Ask HN: What to do when CloudFlare is on an Adult block list • Hacker News Board

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#51

Post by dangrossman » Mon, Feb 09, 2015, 8:24 PM UTC

Artemis2 wrote: post #48

michaelbuckbee wrote: post #46

Earlier quoted context omitted.

Heroku doesn't do a great job explaining what that $20/mo provides - it's not for a SSL certificate. It's for a SSL terminating load balancer that sits in front of your app instances.

That's still very expensive, Cloudflare offers it for free, with a free certificate.

That Cloudflare offers it for free doesn't change the economics for everyone else. They do a lot for free that anyone else would charge for. IP allocations are not free, extra load balancers are not free, labor to set up custom certs on load balancers is not free. If you put a CDN in front of your site and want SSL termination on it, then every node in every location needs to have that cert installed and potentially an extra IP address for it, each. Companies aren't charging extra for SSL solely because they think they can gouge you on it; it's really not free to deploy.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#52

Post by geographomics » Mon, Feb 09, 2015, 8:39 PM UTC

claudius wrote: post #49

geographomics wrote: post #47

Earlier quoted context omitted.

But if you look at the bylaws of the CA/B forum [1], they explicitly exclude discussion of "pricing policies, pricing formulas, prices or other terms of sale" as part of their mandate. So we can't assume a position for or against revocation charges - it's just not within the scope of the guidelines. Which are non-binding and advisory anyway. [1] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-Byl...

I’m not against revocation charges per se, I’m against charges being paid prior to revocation. So a CA including something like “if we have revoke this cert, you have to pay 20$, we will revoke under these circumstances: …” would be perfectly fine with me – terms in legal contracts requiring one party to pay a certain amount if certain situations arise are not uncommon, so I don’t think this would have legal issues.…

Could you outline a scenario where you make a request that someone else's certificate be revoked, yet it's of such little importance that you refuse to pay the $25 fee that may possibly be charged?

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#53

Post by geographomics » Mon, Feb 09, 2015, 8:56 PM UTC

AlyssaRowan wrote: post #50

claudius wrote: post #42

Earlier quoted context omitted.

Point 7.1.2.8 states that "the CA Will revoke the Certificate for any of the reasons specified in these Requirements". This is a warranty made by the CA towards all "Certificate Beneficiaries", which includes "All Relying Parties who reasonably rely on a Valid Certificate", i.e. the general public. Unfortunately, it is not made absolutely clear what "reasons specified in these Requirements" means. There are a couple…

SHALL here is an RFC2119 term which is unconditionally binding, like REQUIRED or MUST: "the definition is an absolute requirement of the specification". Zero wiggle room. The CA's policies on whether they charge for things in general (such as re issuing ) falls out of scope of CA/B Forum - but some things are absolutely required if browsers are to trust a CA, like, say, § 13.1.5: "The CA SHALL revoke a Certificate wi…

> After Heartbleed however, when presented with a huge list of compromised certificates

Possibly compromised. That's why it was the subscriber's choice, to decide in the balance of probabilities whether to revoke or not.

It's not like the Debian weak keys flaw where there was absolute proof of the private key being compromised - a database of all the possible keys (at standard lengths) were generated. In that case, StartSSL revoked the certificates automatically and free of charge.

Re: Ask HN: What to do when CloudFlare is on an Adult block list

#54

Post by captn3m0 » Fri, Feb 13, 2015, 11:37 AM UTC

kelnos wrote: post #44

captn3m0 wrote: post #39

Earlier quoted context omitted.

Cloudflare has to issue a single SSL certificate that is shared across multiple sites. The cost of a certificate is not proportional to the number of alternative names in the certificate, and is a fixed cost. As a downside to this, they have to use SNI, which is not supported in any IE+XP combination, along with a few older mobile browsers as well.

You're mistaken; certs with multiple SANs don't make use of SNI. SNI is used (required) when you have multiple distinct certs. CloudFlare is not using SNI likely specifically because of the IE+XP issues (among others) that you point out.

Yeah, I got the two mixed up. SNI doesn't mean multiple hostnames on a cert. It means multiple certs on the same IP.

However, due to high costs behind getting IP addresses, CloudFlare does use SNI for its free tier. Its paid customers on the other hand get their own IP per hostname.