Viewing profile — womble

Little known fact: "Pulumi" is a Zulu word for "unusually large pile of elephant droppings."

I'm not developing the co-op based on the assumption that domain validation can be wholly automated -- but it can be automated for the 99+% of domains that don't try to phish peopl…

(disclosure: I'm the SSL co-op guy) Organisations aren't code, so trying to make analogies to "forking" CAcert isn't something that stands up to scrutiny. Yes, audits for WebTrust …

(disclosure: I'm the SSL co-op guy) CAcert's goal is to issue certificates for free, by implementing an alternate identity validation model. The SSL co-op's goal is to issue a subs…

"No one should have to sacrifice security because they don't want to fork over that sort of cash" It's a bit long to be the SSL co-op's tagline, but as a motto, you've pretty much …

Anything that includes a trademark (like info-secure- apple .com) or "risky" term (like atlanta-usbank.com) typically ends up getting manually verified, even for domain-validated c…

I'm a little surprised that so many people deliberately mangle URLs to see if there's anything listening on :443, myself. I might just pull SSL off the other domain on IPv4, and pu…

I'm not averse to that idea, in principle. Heck, that sounds like a nice complementary business idea -- you run a DNS registrar that offers a free domain-validated wildcard certifi…

Revocation for X509 certs is a very different matter to that of revoking PGP keys. For X509, the CA can revoke the cert unilaterally, or at the request of the subscriber without th…

Running a revocation service is an annoyingly fiddly job, but all of that needs to be setup and running before you become a CA. Pretty much all of the faffing around is in the need…

(disclosure: I'm the SSL co-op guy) All of Google's free services (CDN, DNS, Chrome, etc) are centred around improving the experience of using the web, so more people use it for lo…

(I'm the SSL co-op guy) - Probably in Australia, at least at first, since that's where I'm based. I'd like the DR site to be in Europe, if possible, but that might not be a day 1 a…

All we have to do is get all certs flagged with must-staple and have all webservers handle stapling, and we're set ! (Sarcasm? Moi ?)

(I'm the sslcoop.org guy) Yeah, well, I haven't worked out how to tell nginx to look at the SNI for a HTTPS request and bomb out completely if it doesn't match any SSL-enabled vhos…

(I'm the sslcoop.org guy) "If all the money we spent on ssl certificates..." And thus was sslcoop.org born! I'm not sure what you mean by "opensource PKI infrastructure", exactly, …

There are rules being introduced against issuing certificates for more than about three years (you can still get five years certs at the moment, but not for much longer); this is m…

(I'm the sslcoop.org guy) That's essentially the model I'm looking to implement. I prefer DNS modification for domain validation, but anything that can be automated will be.

(I'm the sslcoop.org guy) StartCom's $60 wildcard is the cheapest I've ever seen. I'm impressed with StartCom's model overall, and it was a great inspiration to me with the SSL co-…