Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

51–60 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#51

Post by mmaunder »

jgrahamc wrote: post #40
mmaunder wrote: post #26

On a related note, Cloudflare use Baidu servers in China operated by Baidu staff. My understanding is that this means private SSL keys given to Cloudflare live on Baidu owned and operated servers. http://www.cnbc.com/2015/09/14/chinas-baidu-and-cloudflare-i... They offer "keyless" ssl which puts the private key back in the data center but this adds complexity and latency on the initial connect so I suspect most don't…

Nope. Your "understanding" is completely wrong. CloudFlare's network in China does not contain configuration, settings, SSL certificates etc. from non-China CloudFlare customers. We run separate infrastructure there and only if you go through the hoops to expose your web site on our network inside China do we send information about your web site there. Source: me (I'm CloudFlare's CTO)

Not that wrong. You're just saying you have to enable China.

Do you make it clear in the UI that a private key is ending up on Baidu's servers operated by Baidu's people? I don't use CF so I don't know - I'm just curious what the user experience is like. I'm asking because your CEO addressed concerns in the CNBC article about Baidu having access to your intellectual property so they seem to have full access.

I think the issue of user education is a real problem. I'm Wordfence's CEO - we're the biggest security vendor in the WordPress space. (We occasionally work with your support staff to solve a customer issue) and I know that user education in infosec isn't what it should be. We're actively working to try and fix that with a vendor neutral learning center we created.

So for example I'm not sure users understand the impact of having a partially secure connection to the endpoint when you only have SSL to a Cloudflare edge server and are reverse proxying in the clear. Same issue here - I'd like to learn more about the UX and how the location of their private keys is explained to them.

I think as vendors we're often to blame because the marketing team gets a little too excited at the cost of user education and clarity.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#52

Post by jhkaghjkga »

0x0 wrote: post #48
EwanToo wrote: post #34

Earlier quoted context omitted.

I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?

Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.

That's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#53

Post by Tepix »

Quote from the article:

"StartSSL already refused to revoke certificates affected by the HeartBleed vulnerability and accused the user from negligence."

That's wrong. They did charge a $25 fee for the revocation, however. I think it's reasonable since there is probably some manual process involved and the certificate was already free. They have to earn money somehow.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#55

Post by imron »

sandGorgon wrote: post #17
imperalix wrote: post #10

Earlier quoted context omitted.

I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.

can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).

How about storing the letsencrypt certificates in a data-container/locally on the host and mapping those files to the nginx container when you start it?

For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#56

Post by Tepix »

subway wrote: post #16
Laforet wrote: post #14

Earlier quoted context omitted.

Your concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert. Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromise…

By default, StartSSL's wizard generates private keys for you. (Providing your own key is of course an option).

I agree that's sneaky. I would never use that feature - it's an invitation to do MITM attacks later on.

When I first saw the form with this option on their website I thought "oh so that's why the Mossad is running this CA for free..."

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#57

Post by Tepix »

bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

These alternatives don't offer S/MIME certificates, do they?

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#58

Post by Tepix »

ascorbic wrote: post #36
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

StartSSL has some of the worst support I've ever encountered. Normally bad support means clueless or non-responsive. However StartSSL support is often actively hostile, treating customers as idiots or worse. I should point out that this isn't always the case, and I have used them in the past without trouble, but the times when it is bad are bad enough to write them off. Their site also looks like it was made in 1998,…

I've had good experiences lately, when they relaunched their website the option to create your own certificate for S/MIME had disappeared (on Mac - apparently it was still there when using Windows). I opened a ticket and the next day it was fixed. Now you can even upload your own CSR for S/MIME certificates which allows for 4096bit S/MIME keys. Previously they only had the in-browser key creation. Nice.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#59

Post by raesene4 »

specialist wrote: post #39
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

Just today, I'm setting up my first https by myself. Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs. But I got "Failed to connect to host for DVSNI challenge". Start googling, reading, messing around with this for a while. No joy. Bailed on Let's Encrypt, started over wit…

have you tried using something like https://gethttpsforfree.com/ as a front-end to the Lets encrypt process?

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#60

Post by Tepix »

specialist wrote: post #39
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

Just today, I'm setting up my first https by myself. Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs. But I got "Failed to connect to host for DVSNI challenge". Start googling, reading, messing around with this for a while. No joy. Bailed on Let's Encrypt, started over wit…

The official Let's Encrypt client is bloated and wants to fiddle with your HTTP server configuration. Bad idea.

Use something small like https://github.com/kuba/simp_le or https://github.com/diafygi/acme-tiny

Post reply on HN