11–20 of 31 posts
As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?
And somehow having one of these prevents your website from being "illegitimate"...
If your problem is that people treat certificates like they're some badge of authenticity, you're really complaining at the wrong company about that.
Earlier quoted context omitted.
It prevents the data between you and the requester from being read or tampered with in-transit. Before HTTPS was popular, I used to see ISPs inject tracking JavaScript or ads into arbitrary websites for their "customers". So, in some sense yes, this preserves a legitimate version of your website for the requester.
And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP. Presumably that’s where the snark is coming from. Clearly the plaintext HTTP was less secure than self-signed certs but browsers perpetuated the “trusted” cert cartel.
This is largely because putting a huge red alert in front of plaintext HTTP pages would provoke a huge backlash from anti-HTTPS factions on the Internet.
HTTP pages should have a big red alert on them, and browsers are very slowly but surely moving in a direction of being HTTPS by default and HTTPS-only in the limited instances where it's possible. Arguably even in that world, a site claiming that the connection is secure and then offering a bad certificate is more worrying than a site that never claims the connection is secure in the first place. But ideally, eventually, we hope that the vast majority of the web is using certificates, and that visiting an HTTP-only page should be a rare event, possibly with some kind of warning in front of it.
Browsers have at the very least gotten rid of the SSL green padlock and have de-emphasized certificate origin in their presentation, and HTTP-only pages at least get labeled as insecure in modern browsers. That's a step in the right direction. But yeah, it's tough to treat HTTP-only pages the way they should be treated because a bunch of Internet users who dismiss MITM attacks will cry murder if browsers do so.
And of course absent a bunch of infrastructure and pinning capabilities and authentication mechanisms that don't exist for browsers, under current usage self-signed certificates don't really prove anything about the security of your connection.
As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?
You can automate the process. Try certbot.
Let's Encrypt has definitely been a net positive to the internet as a whole. I do wish more services/tools had cleaner integration. I've switched to mostly using Caddy for personal web and reverse proxy chores as it's just much easier to deal with imo.
I just had a positive experience with adding a Let's Encrypt SSL cert at Fly.io[1] for hosting my new PWA on a custom domain[2]. It was literally a one-line command to run but no DNS challenge
[1] https://fly.io/docs/app-guides/custom-domains-with-fly/#addi...
This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free.
A Raspberry Pi could serve this.
Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually.
The reality is that they are pure rent-seekers, charging $50 for something that can be provided for free from a fanless hobby computer.
I just want everyone to have some perspective next time you go buy a wildcard certificate for a thousand dollars, which differs from a normal certificate by just four bytes.
Count the dollars per byte.
To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free. A Raspberry Pi could serve this. Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually. The reality…
Earlier quoted context omitted.
And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP. Presumably that’s where the snark is coming from. Clearly the plaintext HTTP was less secure than self-signed certs but browsers perpetuated the “trusted” cert cartel.
> And browsers would give a huge red alert for self-signed certs but say nothing about plaintext HTTP This is largely because putting a huge red alert in front of plaintext HTTP pages would provoke a huge backlash from anti-HTTPS factions on the Internet. HTTP pages should have a big red alert on them, and browsers are very slowly but surely moving in a direction of being HTTPS by default and HTTPS-only in the limite…
As someone who is really tried of going through the small pain to pull a new cert every 3 months and then apply it to multiple machines.. what's the norm place for just buying a 1 or 2 year certificate? and is it pretty cheap?