Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Snitch.io – SSL auditing and alerting

snitch.io

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Show HN: Snitch.io – SSL auditing and alerting

#21

Post by yourabi »

_asciiker_ wrote: post #6

I think you're trying to solve a non-problem since the company that sells the certificates warns you (sometimes even more than those intervals), afterall, they want you to renew as well. As for checking for quality, that should be the sys admin task or the webmaster. good luck though!

Thanks for your feedback but I strongly disagree and I think recent history supports that CAs don't do much for you once they've collected your payment.

CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a revoked certificate in production.

I've bought multiple certificates from different reputable vendors - I only ever got one Heartbleed notice. (This pattern repeats itself)

Many shops don't have a dedicated admin / webmaster auditing their certificates and even those that do have had public issues (Akamai, Apple, GitHub, Stripe...etc)

The value in a service like Snitch is that we worry about your SSL certificates. Many people don't have the interest or time in rolling their home grown monitoring of this stuff...

Re: Show HN: Snitch.io – SSL auditing and alerting

#22

Post by yourabi »

aroch wrote: post #18
danielbln wrote: post #14

Earlier quoted context omitted.

I would think that bigger companies would use dedicated IT staff over a start-up for something crucial like SSL cert checking.

Given that Microsoft and Amazon have both had their SSL certs for their cloud businesses expire, a little extra reminding probably can't hurt. That said, I wouldn't pay for a service like this from a random person, I'd have my registrar do it (MarkMonitor or similar -- that's why they're paid the big bucks).

Thanks for the feedback and thoughts, aroch.

Can I ask why you wouldn't pay a "random person" as you say - since this information is by definition public?

Can you tell me a bit about your experience using MarkMonitor to do this?

Re: Show HN: Snitch.io – SSL auditing and alerting

#24

Post by yourabi »

mobiplayer wrote: post #17
junto wrote: post #7

Cool idea. I had the same idea back when Heartbleed was in full swing. Nice to see that someone has actually executed the idea. Bravo!

There are various implementations of the same idea out there and they've been there for long. In any case, very nice execution on the front end. Good job.

Thank you!

We're constantly improving and adding extra checks.

Re: Show HN: Snitch.io – SSL auditing and alerting

#26

Post by yourabi »

evandena wrote: post #13

$10 a month for one certificate seems kind of expensive, considering a script with openssl can do the same thing for free. And only 25 for enterprise? Our midsize business is currently using 416 certs.

Thank you for the feedback - interesting to hear that your midsize business generated 416 certs.

We do more than you can do by scripting OpenSSL. For example: as far as I know OpenSSL won't warn you if your certificate is signed using SHA1 - one of new several features we're about to push out.

More generally scripting OpenSSL requires knowledge, time and infrastructure many people aren't able or willing to invest (what is monitoring the monitor...)

Re: Show HN: Snitch.io – SSL auditing and alerting

#27

Post by yourabi »

bowlofpetunias wrote: post #8

Great idea, will certainly give it a try. Not a big fan of pricing plans that mix volume with features, always makes me feel I'm being screwed when I only need one or the other. (Even though I might be perfectly fine with paying the same amount if the pricing structure was different.)

Thank you for the feedback!

Definitely something we'll consider. Email me if I can help out in any way! hn username at currylab.com / gmail.com

Re: Show HN: Snitch.io – SSL auditing and alerting

#28

Post by yourabi »

rficcaglia wrote: post #11
spindritf wrote: post #5

You do more than that but really the CA should handle alerts about expiring certificates. They have full knowledge of all certificates, and contact to the responsible party.

true but then you need to actually renew it amd then install it....too many times tickets are filed but get put at the bottom of this list until last minute, or worse a customer reports the nasty browser security warning page though i do wonder if "this is a feature, not a company"?

Thanks for the feedback.

We're constantly improving and rolling out new features. We're confident that over your question will become less of a question :-)

Re: Show HN: Snitch.io – SSL auditing and alerting

#29

Post by aroch »

yourabi wrote: post #22
aroch wrote: post #18

Earlier quoted context omitted.

Given that Microsoft and Amazon have both had their SSL certs for their cloud businesses expire, a little extra reminding probably can't hurt. That said, I wouldn't pay for a service like this from a random person, I'd have my registrar do it (MarkMonitor or similar -- that's why they're paid the big bucks).

Thanks for the feedback and thoughts, aroch. Can I ask why you wouldn't pay a "random person" as you say - since this information is by definition public? Can you tell me a bit about your experience using MarkMonitor to do this?

I don't see the value in paying someone and then trusting them with something (as you say) important to my business when they have no track record.

For my personal set of servers (some 25-30, with ~50 SSL certs), I have Nagios for monitoring them plus calendar alerts, SMS alerts and sane cycling (everything expires in the same month).

My employer is an intermediary CA, they can issue their own certs but I've worked with people who use Markmonitor. As part of buying your cert through them is they worry about making sure your domains stay protected. They'll call you, text you and even mail you reminders. And they have a proven track record dealing with companies that are collective worth trillions.

Re: Show HN: Snitch.io – SSL auditing and alerting

#30

Post by _asciiker_ »

yourabi wrote: post #21
_asciiker_ wrote: post #6

I think you're trying to solve a non-problem since the company that sells the certificates warns you (sometimes even more than those intervals), afterall, they want you to renew as well. As for checking for quality, that should be the sys admin task or the webmaster. good luck though!

Thanks for your feedback but I strongly disagree and I think recent history supports that CAs don't do much for you once they've collected your payment. CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a rev…

"CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a revoked certificate in production."

You have valid points, my advice would be to make that part of the message as clear as possible. as a sys admin I could be a potential customer but then again, I already have to worry about certs I implement.

Post reply on HN