WoSign: Free two-year multi-domain SSL certificate

Because it was designed to give undue influence to fringe parties. Real electoral reform would be proportional representation.

> trustworthy

Do you really trust all of these keys?

https://www.mozilla.org/en-US/about/governance/policies/secu...

Even companies like AOL, VISA, Wells Fargo, and the historically-problematic VeriSign and GoDaddy, and lets not forget the Even the companies with serious legal issues in the past, and several governments (China, Japan, Turkey, etc).

This reliance on a single point of trust is why the PKI systemd is destined to fail in the long run: that single point of trust also a single point of failure. The entire concept of a CA requires handing over key parts of our infrastructure over to a small list of "authorities" (which grants the CA a lot of power), while simultaneously trusting those authorities to never abuse that power or be corrupted from the outside.

> If everyone is a certificate authority, then no one is

This is actually the core problem with PKI. Not only does it presuppose that a "few" trusted authorities is even possible, it also frames the discussion by assuming that only a globally supported solution is required. This attitude also dismisses the capabilities to evaluate trust and merely asserts that most people shouldn't worry about this kind of security problem.

A better idea is to recognize that everybody solves pieces of the trust problem constantly in their daily life. Some of the decisions are made of personal experience or observation, but we also rely on others that we see as an "authority". These are powerful behaviors that should be built upon. Everybody can be a CA, because they already are in.

Someone that sets up an "authority" that is only used between a group of friends is perfectly safe IFF 1) stays at the scale where trust already exists, AND 2) the people involved have some easy way to select the trust basis they wanto to use.

Criteria 2 is the most important. The CA system is de facto boolean trust. (i.e. HTTP-vs-HTTPS). There is no sane way for the typical user to say they want, for any particular transaction or communication, to only trust some specific authority (or authorities). and then switch to a completely different trust basis as needed. Once this ability is in the hands of the average person, I suspect the key distribution problem will solve itself as people self-organize.

yea,i also can't get it to work. been bashing my head against this for hours. i did this to make the multidomain cert: http://stackoverflow.com/a/9158662/4202492[1] then i'm doing this: "openssl req -out example.com.csr -new -sha256 -newkey rsa:2048 -nodes -keyout example.com.key -config openssl.cnf"

do i need to attach a mail adress to the csr? do i need to set a challenge password? what is the "free binding domain" on wosign?

WhoaSSL

The only reason why I suggested Verisign is because they have been in the industry long enough to know what they are doing (presumably) and not make the same mistakes that were made in the past.

Worst case scenario - if Verisign doesn't want to share the toys in the sandbox, Microsoft/Google/Mozilla et all can just refuse to include their CA certs as trusted certs.

However, Verisign is in a very interesting position as they currently manage/control .com tld.

So what I'm saying is - if the children don't agree to play together then they can take their toys and go home then no one can play.

(I like to use the analogy of children and these big companies because, in my opinion, it appears that's how they operate. They just can't come together, like mature adults, and form some sort of solution to this. Last I heard is that Google wants to show an error page for non-HTTPS enabled sites, on Chrome, which will make everything even worse[1]. Don't even get me started on the whole self-signed cert error message page...).

[1] - http://www.chromium.org/Home/chromium-security/marking-http-...