Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WoSign: Free two-year multi-domain SSL certificate

ohling.org

Post reply on HN
Print view View original

11–20 of 63 posts

Re: WoSign: Free two-year multi-domain SSL certificate

#11

Post by rmoriz »

noxenook wrote: post #10

At risk of sounding xenophobic, you have to wonder if this is simply an effort to have Chinese-issued certificates become common place in the west. A common form of certificate pinning is based on the CA that issued the certificate (to allow certificate rotation). More Chinese issued certificates being used intentionally will make the mere fact that a certificate was issued by a Chinese CA less suspicious.

Yes and no.

Nothing is 100% secure and new CA players will bring a higher encryption usage overall (in this case -> other business model/regional reach). Higher usage will also drive the amount of criminals (including secret agencies) trying to MITM/intercept those encryption. This will push vendors and developers to increase certificate pinning and other models of "bottom-up" models besides the top-down model that the CA-model implements.

IMHO it would be great to have a "working by default" model (which the CA-model is compared to something like pgp) and a protocol-independent way to pin public keys (eg not tied to http/s like HSTS and HKPK).

People and companies in need of "higher" security can pin keys and eg ignore the root trust of their OS/browser. So IMHO the best of "both" worlds.

HSTS http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

HPKP https://developer.mozilla.org/en-US/docs/Web/Security/Public...

Re: WoSign: Free two-year multi-domain SSL certificate

#12

Post by nadams »

> great free StartSSL

It looks like they cleaned up their forums from when they were last mentioned[1] but I'll still keep my distance.

Anything like this is really a bandaid for the real problem with SSL/CA. As in why can't I be a CA for my own domain? I think Android is a perfect example of this problem - if you import a CA cert using the built in Android credential storage every time you reboot it will show a vague and useless message saying that people may be spying on you. Not which CA cert was added and when - just "hey, you added, on purpose, a CA cert. I'm just making sure you are aware of this".[2] I understand the warning? error?...err simply because now I can sign a cert for ANY domain and Android will accept it as legit. This makes sense for the average users who don't understand or care what a CA is, not advanced users or enterprise users who will most likely use their own CA infrastructure. In this case - it would make more sense for them to be a CA over just company.tld rather than any domain.

Personally - I'm using a modified version of PHP-CA[3] (as in changed the OpenSSL defaults to something sane and fixed some small issues). It's obviously not very advanced (for lack of better words kind of sucks) - but I wanted to hit the ground running with being my own CA for personal use and I have other projects I'm working on.

[1] - https://news.ycombinator.com/item?id=8901822

[2] - https://code.google.com/p/android/issues/detail?id=82036

[3] - http://php-ca.sourceforge.net/

Re: WoSign: Free two-year multi-domain SSL certificate

#13

Post by aroch »

rmoriz wrote: post #11
noxenook wrote: post #10

At risk of sounding xenophobic, you have to wonder if this is simply an effort to have Chinese-issued certificates become common place in the west. A common form of certificate pinning is based on the CA that issued the certificate (to allow certificate rotation). More Chinese issued certificates being used intentionally will make the mere fact that a certificate was issued by a Chinese CA less suspicious.

Yes and no. Nothing is 100% secure and new CA players will bring a higher encryption usage overall (in this case -> other business model/regional reach). Higher usage will also drive the amount of criminals (including secret agencies) trying to MITM/intercept those encryption. This will push vendors and developers to increase certificate pinning and other models of "bottom-up" models besides the top-down model that t…

Honestly I'd like to see something in the vein of TACK [1] over the other various key pinning methods.

[1]http://tack.io/

Re: WoSign: Free two-year multi-domain SSL certificate

#14

Post by noxenook »

aroch wrote: post #13
rmoriz wrote: post #11

Earlier quoted context omitted.

Yes and no. Nothing is 100% secure and new CA players will bring a higher encryption usage overall (in this case -> other business model/regional reach). Higher usage will also drive the amount of criminals (including secret agencies) trying to MITM/intercept those encryption. This will push vendors and developers to increase certificate pinning and other models of "bottom-up" models besides the top-down model that t…

Honestly I'd like to see something in the vein of TACK [1] over the other various key pinning methods. [1] http://tack.io/

Agreed. This plus Certificate Transparency (Google) will go a really long way.

Re: WoSign: Free two-year multi-domain SSL certificate

#15

Post by thejosh »

grakic wrote: post #8
thejosh wrote: post #6

Earlier quoted context omitted.

Cloudflare offer free SSL now, so if you are small and can't afford a certificate, they could be a good choice.

Cloudflare Univeral SSL uses SNI https://support.cloudflare.com/hc/en-us/articles/203041594-W...

Sure, but looking at: Current inclusion status in major CA certificate stores: Included by default in NSS 3.16.3 or newer (Mozilla Firefox 32+). Included by default in Microsoft Windows since September 2014 on Windows Vista+ (should automatically update as mentioned here). Included by default in Android 5.0+ (no source, but on my Nexus tablet with Android 4.4.4 it is not yet included but on my Nexus phone with Android 5.0 it is) It is not yet included in the Apple certificate store. This is not a big issue however, since the WoSign root CA is cross-signed by the StartCom CA which itself is included almost everywhere since >5 years.

SNI isn't included in Windows XP, yet the SSL won't work in XP anyway.

Re: WoSign: Free two-year multi-domain SSL certificate

#16

Post by cnst »

This offer sounds great!

However, I must ask -- what's their business model?

Even as great as the offer is, this is akin to the free sample... Because once you deploy the https:// address scheme, there is no going back. On the other hand, this would have been perfect if there was opportunistic encryption within HTTP.

Re: WoSign: Free two-year multi-domain SSL certificate

#17

Post by iancarroll »

rmoriz wrote: post #9
aroch wrote: post #3

Seems they just recently passed Mozilla's/Google's CA root inclusion process: https://bugzilla.mozilla.org/show_bug.cgi?id=851435 Edit: Hmm, looks like the free certs will never pass strict OCSP checks. As broken as the OCSP system is, I would still like to be able to check against it.

Usually it's quite easy to pass this (a single vendor) - you just need to get verified by a WebTrust recognized company (E&Y or some other bookkeeping company) and be able to convince the vendor (the process is pretty much the same with each vendor). However you'll need to build and run your infrastructure upfront so you're already burning some years money just to get those documents. When you finally get them and be…

> apply for inclusion with the vendors (Apple/MSFT/GOOG/Mozilla/Debian etc) it will take another couple of months

Mozilla takes ~1.5 years to include a CA.

> I wonder what the total initial and running costs of starting up a CA (including WebTrust & yearly re-audit) are today...

Without including man-hours, I've estimated it to be $550k for creating and maintaining a CA for three years. The audits make up a large majority of this. Big firms like E&Y charge a lot, which is what my estimate is based off of. You also need HSMs + places to store the HSMs, a CP(S), etc. If you've ever read the WebTrust guidelines, you'll know you need a lot of accountability and security.

You could probably reduce the figure with a small auditing firm. My estimates of course are estimates. Certly got quoted $120k/yr (not including a readiness audit) for a WebTrust audit by E&Y.

Re: WoSign: Free two-year multi-domain SSL certificate

#18

Post by iancarroll »

rmoriz wrote: post #4

Nice find! But given the amount of hassle to get one, your hourly rate must be very low. But I'm sure it will be the future to get near-0$ DV-certificates. It's a pity no CA besides StartCom and Comodo pick up the S/MIME market. Both options are not very usable for non-IT people.

> It's a pity no CA besides StartCom and Comodo pick up the S/MIME market.

A lot of CAs sell S/MIME certs, including GlobalSign and CyberTrust. They're not heavily advertised, though.

Re: WoSign: Free two-year multi-domain SSL certificate

#19

Post by iancarroll »

cnst wrote: post #16

This offer sounds great! However, I must ask -- what's their business model? Even as great as the offer is, this is akin to the free sample... Because once you deploy the https:// address scheme, there is no going back. On the other hand, this would have been perfect if there was opportunistic encryption within HTTP.

> Because once you deploy the https:// address scheme, there is no going back.

Unless you send the HSTS header, that's not true. Even so, you could just set the HSTS expiry time to the certificate's expiry (which would have to be done within your code, sadly).

Re: WoSign: Free two-year multi-domain SSL certificate

#20

Post by Xorlev »

cnst wrote: post #16

This offer sounds great! However, I must ask -- what's their business model? Even as great as the offer is, this is akin to the free sample... Because once you deploy the https:// address scheme, there is no going back. On the other hand, this would have been perfect if there was opportunistic encryption within HTTP.

State-sponsored CA perhaps?

I'd be a little suspicious of anything too free like that. I hate to be too xenophobic but I can't say the thought didn't cross my mind.

Post reply on HN