[deleted]
Ask HN: How bad is it to use a self-signed SSL certificate?
11–20 of 118 posts
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#12It's terrible, because Man-In-The-Middle attacks are trivial and automatable. namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.
I agree with your answer, but I don't recall ever seeing a post mortem write-up of such an attack. Are people who have seen them in the wild all bound my NDAs or something?
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#13https://www.startssl.com/ gives out free SSL certificates. Just don't expect much on their part, given it's free. For example, they refused to reissue certificates for free after Heartbleed. Also you can't use them on commercial sites.
otherwise https://www.gogetssl.com/ is probably as cheap as it gets.
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#14Earlier quoted context omitted.
You might be able to use StartSSL's free one: https://www.startssl.com/
Just keep in mind that Class 1 (free) certificates are for non-commercial sites only.
Also, StartSSL's certs don't work on android (you get cert not trusted error) for some reason.
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#15It's terrible, because Man-In-The-Middle attacks are trivial and automatable. namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.
I agree with your answer, but I don't recall ever seeing a post mortem write-up of such an attack. Are people who have seen them in the wild all bound my NDAs or something?
I agree with your answer, but I don't recall ever seeing a post mortem write-up of such an attack.
So, if you know how MITM operates, tell me: How would the server operator ever know?
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#16It's terrible, because Man-In-The-Middle attacks are trivial and automatable. namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.
I agree with your answer, but I don't recall ever seeing a post mortem write-up of such an attack. Are people who have seen them in the wild all bound my NDAs or something?
Not many postmortems on people discovering the NSA was reading all their email either.
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#17I don't know why you're bothering with SSL at all. Your use case is that your site is informational, it's intended to be open to anyone, there is no personal/customer information on it, and there's no authentication (everyone is anonymous).
All adding HTTPS support will do is make it marginally harder for someone to spoof your site.
And why is NSA surveillance a concern? Your site is wide open for anyone to see, with or without HTTPS.
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#18It's terrible, because Man-In-The-Middle attacks are trivial and automatable. namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.
Terrible compared to what? http? I don't understand why we get big scary warnings from browsers for self signed https, but never a peep out of them when submitting the same form over http.
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#19I don't know why you're bothering with SSL at all. Your use case is that your site is informational, it's intended to be open to anyone, there is no personal/customer information on it, and there's no authentication (everyone is anonymous). All adding HTTPS support will do is make it marginally harder for someone to spoof your site. And why is NSA surveillance a concern? Your site is wide open for anyone to see, with…
If only "important" traffic is https, then that narrows the search for them quite a bit, doesn't it?
Re: Ask HN: How bad is it to use a self-signed SSL certificate?
#20If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system.
But actually achieving the pre-distribution step is pretty hard, and basically impossible over the internet. You can achieve it pretty well in a business setting, where you can push your certificates to all the clients through AD, MDM, or similar.
Sidenote: You should also take this opportunity to appreciate how dismally mis-designed web transport security is:
* Cleartext, unauthenticated: just works, no warnings.
* Encrypted, unauthenticated: THE SKY IS FALLING.
* Encrypted, authenticated: little padlock.