Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The SSL Co-operative: A Member-Controlled Certification Authority

sslcoop.org

Post reply on HN
Print view View original

61–70 of 90 posts

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#61

Post by michaelbuckbee »

ademarre wrote: post #31
michaelbuckbee wrote: post #21

There's an assumption in this that domain validated certificates can be wholly automated. But, in the same way that spammers seek out open SMTP relays, phishers seek out weak SSL validation systems for use in setting up phishing sites. CA's currently maintain internal keyword warning systems that flag domain validated requests for manual intervention. Anything that even hints that it is involved with a major company,…

Interesting. Perhaps an alternative to the keyword warning system you describe (for SSL certs only) could be to scan the candidate CN for existing SSL certs. If any are found, flag it for manual review, or possibly come up with a proof system whereby the applicant proves he is the holder of the former certificate.

The problem is that phishers register sound alike domains like info-secure-apple.com or atlanta-usbank.com, that were completely clean prior to issuance.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#62

Post by ademarre »

michaelbuckbee wrote: post #61
ademarre wrote: post #31

Earlier quoted context omitted.

Interesting. Perhaps an alternative to the keyword warning system you describe (for SSL certs only) could be to scan the candidate CN for existing SSL certs. If any are found, flag it for manual review, or possibly come up with a proof system whereby the applicant proves he is the holder of the former certificate.

The problem is that phishers register sound alike domains like info-secure-apple.com or atlanta-usbank.com, that were completely clean prior to issuance.

One could argue that should be okay for a class of certificate without identity/organization verification.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#63

Post by Someone1234 »

IgorPartola wrote: post #54
dtech wrote: post #42

Earlier quoted context omitted.

StartSSL/Startcom already does not charge for individual (wildcard) certificates, you can request unlimited numbers. You do pay a $60 fee for identity validation, which is valid for 2 years. You can also have automated validation, but they don't allow wildcard certificates (which I sort-of understand, they do need to make money some way right) So you get unlimited free non-wildcard certificates or unlimited wildcard…

Apparently StartSSL does charge you quite a bit to revoke a free certificate. That bit a lot of people when Heartbleed happened. See https://www.startssl.com/?app=37 .

That's partly because of how the revocation infrastructure operates. It definitely adds cost, including generating CRL, trimming the CRL as certificates expire (could be 10 years into the future), and running the revocation server itself.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#64

Post by Someone1234 »

dspillett wrote: post #47
dtech wrote: post #42

Earlier quoted context omitted.

StartSSL/Startcom already does not charge for individual (wildcard) certificates, you can request unlimited numbers. You do pay a $60 fee for identity validation, which is valid for 2 years. You can also have automated validation, but they don't allow wildcard certificates (which I sort-of understand, they do need to make money some way right) So you get unlimited free non-wildcard certificates or unlimited wildcard…

> So you get unlimited free non-wildcard certificates Do note the "no commercial use" clause on the free certificates. Not an issue for any of my uses but it may affect quite a few people. Though I'm not sure how they would enforce this. Of course if you can't afford $60 for two years for the next grade up, then your commercial venture is probably not a roaring success!

> Though I'm not sure how they would enforce this.

Revoke the certificate.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#65

Post by Someone1234 »

aianus wrote: post #49
dochtman wrote: post #15

Earlier quoted context omitted.

To be fair, it seems like they have a point that revocation is actually expensive for them.

Where does it say that? I would assume it's just as easy as issuing them in the first place.

You would assume wrong. Revocation is a massive PITA.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#66

Post by daveloyall »

womble wrote: post #37
meowtaxi wrote: post #5

Am I the only one that finds it hillarious (or troubling) that the SSL cert for this site is for a different host name?

(I'm the sslcoop.org guy) Yeah, well, I haven't worked out how to tell nginx to look at the SNI for a HTTPS request and bomb out completely if it doesn't match any SSL-enabled vhost. Unless you've got pervasive IPv6 -- then I can set everything up so manually mangling URLs to use HTTPS doesn't cause problems (there's no links to HTTPS resources on sslcoop.org)... Turns out the real scarce resource is IPv4 addresses -…

Womble, I like your idea and I wish you success. But, it is now constructive feedback time. :)

meowtaxi is sooo right! Seriously, I was going to post the same thing. Sure, I expected an SSL error when I manually switched to the https version of your url, but the specific SSL error I ended up getting reflects really, really poorly on an organization that aims to become a CA.

I did check your FAQ first for some mention of the site's current SSL woes...

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#67

Post by Karunamon »

Someone1234 wrote: post #63
IgorPartola wrote: post #54

Earlier quoted context omitted.

Apparently StartSSL does charge you quite a bit to revoke a free certificate. That bit a lot of people when Heartbleed happened. See https://www.startssl.com/?app=37 .

That's partly because of how the revocation infrastructure operates. It definitely adds cost, including generating CRL, trimming the CRL as certificates expire (could be 10 years into the future), and running the revocation server itself.

Let's not pretend it's anything more than profit. Adding a fingerprint to the end of a CRL file is a completely automated process which does not place significant strain on infrastructure.

I'd imagine the file gets large after a while, but we've had ways to ease distribution of large files for quite some time..

Nevermind the fact that CRLs are of dubious value, anyways. See: http://people.csail.mit.edu/rivest/pubs/Riv98b.pdf

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#68

Post by Karunamon »

Someone1234 wrote: post #65
aianus wrote: post #49

Earlier quoted context omitted.

Where does it say that? I would assume it's just as easy as issuing them in the first place.

You would assume wrong. Revocation is a massive PITA.

Why? It appears a CRL is nothing more than a file containing blobs of DER-encoded cert files.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#69

Post by eximius »

I will gladly run a member organization to lower the barrier of entry to end-users and non-businesses. No one should have to sacrifice security because they don't want to fork over that kind of cash.

I run a forum I want Wildcard SSL on but I don't want to buy one since I currently spend no more than $30/year to host it. The Wildcard SSL Cert alone would cost double that at some of the cheapest places.

If I can fix my problem and others, count me in.

Re: The SSL Co-operative: A Member-Controlled Certification Authority

#70

Post by MichaelGG »

Someone1234 wrote: post #63
IgorPartola wrote: post #54

Earlier quoted context omitted.

Apparently StartSSL does charge you quite a bit to revoke a free certificate. That bit a lot of people when Heartbleed happened. See https://www.startssl.com/?app=37 .

That's partly because of how the revocation infrastructure operates. It definitely adds cost, including generating CRL, trimming the CRL as certificates expire (could be 10 years into the future), and running the revocation server itself.

In another thread it was explained that they charge for revocation because their current software doesn't automate it. It sounded like a limitation in their stack and the fee is a workaround.
Post reply on HN