111–120 of 123 posts
Keep track of when your certificate is going to expire, and automatically renew it. Or, all you have to do is let this new piece of software run periodically on your secure server. What could possibly go wrong?
It needs to run continously for revocation purposes but you don't notice because it's integrated in your web server. This could be done in the same way.
Earlier quoted context omitted.
This is a horrible idea... I have numerous certs for my domain and collecting them all to prove to you I own them is not going to be fun.
You wouldn't be in a very good position to revoke them then, would you? For example, if we had another heartbleed.
Earlier quoted context omitted.
It's very, very hard for traditional CAs to compete with free, trusted in all major platforms and with dead simple set up. Hopefully this sort of scheme, combined with the added trust of Certificate Transparency, can kill off most traditional CAs. The only reason I would still buy 1 certificate is for wildcard support.
Wait. Where can I get free certs today? Or did you mean once this service goes live? I've used StartSSL, but somehow messed up the process and can't issue a new cert unless I pay to revoke the current. Even then their free certs expire in a year. The only other free cert I found was from Comodo, but it expires after 90 days. So, I wouldn't exactly say the only reason to pay for a cert is for wildcard support.
Firefox: Mozilla added the certificate in NSS 3.11.9 on 2008-01-31, see http://www-archive.mozilla.org/projects/security/pki/nss/nss... and https://bugzilla.mozilla.org/show_bug.cgi?id=411299 So Firefox starting with 3.0 works
Chrome: When the first Chrome came out it used Mozilla NSS which already included the certificate. Now Chrome uses the OS key store: http://www.chromium.org/Home/chromium-security/root-ca-polic...
Microsoft: The certificate is trusted by default since at least IE8 (http://www.herongyang.com/PKI/HTTPS-IE-8-Trusted-Root-CA-Cer...) and Windows automatically updates the certificates, see http://technet.microsoft.com/en-us/library/cc751157.aspx
Apple: Since iOS 2 (2008-07-11) (http://support.apple.com/en-us/HT2185) and at least since OS X Mavericks (http://support.apple.com/en-us/HT203120), but probably way earlier.
Java: Yes: https://gist.github.com/saltlakeryan/8479238
Apparently they will use the same certs as implemented on letsencrypt.org, so the free certs will work without error on every client which trusts the "DST Root CA X3" CA. Can we collect a definitive list of clients which include this CA certificate? Similar to the list for StartSSL ( https://forum.startcom.org/viewtopic.php?f=15&t=1802 ). Firefox: Mozilla added the certificate in NSS 3.11.9 on 2008-01-31, see http://…
Apparently they will use the same certs as implemented on letsencrypt.org, so the free certs will work without error on every client which trusts the "DST Root CA X3" CA. Can we collect a definitive list of clients which include this CA certificate? Similar to the list for StartSSL ( https://forum.startcom.org/viewtopic.php?f=15&t=1802 ). Firefox: Mozilla added the certificate in NSS 3.11.9 on 2008-01-31, see http://…
Chrome does not use NSS. It uses the underlying OS root store.
Earlier quoted context omitted.
Ownership verification is already done via DNS by existing CAs. If an attacker has full control over your DNS, he can already change the DNS records and trick a CA into delivering him a genuine certificate. This isn't really a MITM attack.
What existing CA's offer this? The ones i've used (godaddy, startssl, namecheap/ssls.com rapidssl/positivessl) all wanted email verification iirc. EDIT: of course that's equivalent to verifying the MX. Never mind!
* DNS: you need to add a specific record to your DNS zone * File: you need to add a specific file to the root of a HTTP server listening on the domain name * Email: they send an email to admin@ on the domain
All three are pretty much ways to check that you are the person in control of the associated DNS.
Does this kill the business model for normal CAs, or is there something worth going to another CA for? Also, how trivial/hard will it be for a state agent to generate its own certificate-signing traffic and use the Let's Encrypt CA to sign arbitrary domains of their choosing?
I've never used those, and I don't know how relevant these are for companies, though.
Earlier quoted context omitted.
Python 2.7 (no SNI support) is the new Windows XP. Not a browser problem, but if you're building an API, it will lock people out. (sorry to beat a dead horse, but it's burned me recently and I think people are flipping the https only switch without awareness or consideration. doesn't mean "don't switch", but be aware.)
Are you unable to throw any number of the faster, event-driven webservers/reverse proxies in front of Python 2.7 to satisfy your SNI needs?