81–88 of 88 posts
Keep in mind that Gandi includes 1 free SSL cert with every domain name. Per year.
Only with the first year, if I'm reading their site right? > With each domain name transferred to Gandi, we include a Standard SSL certificate for free the first year. https://www.gandi.net/domain/ssl#nav
Keep in mind that Gandi includes 1 free SSL cert with every domain name. Per year.
Only with the first year, if I'm reading their site right? > With each domain name transferred to Gandi, we include a Standard SSL certificate for free the first year. https://www.gandi.net/domain/ssl#nav
Included for free the first year with the purchase,
transfer, or renewal of your domain name.
Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn this when I tried to callout to a web service (with a startcom cert) from Salesforce. Also their certs are only free as long as you don't need to revoke it.
i once built a clojure web app and used a startssl free certificate. it worked fine after i imported it into the java keystore. i was using OpenJDK under linux. were you using Oracle's java?
Earlier quoted context omitted.
yes i know, this people scaring started with ff2,ie7? - there is nothing wrong with self signed certs, except useless companys wanna make a quick buck selling fud
There absolutely should've been some sort of "encrypted but not verified" handling for self-signed certificates. The current state of browsers is that unencrypted HTTP is presented as safer than self-sign encrypted HTTPS. That's lunacy. Unfortunately, there isn't, and as a result self-signed certificates are useless to anyone running a HTTPS site that expects any visitors.
I'd personally be really happy to see something like http://perspectives-project.org/ instead of the current web of mistrust.
Earlier quoted context omitted.
yes i know, this people scaring started with ff2,ie7? - there is nothing wrong with self signed certs, except useless companys wanna make a quick buck selling fud
There absolutely should've been some sort of "encrypted but not verified" handling for self-signed certificates. The current state of browsers is that unencrypted HTTP is presented as safer than self-sign encrypted HTTPS. That's lunacy. Unfortunately, there isn't, and as a result self-signed certificates are useless to anyone running a HTTPS site that expects any visitors.
Earlier quoted context omitted.
There absolutely should've been some sort of "encrypted but not verified" handling for self-signed certificates. The current state of browsers is that unencrypted HTTP is presented as safer than self-sign encrypted HTTPS. That's lunacy. Unfortunately, there isn't, and as a result self-signed certificates are useless to anyone running a HTTPS site that expects any visitors.
Though I don't enjoy the current sad state of affairs with regards to the security and validation of CAs, there's something to be said for the old adage that no security is better than false security, and trusting all self-signed certificates would definitely be false security, since eavesdroppers could just do a man-in-the-middle with their own self-signed certificate. I'd personally be really happy to see something…
Currently, self-signed HTTPS is trusted less than unecrypted HTTP. We don't get a massive warning if visiting Facebook over HTTP, despite the MITM risk and the fact that data is being sent in clear to boot.
Earlier quoted context omitted.
Be aware though that GeoTrust and Thawte certs don't work[1] on android devices. There are claims that it can be fixed by adding a cross-root cert[2] but for me that didn't work out. More generally: If you need to support mobile devices then read your CA's compatibility list closely (if you can find it...) and test, test, test. You'd think this shouldn't be an issue anymore in 2012, but it sadly still is. [1] http://…
Sigh. I spent way too much time picking these particular certs and they've gone and messed it up. :) The cross-root cert should work, but you need to make sure it's presented in the right order, I think. FWIW, my latest RapidSSL-through-Namecheap certs were issued by: issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority And that's the "good"/trusted CA. I'm not sure when they made the switch, but I only got…
I've used StartSSL in the past. I will never do so again. Yes, the certs are free, and yes, they work in all common browsers. But the process of obtaining them is a horror of Lovecraftian proportions. I'll happily pay a few dollars to Namecheap to be able to avoid the nightmare that is StartSSL's UI.
The only complication is the fact that they use client side SSL certificates for authentication. I don't know of any other site which does this. Although I like that they're dog fooding, it probably would have been better if they'd stuck with a traditional username/password/cookie scheme for logging in, from a business/usability perspective.
CACert does.