn't look hard enough. The RA comes bundled with the CA (Oops I mean Security Manager). The CA can be configured to be a subordinate with little trouble during installation.
Stop Continental Drift! Reunite Gondwanaland!