I'm mainly favor in this because I could trust the cooperative more than I trust the existing CAs. As long as it doesn't cost me more than the existing cheapest options [e.g. StartSSL, NameCheap's cheap ssl certs] and had 99.7%+ coverage, I'm 100% sure I'd pay for it.. :)
The SSL Co-operative: A Member-Controlled Certification Authority
51–60 of 90 posts
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#52Earlier quoted context omitted.
(I'm the sslcoop.org guy) Yeah, well, I haven't worked out how to tell nginx to look at the SNI for a HTTPS request and bomb out completely if it doesn't match any SSL-enabled vhost. Unless you've got pervasive IPv6 -- then I can set everything up so manually mangling URLs to use HTTPS doesn't cause problems (there's no links to HTTPS resources on sslcoop.org)... Turns out the real scarce resource is IPv4 addresses -…
Possibly a stupid question, but why not make whichever vhost is correctly configured for SSL your default? Any traffic will go there unless another match is found. This is what I do to force SSL and redirect anything not matching another vhost. Catch-all + HTTP --> HTTPS server { # Set server name & make it the default for this IP address listen 80 default_server; listen [::]:80 default_server ipv6only=on; return 301…
That's not helpful, he doesn't have a cert for www.sslscoop.org, so the link is http; but if you try https://www.sslscoop.org/ you get a cert error, because the IP(s) are running https, but for a different name.
By the time the server can return the redirect you propose, the user agent must have already accepted the non-matching certificate.
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#53I'm failing to see how this differs from http://www.cacert.org/, though perhaps this would be more strict on participation?
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#54I'll say the same thing here that I said in a response to the survey: I'd be interested in taking part in a CA co-op that seeks membership/sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates. Certificates cost approximately nothing to issue, and most of the CA's infrastructure would…
StartSSL/Startcom already does not charge for individual (wildcard) certificates, you can request unlimited numbers. You do pay a $60 fee for identity validation, which is valid for 2 years. You can also have automated validation, but they don't allow wildcard certificates (which I sort-of understand, they do need to make money some way right) So you get unlimited free non-wildcard certificates or unlimited wildcard…
Apparently StartSSL does charge you quite a bit to revoke a free certificate. That bit a lot of people when Heartbleed happened. See https://www.startssl.com/?app=37.
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#55I'm failing to see how this differs from http://www.cacert.org/ , though perhaps this would be more strict on participation?
Well, currently CACert certs are not accepted by any major browsers, so while it's a great idea, without funding it's dead in the water.
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#56I'll say the same thing here that I said in a response to the survey: I'd be interested in taking part in a CA co-op that seeks membership/sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates. Certificates cost approximately nothing to issue, and most of the CA's infrastructure would…
StartCom charges $60 for a wildcard certificate that will be accepted by just about every important browser out there. You might even be able to get them cheaper elsewhere. There are not any significant costs to obtaining SSL certificates, so a new CA is hardly likely to change the SSL landscape at all.
>There are not any significant costs to obtaining SSL certificates, so a new CA is hardly likely to change the SSL landscape at all.
Well, it'll slightly increase the attack surface against the CA model, so there's the (probably very small) chance that something will go wrong and it will introduce a massive (temporary) hole in TLS, since CA-based trust has a "weakest-link" failure model.
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#57What would make sense to me more than an SSL co-op would actually be a registrar that gives you a free wildcard certificate for every domain you register. You almost always need a certificate for every domain you use, so why not bundle the two? I wonder if doing a crowdsourced bootstrap of such a registrar would work.
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#58Earlier quoted context omitted.
I think the question you should ask yourself is: how is the NSA involved in the currently established CA system? The answer (to your question) is , the very same way. Besides, who does think that having an alternative CA provider is going to change anything? The crypto empowering security nowadays is un-trusted, implementations proven containing backdoors, and on the top of that all the implementations are written in…
How is the NSA involved in the currently established CA system?
2 ways,
A, creating rogue cert by md5 collisions (they have the capacity) B, making people believe that a CA guarantees the identity of the issuer, while having their CA in the approved list so they can sign certs (for example like gmail.com)
There is good documentation about it:
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#59Earlier quoted context omitted.
I think the question you should ask yourself is: how is the NSA involved in the currently established CA system? The answer (to your question) is , the very same way. Besides, who does think that having an alternative CA provider is going to change anything? The crypto empowering security nowadays is un-trusted, implementations proven containing backdoors, and on the top of that all the implementations are written in…
How is the NSA involved in the currently established CA system?
The CA's are legally compelled to issue 'global certificates' that always return as valid so they can do MITM attacks at will.
It's fairly well documented if you google around.
And note, while it may seem like a terrible thing, it really isn't. The issue isn't that they're able to do it, the issue is how rigorous they are with their process of deciding to do it.
There is absolutely a valid reason for the government to want to do this.
Re: The SSL Co-operative: A Member-Controlled Certification Authority
#60Earlier quoted context omitted.
I think the question you should ask yourself is: how is the NSA involved in the currently established CA system? The answer (to your question) is , the very same way. Besides, who does think that having an alternative CA provider is going to change anything? The crypto empowering security nowadays is un-trusted, implementations proven containing backdoors, and on the top of that all the implementations are written in…
The NSA almost certainly has a way to sign their own certificates that they use for MITM attacks. But that doesn't mean they gain anything from infiltrating a large number of CAs; after all, those only sign certificates, not create the private keys.
Well, the joke was about how useless is to start a new CA. The first member is going to be the government through a cover agency. Remember, making you believe that SSL makes your service secure is cheaper and better from the NSA point of view than having a huge cluster to crack the encrypted traffic.