Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

21–30 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#21

Post by ars »

xxpor wrote: post #5
aftbit wrote: post #4

Earlier quoted context omitted.

When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.

Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.

I got downmodded before for saying this, but I still feel this way:

Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like.

I don't consider this a positive thing.

You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way.

I have yet to hear any useful reason to rotate the key.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#22

Post by 0x0 »

bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

Lack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still highly desirable.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#24

Post by markdown »

mchahn wrote: post #9

I personally have a serious problem dealing with the state of china's telecommunications. It's about as close to evil as you can get. I'm not saying other state actors are much better but, I'm just saying ...

You're joking, right?

China has a terrible record against their own citizens, but the US government has a proven, published record of spying on the entire internet.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#25

Post by dujiulun2006 »

steve371 wrote: post #15

Chinese company is not a red flag. but Qihoo is. The company has known bad reputation. a. they labeled their own browser as a Microsoft security update, which triggered MS investigation b. they cheated on the anti-virus lab testing and got banned. ....etc.

For Chinese people working in IT industry, Qihoo is an awful company for the reasons mentioned above, but also for allegedly assisting government Internet censorship.

Now let's make their awful name worldwide. ;)

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#26

Post by mmaunder »

On a related note, Cloudflare use Baidu servers in China operated by Baidu staff. My understanding is that this means private SSL keys given to Cloudflare live on Baidu owned and operated servers.

http://www.cnbc.com/2015/09/14/chinas-baidu-and-cloudflare-i...

They offer "keyless" ssl which puts the private key back in the data center but this adds complexity and latency on the initial connect so I suspect most don't use it.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#27

Post by skeolawn »

markdown wrote: post #24
mchahn wrote: post #9

I personally have a serious problem dealing with the state of china's telecommunications. It's about as close to evil as you can get. I'm not saying other state actors are much better but, I'm just saying ...

You're joking, right? China has a terrible record against their own citizens, but the US government has a proven, published record of spying on the entire internet.

I'm guessing you have a lot to learn about China.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#28

Post by dujiulun2006 »

mmaunder wrote: post #26

On a related note, Cloudflare use Baidu servers in China operated by Baidu staff. My understanding is that this means private SSL keys given to Cloudflare live on Baidu owned and operated servers. http://www.cnbc.com/2015/09/14/chinas-baidu-and-cloudflare-i... They offer "keyless" ssl which puts the private key back in the data center but this adds complexity and latency on the initial connect so I suspect most don't…

https://www.cloudflare.com/china/

[quote]For the moment the China network does not support HTTPS traffic (HTTP only). Support for SSL/TLS will be made available in the coming months.[/quote]

As long as you don't sign in to China servers, they won't put you there. Even if you want to, first you need valid ICP certificate issued by Chinese govt.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#29

Post by baby »

mmaunder wrote: post #26

On a related note, Cloudflare use Baidu servers in China operated by Baidu staff. My understanding is that this means private SSL keys given to Cloudflare live on Baidu owned and operated servers. http://www.cnbc.com/2015/09/14/chinas-baidu-and-cloudflare-i... They offer "keyless" ssl which puts the private key back in the data center but this adds complexity and latency on the initial connect so I suspect most don't…

Baidu is like Google but in China. They must already have a certificate in any browser's trust store. And also, think about all the keys contained in AWS servers, and AWS is in America...

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#30

Post by profmonocle »

ars wrote: post #21
xxpor wrote: post #5

Earlier quoted context omitted.

Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.

I got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.

Hasn't this always been true for domain validated certificates? If you control the domain's content, you can get a cert. I don't see how LE makes that any worse.
Post reply on HN