Slashdot Mirror
Self-Regulating SSL Certificate Authority?
bcg asks: "It has come that time again to renew some of my SSL certificates and part with substantial amounts of cash. This has got me thinking - why should we pay large amounts of cash for authorized certs when so little is done by the companies issuing them? Sure they get you to send them a copy of a business certificate but how does this prove the character of those running the SSL server? What ideas can we come up with for a self-regulating certification authority? Could we set something up along the lines of the many free DNS servers around but use it to authenticate SSL certs?"
We last touched on this subject in October, when someone was searching for cheap
SSL certs. We've also discussed why certs are so expensive. Why not take it one step further and discuss ways of making and authenticating our own certs for free...or as close to free as possible?
Just create your own CA certificate and then write an html page for Netscape and another one for IE so that it loads your CA certificate into the browser's certificate database.
Then use your CA certificate to issue as many certificates as you like. As long as the DN matches the hostname or IP of your HTTPS server, your users' browser will play along happily.
Comodo issues relatively inexpensive certs that are accepted by most consumer, and even most non-consumer browsers.
FreeSSL also offers inexpensive (though it doesn't quite seem to be free) certs.
They seem to work with Lynx, Mozilla-based browsers, IE... Well. Look at the compatibility list. =]
If you want to be compatible with EVERYONE, you'll have to spend a bit more, but these are good for the majority of e-commerce sites, and intranets/basic sites.
-Sara
You can get free ones from cacert.org.
I use them to SSL enable my website at glasgownet.com and any other stuff I need certs for.
Well worth it.
FreeSSL offers free certificates. They confirm by email and an automated phone call. You'll be certified in 10 minutes or less. I found them after reading this article and looking around a bit. Absolutely no problem getting it working. Wish I had know about this sooner.
Yes, they also have non-free certs, but for the life of me I can't figure out the difference. My only question is how they make any money offering free certs and making automated long distance confirmation calls.
Gotta say, it's pretty cool when you press # on your telephone and the web page updates to show you've been confirmed.
Now if only I could figure out a way to get SSL working better with name-based virtual hosting.
- Some browsers do not allow you to click 'yes' at all. Think older IE browsers which simply gave you the "something is wrong" page. It may be a completely valid cert in Mozilla, but with this browser you can't view the page no matter how much you want to.
- If you do get the ssl warning and the option to say "yes", how do you know you're not the victim of a man-in-the-middle attack?
Unless you actually control both endpoints (say you are setting up SSL using Stunnel on machines you run) then self-signed certs are not perfectly secure. Or, if you do verify everything as you should, you have introduced a huge hassle in performing secure SSL.For example the latest version of Blazer for my palm has no such feature, so I'm screwed.
In order to click "yes" you should verify that the SHA1 and MD5 fingerprints are correct. Do you carry a copy of these around in your wallet so you can use that web page when you're on the road? I didn't think so.
I only wish I had one.
I use so many SSL certs that I became a reseller for InstantSSL. It basically costs $200 and you get the ability to generate all the certificates you want without first providing business licenses. It also costs about $8 less, too. There's also zero turn around time...I get the completed cert immediately. It's *extremely* convenient but it kind of defeats the concept of a trusted source.