Slashdot Mirror
Free SSL Certificate Project
An anonymous reader writes "Do you have a website or run even a web server and want to secure the traffic between your visitors browser and the web site? Did you find out, that in order to make your site SSL aware, you'll need a SSL (Secure Sockets Layer) certificate? Are you also surprised to find out that such a certificate can cost you up to a few hundred dollars, valid for one year only? For what, you might ask yourself? Linuxlookup.com is running a small article on free SSL certificates."
I've always used cacert.org for free SSL certificate s. :)
This space is not for rent.
Anyone CAN get one! All you have to do is pay X amount of money.
Besides, do you really trust people such as Verisign to actively control certs?
It has always seemed strange to me that encryption via SSL and verification of your business identity were rolled into the same system.
I've had a few situations where I wanted to encrypt html and had no need of guaranteeing my server's identity to anyone. It seems like I should be able to encrypt traffic without having to jump through hoops and spend a lot of cash. Or without having a second class certificate.
I hope this new project succeeds.
Like being able to self-issue a certif is new? Used some random tool that came with MS Office to do it last time I had a use for one, of course that was Office 2K or thereabouts but it's probably still there, and there are probably alot of other ways to self-issue one. The entire point of the big expensive ones is that you have a "trusted" authority validating the transaction.
Get OpenSSL and roll your own, any time, any platform... always been that way... and this is news? Some script-kiddy-turned-public-relations-director figured this out? Good for j00. As for everyone else, nothing to see here that we don't already know.
Since the linked article is dying, who knows if you'll be able to even get the link to the real article. So here's your text, AC to keep the whoring in Vegas.
StartCom Free SSL Certificate Project
StartCom Free SSL Certificate Project The Idea:
Do you have a website or run even a web server and want to secure the traffic between your visitors browser and the web site? Did you find out, that in order to make your site SSL aware, you'll need a SSL (Secure Sockets Layer) certificate? Are you also surprised to find out that such a certificate can cost you up to a few hundred dollars, valid for one year only? For what, you might ask yourself?
StartCom Ltd., the vendor and distributor of StartCom Linux Operating Systems, operates also MediaHost(TM), a hosting company specialized in DB and Java web application hosting and offers its clients SSL secured web sites with certificates signed by StartCom Ltd already for years. Here is, where the idea for this project originated: Free SSL certificates!
How?
Most web servers, such as Apache, IIS and others are capable of running the 128-bit secured and encrypted SSL protocol. All you need, in most cases, is a SSL certificate to make it work. StartCom is going to provide you with this certificate through a simple web based interface wizard and sign up process free of charge. Together with the installation instructions, you'll have your secured web site running within a few minutes.
Why?
Because we believe, that companies like Verisign, Thawte and others, just rip you off your money! Simply as that! Even the so called "Free SSL certificates" offered by some companies aren't free, but can cost you up to a US $ 100 or even more.
More than that, lets think about, what SSL is supposed to do: Encrypt and secure the traffic between a browser and the server! Point! It is not supposed to give you the impression, that a website is trustworthy or even say anything about its identity...for this you should use your brain and common sence.* Anybody can get a SSL certificate and as such does not give any type of warranty about the intensions, or quality of products, of the website or its owners! We'll prove here, that SSL certificates can cost much less or may be even free of charge! If enough people are using our certificates and stop buying them, well, than the existence of these companies will vanish and we'll all win another piece of freedom!
* We'll offer in the future, some sort of verified SSL certificates, but on this later...
Where, when?
Convinced? We build and tested this web site during February 2005, so you'll be able to get a SSL certificate for free. Use the links below to get your free certificate now! Please spread the word about this project to your friends (by having a link to our web site?). Contact us, if you want to contribute. And....spend your money on better things! There are enough good causes to support!
Common sense says, make sure the StartCom CA Certificate is not on any of my machines!
The entire point of using certificates is so that you know that there is a certified binding between a public key and an identity. If you don't know who will recieve your encrypted information then there's no point encrypting it in the first place!
$50 per year per certificate. I've had no problems getting them to work with all browsers. Since I can't read the article, are they giving out real authority certs? Ones that your browser won't pop up the window saying it's untrusted?
./sign.sh server.csr
If not, here is a recipe for free signed certificates:
openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl genrsa -des3 -out ca.key 1024
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
And getting one isn't the issue at all - you can generate as many as you want yourself - it's getting one that means something that's the issue.
sic transit gloria mundi
When you finally get to the site that is offering the certs (http://cert.startcom.org/) all you find is bad grammar and certs that aren't recognized by any browser (i.e. warnings pop up). It's admirable that the site wants to issue free certificates, but you won't find many surfers willing to trust them. Also, you can create your own certs with minimal effort, and you'll end up with the same thing.
In practice the ID checks that I've seen done are fairly flimsy. And with "hundreds" of dollars being charged by big name certifying authorites there is strong motivation for them to just give you the cert (and take your money) once you've faxed them a couple of vaguely official looking signed bits of paper.
Anyone paying "hundreds" of bucks for a certificate is being scammed though. Much cheaper ones are available from people like GoDaddy. I can't see why anyone wouldn't just go for the $29 one, your users won't notice any difference between them unless they are particularly inquisitive and enjoy poking around obscure browser dialogues.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Didn't these people buy SCO linux licenses? Why on earth would I give them money?
Having an internet presence is critical to running a successful business venture. Also, the creation of a truly international digital economy necessitates the development of a trusted method of identity establishment. Especially in these days of questionable computer security and the impossibility of ascertaining identity from IP. Reliable certification is vital to the development of the internet economy.
However, the centralization of certification among a few organizations and their cost is shutting out smaller enterprises that don't have access to the fees or technology required. In effect, this institutes a kind of "information segregation" or isolationism that has the effect of a barrier to poorer nations - such as Nigeria or Rwanda - to the internet commerce that is so critical to the economy of the future.
As such, I believe the best scenario is free certification provided by ICANN that can certify pages from poorer nations, so they can compete on an even playing field with the wealthier nations. Giving out free certifications - one per IP address at least - is the best way to accomplish this, and will allow for confident and secure transmission of funds and information.
cacert.org is doing everything these guys are, and then some. cacert.org is free, but with a much higher level of personal confidence than Verisign, Thawt, or any others that I know of.
Additionally, with cacert.org, you are able to get more than just server certs and keys.
"Individuals are smart, people are stupid" -- Tommy Lee Jones as "K" from Men In Black
Think about this for a minute... The purpose of SSL is not to secure data during transport, it is to secure data during transport AND to verify to the sender that the reciever is who they claim to be.
Without identity verification there is NO POINT in encryption for most usages.
The point is to make the person who is submitting their credit card number resonably secure in the knowledge that they are sending it to who they think they are. This cannot happen without identity verification.
- sigs are stupid
I'm using it as (loosly) 'reboot'
So thats rougly:
Windows in 6 Bytes (IA-32): Do nothing then reboot.
Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
Does anyone even know what a man in the middle attack is anymore? Without certificates (or with easy to aquire certificates) we don't have a way to ensure that someone isn't spying on the encrypted traffic. This service will allow me to register a certificate that looks "just like" the one you expect to get from www.usemycreditcard.com and intercept your confidential details by presenting a key signed with that certificate to your browser. This is already happening with Verisign certificates, a case of them not doing their job, and now StartCom want to make it easier? I guess it doesn't really matter as the vast majority of people are too damn stupid to examine a certificate to ensure it is correct anyways.
How we know is more important than what we know.
For a (partial) list of the design and implementation problems that interfere with certificates actually solving the problem, check out Peter Gutman's scathing critique of X.509-based PKI.
Well, the point of SSL is to encrypt communications. But the point of a signed certificate is to prevent impersonation. If a trusted authority allows anyone to get a certificate for any domain name, then it becomes easy to impersonate someone's site.
I'm not sure what the point of this is, if the browsers don't have these folks listed as trusted authorities. You can already sign your own certificate and get the same effect. But if you are asking your customers/users to accept a certificate that is not signed by a trusted authority, you are leaving yourself open to being impersonated.
You post your public key in your DNS record. DNS already maintains an identity system.
The trick with DK is to get the browser's to fetch the site's public key from the DNS record (it has to do the DNS query anyway) and use that in the handshaking.
Yes, there is the potential for someone to hijack the site, but that is getting more difficult. And, DK would be a free add-on to the DNS stuff you have to do anyway.
Reminds me of one time back in HS. We didn't like our CS teacher and for our final project in C every student put a call to INT 19 at the end of their code, so when she was through running and grading our program it'd reset her computer. I don't think she ever figured it out.
------
"And may your days be long upon the earth."
...If you are doing it for an OpenSource project:o pensource. asp
https://www.godaddy.com/gdshop/ssl/ssl_
Not to mention, it's the cheapest SSL cert I know of at $30/year.
Yes, I am a smart ass; it's better than the alternative.
Let's suppose you take your PC to a coffee shop and want to read your stock-r-us.com stock portfolio...
...even though there are already PLENTY of free certificate providers out there today, stocks-r-us has to pay big big bucks to one of a few certificate agencies- There's absolutely, positively, no way around this currently, for complex reasons that are hard to explain briefly, but I'll give it a shot...
...or not: This works fine if YOU know how to recognize the stocks-r-us secret handshake, but, for technical reasons, this is only possible if your computer and stocks-r-us have chatted in the past (i.e. you've used your computer before to sheck your stocks) if not, there's no way you can get the jimmy on how to tell a genuine stocks-r-us secret handshake.
...or not: The user of their has to already know the handshake of the CA for this to work ahead of time, or the proverbial "house of cards" will just fall apart anyway... How can they be sure you already have the "secret hanshake" of this third person/CA?
First of all, there are two things, at the minimum, you need to talk to stocks-r-us over the internet securely from a coffee shop:
1. An encrypted communication channel (this is handled by public key and symmetric key encryption protocols)
2. A guarantee that the person you are talking to over the 'net really is stocks-r-us and not an impostor.
All this fancy talk in this slashdot story involves this second step in this process... so how can you get this no-impostor guarantee? Well, the most basic way would be to ask stocks-r-us a secret question only they could answer, sort of like a "secret handshake". An SSL certificate is simply a "secret handshake". (well, not so simply, but just accept this idea for now...) So in order to make sure the company you're talking to over the 'net is your stocks-r-us, you check to see if they know the stocks-r-us secret handshake. Problem solved...
This is where a certificate authority comes in: You can get a third person (whose handshake you do know) to give you stocks-r-us' secret handshake. There are many many organizations that offer free (or not free) services to act as this third person (i.e. as a "CA") So stocks-r-us can just sign up with one of these companies to give them the secret handshake info- Problem solved...
Well, the answer is pretty goofy... the "handshake" of the CA has to be "hardwired" into every copy of Firefox/Internetexplorer/Safari/etc when it is installed. If you go to the settings of your browser, you'll see a list of CAs already placed in by Microsoft/Apple/Mozilla/etc right out of the box! That's the only way this could work...
...so you might be wondering: Don't the CA companies in this initial list of built-in handshakes have some kind of monopoly/oligopoly? The answer, of course, is YES: These special CAs charge monopoly-style prices for their services for this very reason. The point of this slashdot article is that an non-profit group wants to somehow make Microsoft/Apple/Mozilla/etc to put it in this super-duper "handshake" list, but it promises it won't charge everyone big bucks who wants to use them as their third party.
(I'm no expert on this, so any experts are welcome to reply to my post to make any corrections if there are any errors of substance...)
I can't begin to imagine why why you would say this.
If you don't feel like forking over money, download OpenSSL and generate your own certs. Here's a good how-to if you're interested. But if you go this route, your users will either have to install your root certificate into their browser's trusted store (I don't recommend this, but hey, it's your computer), or they'll have to click through an annoying dialog warning that the certificate is not trusted.
What you're paying for when you buy a certificate is not so much the certificate itself, but for the processes surrounding the issuing of said certificate. When getting a certificate, you must prove to the registration authority that you are who you are, and that you have the legal right to obtain a certificate for your organization. Only after this verification has taken place will you be issued a certificate from a trusted authority. But your users can examine the certificate's chain of trust, and verify who they're talking to. Impossible to do with a self-signed or otherwise untrusted certificate.
CA's are supposed to make their issuing policies publically available. One day a few years ago when I had too much time on my hands I went through and checked them all. Of the 100 odd root certificates that were originally installed in my browser, I threw out about half for not having their policy publically available in human readable form. I threw out most of the rest (including Verisign and Thawte's low-end certs) because their policy was too lax, but maybe I just have high standards.