Launching in 2015: A Certificate Authority to Encrypt the Entire Web
1–10 of 476 posts
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#2Very interesting, it looks like they're working with IdenTrust on this. I wonder if it supports wildcard certs.
Like StartCom selling Class 2/3, running a CA is very expensive and I wonder how they plan on recouping the fees for this.
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#3Free CA? This is cool. Why this wasn't done a long time ago is beyond me. (Also please support wildcard certs)
An interesting thing happened at a meet-up at Square last year. Someone from google's security team came out and demonstrated what google does to notify a user that a page has been compromised or is a known malicious attack site.
During the presentation she was chatting about how people don't really pay attention to the certificate problems a site has, and how they were trying to change that through alerts/notifications.
After which someone asked that if google cared so much about security why didn't they just become a CA and sign certs for everyone. She didn't answer the question, so I'm not sure if that means they don't want to, or they are planning to.
What privacy concerns should we have if someone like goog were to sign the certs? What happens if a CA is compromised?
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#4A little vague on details.
Apache only or also Nginx?
Who is the CA?
No way I am running something like this on a production machine.
I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver.
Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#5Will these certificates work with Internet Explorer and Chrome?
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#6My website only contains publically available stuff for people to read.
Is there any reason why I would want to use https for this use case?
Or what does "entire web" mean?
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#7Wow, I had a goofy idea a few months ago that one day we could have some sort of non-profit/charity that just runs a free, as in beer and freedom, "common good" CA.
Looks neat.
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#8A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.
This is just a pre-announcement to let folks (OSes, hosting providers, other platforms) plan and do integration work. Per our own warnings, we definitely don't want this running on production machines until it launches in 2015.
Our Apache code is a developer preview, we'll be working on Nginx next.
ISRG will be operating a new root CA for this project. Although if you think that your choice of CA makes you more or less secure, you may not have understood how PKIX works -- you can buy a cert from whichever CA you like, but your adversary can always pick the weakest one to try to impersonate you.
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#9A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.
"This code intended for testing, demonstration, and integration engineering with OSes and hosting platforms. Currently the code works with Linux and Apache, though we will be expanding it to other platforms."
Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web
#10My website only contains publically available stuff for people to read. Is there any reason why I would want to use https for this use case? Or what does "entire web" mean?
Yes, because it is no one's business what people are looking at anyways. If you have more than one URL, HTTPS will hide that.
HTTPS will also make an attacker unable to change your content.