Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How bad is it to use a self-signed SSL certificate?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 118 posts

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#41

Post by simon_vetter »

MyDogHasFleas wrote: post #17

I don't know why you're bothering with SSL at all. Your use case is that your site is informational, it's intended to be open to anyone, there is no personal/customer information on it, and there's no authentication (everyone is anonymous). All adding HTTPS support will do is make it marginally harder for someone to spoof your site. And why is NSA surveillance a concern? Your site is wide open for anyone to see, with…

By sending data in plain text, your users are revealing their intent to retrieve the content hosted on the site, even though that content is public.

That in itself may be considered a breach of privacy, as it exposes your users to passive capture and profiling.

Also, accessing the content you are hosting might be considered legal in some countries but illegal in others, regardless of if it is public or not.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#42

Post by logn »

anu_gupta wrote: post #31

One thing that always confuses me is the plethora of options for buying SSL certificates. I understand the difference between a single domain and wildcard SSL. But, as an example, what's the difference between Positive SSL and Essential SSL (2 types of SSL certs sold by Namecheap) - Essential being about 3x the price.

I think at some point I contacted support about that. It generally comes down to one of a few issues:

compatibility (mobile, different browsers, etc)

steps taken to verify (via phone, email, fax, proof of business registration, etc)

insurance (they'll offer various amounts of payment in liability insurance)

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#43

Post by alec »

pyvek wrote: post #14
kamaln7 wrote: post #8

Earlier quoted context omitted.

Just keep in mind that Class 1 (free) certificates are for non-commercial sites only.

Also, StartSSL's certs don't work on android (you get cert not trusted error) for some reason.

Works for me - I have a StartSSL personal cert and an Android phone (Nexus 5 / KitKat), and all of Chrome, Chrome Beta, and Firefox load up the site without any sort of warning or other indication. I also dug out a Jelly Bean phone (Galaxy Nexus) to try with the stock Android Browser and didn't have any issues.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#44

Post by gmuslera »

Certificates not just encrypt communication, they also tell that the site is really the one you think.

In that sense self-signed certificates are mainly useful for small amount of people when you have another way to validate that the certificate is valid (i.e. installing it in person in the intended client devices). Else anyone could just create another certificate with the same human readable info.

There are some free or cheap enough certificates around that are already suggested, and other ways to validate certificates that may be useful even for self-signed ones, like http://convergence.io/

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#45

Post by itistoday2 »

nav1 wrote: post #39
cowbell wrote: post #18

Earlier quoted context omitted.

Terrible compared to what? http? I don't understand why we get big scary warnings from browsers for self signed https, but never a peep out of them when submitting the same form over http.

Because encountering a site with a self-signed certificate likely means that the connection is MITM'd. In any case, with a self-signed cert you can't who you're connecting to.

CA-signed certificates do not mean that you are not being MITM'd. They are actually worse in that they give everyone (including the browser) a false sense of security that you have to pay for.

See detailed reply here: https://news.ycombinator.com/item?id=7826443

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#46

Post by markgamache1 »

YOU ARE DESTROYING THE INTERNET

Training users, who have no way to properly asses this risk, to click OK to the SSL error, is like Jim Jones's practice runs drinking the Koolaide.

Firefox had it right when the briefly made it impossible to OK the use of misconfigured SSL.

Most IT people don't understand the risk of self-signed certs. We can't expect users to make good choices here.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#47

Post by itistoday2 »

ctz wrote: post #20

If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in , then self-signed certificates are usually much better than the public CA system . But actually achieving the pre-distribution step is pretty hard, and basically impossible over the internet. You can achiev…

> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system.

Indeed, and the blockchain (combined with a proxy like DNSChain), can be used to do this securely and for free at-scale.

> Encrypted, authenticated: little padlock.

Neither self-signed nor CA-signed certificates are securely authenticated, so the padlock is completely misleading.

See this comment for details: https://news.ycombinator.com/item?id=7826443

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#48

Post by dandrews »

markgamache1 wrote: post #46

YOU ARE DESTROYING THE INTERNET Training users, who have no way to properly asses this risk, to click OK to the SSL error, is like Jim Jones's practice runs drinking the Koolaide. Firefox had it right when the briefly made it impossible to OK the use of misconfigured SSL. Most IT people don't understand the risk of self-signed certs. We can't expect users to make good choices here.

In re: Jim Jones. That isn't cute.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#49

Post by lockes5hadow »

tptacek wrote: post #23
ctz wrote: post #20

If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in , then self-signed certificates are usually much better than the public CA system . But actually achieving the pre-distribution step is pretty hard, and basically impossible over the internet. You can achiev…

A site claiming to offer cryptographic security when it is in fact not is, in reality, worse than a site that simply doesn't offer cryptographic security. Both those sites --- the SSL site and the non-SSL site --- aren't offering security. But only one of them is also being deceptive about it. However, you'll get no argument from me if you constrain your argument about dismal mis-design to browser UI/UX. The browser…

You have a point here. Perhaps the real solution is that we should make the browser throw a fit when someone tries to input a "password" into a page/authdialog that has no security as well.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#50

Post by mike-cardwell »

pyvek wrote: post #14
kamaln7 wrote: post #8

Earlier quoted context omitted.

Just keep in mind that Class 1 (free) certificates are for non-commercial sites only.

Also, StartSSL's certs don't work on android (you get cert not trusted error) for some reason.

StartSSL has worked on Android since version 2.2, which was released 4 years ago.
Post reply on HN