Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The SSL Co-operative: A Member-Controlled Certification Authority

sslcoop.org

Post reply on HN
Print view View original

31–40 of 90 posts

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#31

Post by ademarre »

michaelbuckbee wrote: post #21

There's an assumption in this that domain validated certificates can be wholly automated. But, in the same way that spammers seek out open SMTP relays, phishers seek out weak SSL validation systems for use in setting up phishing sites. CA's currently maintain internal keyword warning systems that flag domain validated requests for manual intervention. Anything that even hints that it is involved with a major company,…

Interesting. Perhaps an alternative to the keyword warning system you describe (for SSL certs only) could be to scan the candidate CN for existing SSL certs. If any are found, flag it for manual review, or possibly come up with a proof system whereby the applicant proves he is the holder of the former certificate.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#32

Post by 0x0 »

pugz wrote: post #4
JoshTriplett wrote: post #2

I'll say the same thing here that I said in a response to the survey: I'd be interested in taking part in a CA co-op that seeks membership/sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates. Certificates cost approximately nothing to issue, and most of the CA's infrastructure would…

That sounds very much like the service that is already offered by StartSSL.com. You pay for identity validation, but you can then create as many regular and wildcard certificates as you wish. It's a superb service.

Do take note that they will reject and/or also refuse renewal if they think the domain whois doesn't exactly identify you, even if you confirm the domain webmaster validation. Lots of hassle if your domains have other entities or business names listed as the whois admin contact.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#33

Post by womble »

joosters wrote: post #26
JoshTriplett wrote: post #2

I'll say the same thing here that I said in a response to the survey: I'd be interested in taking part in a CA co-op that seeks membership/sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates. Certificates cost approximately nothing to issue, and most of the CA's infrastructure would…

StartCom charges $60 for a wildcard certificate that will be accepted by just about every important browser out there. You might even be able to get them cheaper elsewhere. There are not any significant costs to obtaining SSL certificates, so a new CA is hardly likely to change the SSL landscape at all.

(I'm the sslcoop.org guy)

StartCom's $60 wildcard is the cheapest I've ever seen. I'm impressed with StartCom's model overall, and it was a great inspiration to me with the SSL co-op. I feel like the more diversity in approaches there is, the better off the CA ecosystem will be. If nothing else, another voice for sanity in the relevant standards bodies (CA/Browser Forum, for instance) can only be of value.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#34

Post by womble »

raving-richard wrote: post #10
JoshTriplett wrote: post #2

I'll say the same thing here that I said in a response to the survey: I'd be interested in taking part in a CA co-op that seeks membership/sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates. Certificates cost approximately nothing to issue, and most of the CA's infrastructure would…

Pretty much what I was thinking. Here's what I almost sent as a response to the survey: This is a brilliant idea. I would pay up to $50 a year for the pleasure of being able to get domain validated SSL certs that are trusted by the major browsers. I would assume that the validation would be via emailing webmaster@domain and making them either respond or click a link or something. That could all be automated couldn't…

(I'm the sslcoop.org guy)

That's essentially the model I'm looking to implement. I prefer DNS modification for domain validation, but anything that can be automated will be.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#35

Post by womble »

JoshTriplett wrote: post #16
pugz wrote: post #4

Earlier quoted context omitted.

That sounds very much like the service that is already offered by StartSSL.com. You pay for identity validation, but you can then create as many regular and wildcard certificates as you wish. It's a superb service.

I use and like StartCom certificates, but they wouldn't solve this problem. Wildcard certificates should not require identity validation; you should be able to get a domain-validated wildcard certificate for free. Also, their free certificates expire every year; domain-validated certificates should only require revalidation if the domain changes hands.

There are rules being introduced against issuing certificates for more than about three years (you can still get five years certs at the moment, but not for much longer); this is more to limit the risk of private key compromise than it is to require people to revalidate. I don't find it too onerous to have to install a new cert every year or so (he says, with several certs currently expired).

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#36

Post by womble »

CMCDragonkai wrote: post #9
colmmacc wrote: post #3

http://www.cacert.org/ is a similar-ish effort that's been ongoing for quite a long time.

It's sad that debian removed them. I think cacert needs more dedicated governance. If all the money we spent on ssl certificates could be pooled together to create non-profit organisation dedicated to public certificates, it would be awesome! And we could probably get opensource PKI infrastructure.

(I'm the sslcoop.org guy)

"If all the money we spent on ssl certificates..."

And thus was sslcoop.org born! I'm not sure what you mean by "opensource PKI infrastructure", exactly, but as a long time F/OSS hacker, I'm definitely planning on putting everything that's developed for the SSL co-op under an open licence.

But the software's the easy bit. The hard part is the work required to define processes and policies, get everything audited, and then getting through the inclusion process for all the browsers. That's what takes somewhat more organisation (and money) than writing some code and running openssl...

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#37

Post by womble »

meowtaxi wrote: post #5

Am I the only one that finds it hillarious (or troubling) that the SSL cert for this site is for a different host name?

(I'm the sslcoop.org guy)

Yeah, well, I haven't worked out how to tell nginx to look at the SNI for a HTTPS request and bomb out completely if it doesn't match any SSL-enabled vhost. Unless you've got pervasive IPv6 -- then I can set everything up so manually mangling URLs to use HTTPS doesn't cause problems (there's no links to HTTPS resources on sslcoop.org)...

Turns out the real scarce resource is IPv4 addresses -- but we already knew that. ipv6coop.org, anyone? (grin)

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#38

Post by [deleted] »

JoshTriplett wrote: post #2

I'll say the same thing here that I said in a response to the survey: I'd be interested in taking part in a CA co-op that seeks membership/sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates. Certificates cost approximately nothing to issue, and most of the CA's infrastructure would…

[deleted]

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#40

Post by perlgeek »

leccine wrote: post #17
codezero wrote: post #14

Earlier quoted context omitted.

What about this post makes you think the NSA is or would be involved?

I think the question you should ask yourself is: how is the NSA involved in the currently established CA system? The answer (to your question) is , the very same way. Besides, who does think that having an alternative CA provider is going to change anything? The crypto empowering security nowadays is un-trusted, implementations proven containing backdoors, and on the top of that all the implementations are written in…

The NSA almost certainly has a way to sign their own certificates that they use for MITM attacks.

But that doesn't mean they gain anything from infiltrating a large number of CAs; after all, those only sign certificates, not create the private keys.

Post reply on HN