Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Looking for someone to help create a trusted CA

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Ask HN: Looking for someone to help create a trusted CA

#11

Post by jamieweb »

Other commenters have already covered the political/financial difficulties of this, so I won't mention those.

However, the journey of CertSimple may be marginally relevant to what you're proposing.

They were a small CA focusing entirely on the easy issuance of Extended Validation certs.

Disregarding the fact that EV never actually had any proven value (except for some code signing use cases), they did have a nice little business.

As far as I know it was a one-person company at first, and they were able to piggyback off the infrastructure of an existing CA. I can't remember whether it was an intermediate cert or simply reselling.

I was going to link to them but they seem to have shut down or been absorbed into another company.

Re: Ask HN: Looking for someone to help create a trusted CA

#14

Post by Ayesh »

Shitpost: https://bugzilla.mozilla.org/show_bug.cgi?id=647959

Running a CA is not easy, and getting your root certificates included in trusted roots is even harder.

For the technical aspects of it, you will need an HSM for the root certificates generated, OCSP servers, a CRL mechanism, and the signing server. Many enterprises already run their own private CA, and there are plenty of free and open source software.

The difficult part is convincing root CA programs. Mozilla, Google, and Apple would be the start, but I suppose Curl/Java/Debian (which sync with Mozilla) will take some time to catch-up too. You need to be audited (by firms like KPMG and they don't come cheap), and they expect a certain level of transparency.

Why would you want to become a CA in the first place? Amazon and cpanel are root CAs that issue certificate for free. LetsEncrypt is free and issues certificates to everyone. I don't think there's any financial profit to be made anymore.

Re: Ask HN: Looking for someone to help create a trusted CA

#15

Post by duskwuff »

grizzles wrote: post #5

The technology side is super easy if you know what you are doing. Getting your cert into the browsers is the problem. It's a political / sales & marketing type of problem. Why should they? You need a pretty convincing answer. Because it's pretty hard to motivate Google or Microsoft with the offer of a cash payment. It depends on what you mean but getting a cert into OSs / devices should be a lot easier.

> The technology side is super easy if you know what you are doing.

There are some nontrivial technical aspects which will be required if you want any certificate stores (browsers, operating systems, etc) to take you seriously.

Running `openssl ca` a few times won't cut it. You'll need a honest-to-god HSM to store your root keys in, a witnessed procedure for generating those keys, and some ironclad policies on access to those keys. This isn't something you can half-ass and fix later; if there's any doubt about who might have access to the root keys, the CA will never be trusted.

Re: Ask HN: Looking for someone to help create a trusted CA

#17

Post by pgporada »

You'll want to study the Baseline Requirements and join the various forums such as MozDevSecurityPolicy (MDSP). Do you have a business plan for this month, year, next year, 2 years out? Are you ready to not sleep and hate yourself for an undetermined time as you get this thing bootstrapped?

Re: Ask HN: Looking for someone to help create a trusted CA

#18

Post by exikyut »

Considering all of the, uh, interesting goings-on that have happened in the CA world over the past few years, the first thing you need is trust and transparency. Buckets of it. Preferably your own personal waterfall.

I get the impression you may not be aware of the fairly unbounded levels of paranoia and suspicion that make up the bulk of public (personal and corporate) opinion about CA trustworthiness.

You very obviously have a motivation and agenda to post here, and for the sake of simplicity I trust that this is benign. But not actually documenting that rationale, let alone adding some reassuring arguments, kind of comes across to me as Step #1 in How To Successfully Not Succeed At Being A CA.

Re: Ask HN: Looking for someone to help create a trusted CA

#19

Post by exikyut »

jamieweb wrote: post #11

Other commenters have already covered the political/financial difficulties of this, so I won't mention those. However, the journey of CertSimple may be marginally relevant to what you're proposing. They were a small CA focusing entirely on the easy issuance of Extended Validation certs. Disregarding the fact that EV never actually had any proven value (except for some code signing use cases), they did have a nice lit…

Yup, absorbed into https://expeditedsecurity.com/certsimple/

Re: Ask HN: Looking for someone to help create a trusted CA

#20

Post by frogcoder »

I'm no expert on creating a CA. The changelog recently has an episode on Let's Encrypt. It covered a lot about how Let's Encrypt got started. Quiet an amazing job, I think you should listen to it or at least read the transcript.

https://changelog.com/podcast/389

Post reply on HN