Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

61–70 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#61

Post by Tepix »

0x0 wrote: post #48
EwanToo wrote: post #34

Earlier quoted context omitted.

I'm struggling to think of a browser that supports SHA-2 TLS encryption, and doesn't support SNI, which one am I missing?

Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.

Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade.

Also I think with Firefox on Windows XP it should work.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#63

Post by vacri »

sandGorgon wrote: post #17
imperalix wrote: post #10

Earlier quoted context omitted.

I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.

can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).

As a totally-naive-to-your-problem-particulars and totally-hacky suggestion, why not start nginx with a starter cert, then mv the new cert into position and reload nginx?

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#64

Post by 0x0 »

Tepix wrote: post #61
0x0 wrote: post #48

Earlier quoted context omitted.

Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.

Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.

That doesn't help when you are targeting a market where Android 2.x is prevalent.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#65

Post by 0x0 »

jhkaghjkga wrote: post #52
0x0 wrote: post #48

Earlier quoted context omitted.

Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI. But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.

That's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.

That's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#66

Post by ctz »

nly wrote: post #13

Fine, stop using them. You still trust them. Your visitors browsers still trust them. Being paranoid wrt a Chinese CA really makes no sense. They have as much incentive as a western CA to behave wrt keeping their signing keys secure, and their revocation list sensible, which is all that really matters.

People need to read this.

There are many things to take into account when choosing a CA to use for your site. But security, jurisdiction and any history of mis-issuance are not relevant to you; only reliers. And no relier has any choice in the matter anyway, or any economic relationship they can terminate.

(Things change if you start to use HPKP and pin to a particular root; nobody does that though because it's an availability and economic nightmare.)

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#67

Post by josteink »

ascorbic wrote: post #36
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

StartSSL has some of the worst support I've ever encountered. Normally bad support means clueless or non-responsive. However StartSSL support is often actively hostile, treating customers as idiots or worse. I should point out that this isn't always the case, and I have used them in the past without trouble, but the times when it is bad are bad enough to write them off. Their site also looks like it was made in 1998,…

> while using client certificates is secure and everything, it's also seriously user-hostile. I have to remember which computer and browser I used a year ago to sign up? Yeah, I know I should back up client certificates, but seriously who does that?

So you want a secure website, and you agree that SSL is needed for things to be secure.

But you're not willing to put in one inch of effort yourself to secure your own SSL keys. You can't even bother to back up the master key to your own certs, because it's too much work?

Cognitive dissonance much?

If you care about security, then do it properly. If you're going to do it half-assed, just don't bother at all. All you're doing then is contributing to security-theater, which is all the work and no real benefits.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#68

Post by Tepix »

0x0 wrote: post #64
Tepix wrote: post #61

Earlier quoted context omitted.

Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade. Also I think with Firefox on Windows XP it should work.

That doesn't help when you are targeting a market where Android 2.x is prevalent.

True. Is there no workaround for Android 2.x? What if you install a 3rd party browser?

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#69

Post by josteink »

bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

> There's really not much reason to use StartSSL now that Let's Encrypt

Have you tried using it? On every domain I've tried to obtain a cert it has failed.

For me StartSSL may be suboptimal, but at least it works, which is more than I can say for Letsencrypt in its current state.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#70

Post by chmike »

Tepix wrote: post #60
specialist wrote: post #39

Earlier quoted context omitted.

Just today, I'm setting up my first https by myself. Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs. But I got "Failed to connect to host for DVSNI challenge". Start googling, reading, messing around with this for a while. No joy. Bailed on Let's Encrypt, started over wit…

The official Let's Encrypt client is bloated and wants to fiddle with your HTTP server configuration. Bad idea. Use something small like https://github.com/kuba/simp_le or https://github.com/diafygi/acme-tiny

I use acme-tiny and confirm it is good. But there is still significant work to do to get a working certificate and the documentation is lacking significant details. I have my own recipe documentation that I should publish. Apart from this, this is the only script out there that did cut it for me.

Note that the update process needs to be automated because let's encrypt certificates last only 3 months as I have read.

Post reply on HN