Switch to HTTPS Now, For Free

https://konklone.com/post/switch-to-https-now-for-free?hn

by rodrigocoelho • 13 years ago

622 251 13 years ago

grinnick• 13 years ago

I used this guide to help switch a site to HTTPS just last week. Very useful and super simple.

On issue I did run into (not relevant to the article but anyway) was that Heroku charges $20/month to use SSL on a custom domain.

ceejayoz3• 13 years ago

I believe that's because Heroku's on AWS and using ELB, so they have to have an ELB just for you ($15/month).

kemayo• 13 years ago

It is sort of worth noting that it's only free if you have a dedicated IP address. If you just have a cheap hosting plan somewhere, you'll need to pay them for said dedicated IP before you can set up SSL, generally.

I mean, we're not talking a huge amount of money. Webfaction is $5/month [1]. Still!

[1] https://www.webfaction.com/features

spindritf• 13 years ago

You can use StartSSL certificates with SNI (Server Name Indication) which allows you to have multiple sites/domains on the same IP. And really, just get a VPS from Digital Ocean -- be the master of your IP, configuration and fate.

druiid2• 13 years ago

Only issue with SNI is that it has to be supported by the browser. Generally not an issue these days, but something to be aware of.

Edit: Actually, I just looked... WinXP still doesn't support it with IE, so, actually it could be a big issue still.

handsomeransoms3• 13 years ago

Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer need to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopped charging me the extra $5/month automatically. Awesome!

A small fraction of Internet users on extremely out-of-date system cannot use SNI. If you need to support those users, you will still have to buy a dedicated IP address. I personally don't bother (if you're running IE 6 on Windows XP, you have bigger problems).

This is a great guide! I did the exact same thing several months ago and am very happy with the result. Enough with the excuses not to deploy SSL!

[1] https://blog.webfaction.com/2011/12/server-name-indication-e...

dangrossman3• 13 years ago

Almost 1 in 5 people on the web are still running Windows XP. No version of Internet Explorer on XP supports SNI. Neither does Safari on XP, the browser in Android 2.x, the BlackBerry browser or Opera Mobile before 10.1. It may be a minority of users, but it's not just "people who are still running IE6".

Pretty much everyone would love to use SNI; site owners wouldn't have to pay for extra IPs, hosting companies wouldn't have to worry about securing and allocating them just for SSL use, tons of IPv4 space could be put back into circulation, and CAs would be able to sell many more certs. Unfortunately the group that can't use it is too large to ignore, so none of that's happening.

bad_user2• 13 years ago

Any IExplorer on Windows XP, Safari on Windows XP, Android 2.x, Blackberry, Symbian, Java before 1.7, Windows Mobile up to 6.5 ... the list is quite significant. Depending on your target, you can easily talk about 25% of the traffic.

pwenzel• 13 years ago

I used StartSSL certs on a few of my Webfaction-hosted websites with SNI. It was fairly simple, and considering the cost, an excellent service that I highly recommend.

One caveat is that the free certificate lasts only a year.

ewolf• 13 years ago

Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise?

If not, than this is exactly what we need to establish HTTPS as the new standard.

Nux• 13 years ago

They work in all modern browsers, they do not work in certain (very) old versions of curl, wget, android etc.[1]

They should be alright for most stuff, especially for personal use.

And they're free because it costs them nothing to issue them.

[1] https://forum.startcom.org/viewtopic.php?f=15&t=1802

tjohns• 13 years ago

There are some minor caveats, but nothing really worth worrying about. Most browsers accept StartCom certs these days, so that's not a concern unless you're supporting ancient systems. The big difference is in how much validation is done.

The cheap certs only offer domain verification; in other words, they verify that the person holding the certificate owns the domain in question. Typically via an automated email to one of the contact addresses associated with the domain. The catch here is that you're only allowed to fill out the CN= (domain) field in your cert; the others are blanked out. For what most people use SSL for, that's sufficient.

The more expensive certs will go a step further and verify the identity of the entity or person holding the certificate. This entails things like checking your articles of incorporation if your'e a business; things that tend to require a human operator at the CA reviewing your submission. In return, you get to fill out more fields in your certificate. However, nobody ever looks at the details for certs, so this is pretty much wasted money, IMHO.

The only point at which the more expensive certs get you something of value is:

1. You pay to get a wildcard cert, which lets you use your cert on as many subdomains as you want. If you actually need it for technical reasons (e.g. you let users create their own subdomains), this might be worthwhile. Most folks won't need this.

2. You pay to get an "Extended Validation" or "EV" cert, which gets you a little green box in the address bar with your company name. There's strict requirements on identity validation to get these, and it's supposed to engender more trust on the part of users. They're also very expensive. Personally, I suspect nobody really cares about these and it's just a racket for the CAs. But opinions vary.

rurounijones• 13 years ago

The fact that EV certificates exist in the first place is an indication in my mind just how badly CAs messed up the certs originally. ("We need to sell more! Get rid of the checks")

It also drives me nuts that browsers still class self-signed certs below normal (non-ev) certs when they basically offer the same level of guarantees (in terms of "this person is who they claim to be")

konklone6• 13 years ago

I think the main catch here is that they're only willing to issue level 1 certs to individuals. For commercial endeavors, they make you pay money, and then they also have you send in proof of identity and stuff, and manually review your documents. I don't think there's a practical difference in security level, but I'm not an expert in this (which is why I don't address this aspect in my guide).

idupree• 13 years ago

Unless I've misunderstood their policy, they also forbid individuals using Class 1 certificates commercially. For example, if you run a blog with "Support my blog! Buy my T-shirt swag from swag-selling-site.com[link]!" then your blog is commercial (per legal definition of commercial; IANAL); thus StartCom's policy forbids you to use their free certificate for that site.

The first sentence and a half of this paragraph[1] from https://startssl.com/policy.pdf expressly forbid it. Its final "when" clause might be trying to limit what is forbidden, but, grammatically, it has no power to restrict the first sentence, and doesn't properly restrict the second sentence either.

[1] "Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc."

(Naturally, I hope I've misunderstood their policy.)

lauriswtf2• 13 years ago

I am pretty sure that you can't use them for commercial projects

__david__• 13 years ago

They do not work on Windows XP (unless the user is using Firefox or Chrome), as the StartCom certificate is not part of the XP trusted root certs. There is an update available from Microsoft to add some new root certs but as far as I can tell it is a manual only update, which means it's very unlikely to be installed by XP users.

We tried to switch our site to https only recently, and had to backtrack because of this (and because we are too cheap/stubborn to buy an SSL cert from someone who is in the XP trusted root certs).

mike-cardwell2• 13 years ago

StartSSL is wide spread enough that anyone who doesn't have their root installed is probably used to clicking their way through SSL warnings anyway.

zobzu5• 13 years ago

They don't provide an EC or DSA CA (only RSA) you are limited to 1 domain + 1 alt name (the main domain) per cert

Those aren't horrible trade offs tho, but yes, those are limitations.

elchief5• 13 years ago

They won't authorize brand new domain names for about 72 hours. And you have to renew every year. Otherwise, I've used em and they're good.

jlongster• 13 years ago

One gotcha that these kinds of tutorials don't mention is that if your site might be blacklisted if google doesn't say it's been 100% clear of trojans for the past 90 days. I hit this on my domain when I accidentally had an .exe file in my static files. I've had to wait 3 months until I can get the certificate.

http://safebrowsing.clients.google.com/safebrowsing/diagnost...

Zoepfli4• 13 years ago

In the switch to https everywhere, we have barely started. For every HN and wikipedia with https there are 20 websites without (and whether the ones that do https do really secure https is yet another question).

Somebody should go through the top 10k websites and make a list, then repeat every few months.

consultant23522• 13 years ago

Well, if you go by % of internet traffic Google is 40-50% of all internet traffic. You could probably get above 99% of all internet traffic with a shockingly small number of sites. While Google, for example, uses SSL it's not like your data is really secure from monitoring there.

glazskunrukitis2• 13 years ago

I understand that some time ago there were reasons behind not using https (price, setup, performance), but now you can get a certificate for few bucks[1].

[1] http://getssl/en/ssl-certificates

ivanr8• 13 years ago

FYI, in my research, about 10% of Alexa top 1 million sites support SSL. For the configuration of those 10%, see SSL Pulse https://www.trustworthyinternet.org/ssl-pulse/

cpeterso2• 13 years ago

Note that Wikipedia supports HTTPS, but it is not the default (yet).

Zoepfli4• 13 years ago

Funny, it is for me: any wikipedia page redirects to its https counterpart.

E.g. http://en.wikipedia.org/wiki/Hacker_News redirects to https://en.wikipedia.org/wiki/Hacker_News .

teeja• 13 years ago

I think that somebody is the EFF. HTTPS-Everywhere (look to the bottom of the page to DL the latest .xmi) has a LOT (certainly hundreds) in their list ... with qualifiers noted.

https://www.eff.org/https-everywhere

iancarroll2• 13 years ago

If you host with SingleHop, they allow generation of unlimited SSL certificates. [1]

[1] Ex: https://ianthedeveloper.com

jakobe4• 13 years ago

I just recently enabled SSL on my business website. It was anything but simple.

First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses.

Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought a domain only certificate because their marketing was so confusing. Their friendly customer service walked me through a complicated process for changing my order.

To get the certificate issued, it took me a week to collect the documents they requested. I had to make sure my business was listed in the yellow pages, so they could send me an automatic phone call for verifying my number.

After every step in the process, they told me to log into their online management area, which was offline from time to time.

I had to confirm my email address by clicking a link about a dozen times. Half of the emails were missing the confirmation link.

Twice I got an email telling me my order will soon be processed, and nothing happened for two days. I had to open tickets in some online support area or send them emails to get them to continue processing.

All in all it took me a month to get SSL working. Now I understand why so many sites do not use HTTPS.

jiggy2011• 13 years ago

If you just want the security of SSL, don't bother with the EV certificate. It's hugely easier.

dangrossman3• 13 years ago

I would be willing to bet over 95% of SSL-secured sites don't have business validation certificates. Given virtually nobody visiting your site will know what that means, let alone how to check anything about the certificate you're using, it just doesn't make sense to pay extra for no benefit. A domain-validated certificate costs less while providing the same padlock icon and level of encryption, and takes just minutes to obtain -- pay, paste a CSR, click a link in an e-mail, and you have a cert.

jakobe4• 13 years ago

In my case, I don't care about encryption. On my website, I only offer software for download. No private data. Payment is handled by a third party.

The only reason why I want to support https is so that customers can confirm who they are downloading from. Ideally, I'd like an EV certificate, but I can't afford that. So I chose a business validation cert. A domain only certificate wouldn't really confirm anything.

(Also, some of my troubles would have been the same with a domain-only cert. The emails with missing links were those for domain validation, and I had to paste the CSR in the management area that was offline...)

dpe82• 13 years ago

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

vacri2• 13 years ago

Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are.

I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored the phone number I gave them, and instead called on the publicly-listed phone number they found on the internet.

dgesang3• 13 years ago

Someone should probably also point out: most of the CAs are more or less equally 'crappy'. We've been through many CAs now and none of them has a process anywhere near 'perfect'.

Btw, Comodo customer support is rather nice. We recently bought a code signing certificate from them and they walked us through the whole process via chat, worked quite well and we were done in about 30 min.

majelix4• 13 years ago

Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Except that SSL isn't just about transport-layer security, it's also about identity. The entire model of SSL breaks down if anyone can buy a certificate for anything.

alecsmart1• 13 years ago

Since you mentioned crappy provider, I would like to add that there is an illusion of choice when it comes to SSL certificates. When I was purchasing an SSL certificate, I researched many and after speaking to the same sales rep on multiple sites, I realized they are all the same company. To quote-

Symantec’s family of dominant SSL brands includes VeriSign, GeoTrust, Thawte, RapidSSL and TC Trust Center.

They own about 70% of the certificates, all priced differently to give you an illusion of choice. So if one provider is crappy, their support is the same; and thus they are all crappy.

fmela• 13 years ago

I had a similar experience when I purchased a software signing certificate from Comodo, exacerbated by the fact that we had accidentally transposed two adjacent digits in the phone number we gave in our listing. It ended up taking about two weeks in all to get Dun & Bradstreet to correct the typo and have Comodo verify the update, and then call us at that number. While the delay was not pleasant, I am glad that they make an effort to ensure that a legitimate organization is purchasing the certificate.

lauriswtf2• 13 years ago

You could have just bought the $7 cert from getssl.me and it would take 2 minutes at most.

jakobe4• 13 years ago

They just resell Comodo certificates, so I assume I'd have the same issues with broken emails and offline managment area and emails promising "Your order is being processed right now" (the business validation stuff was only a part of the problem)

Also, it makes me angry how you have all those beautifully designed landing pages everywhere, and as soon as you have ordered, you have to deal with ugly and confusing websites that barely work at all.

JoshTriplett• 13 years ago

If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).

agwa3• 13 years ago

Android 2.x also doesn't support SNI.

jakobe4• 13 years ago

But then I'd need to support SSL for all domains hosted on the server, and this would mean getting 5 certificates instead of one.

handsomeransoms3• 13 years ago

Fun fact about Startcom (providers of StartSSL): they were the only certificate authority that the "Comodohacker" responsible for breaching Comodo, Diginotar, and others, was unable to hack. [1]

[1] http://www.informationweek.com/security/attacks/how-startcom...

ivanr8• 13 years ago

You probably meant to say that they are the only CA Comodohacker admitted attacking and failing to obtain any fraudulent certificates. Given that there are over 100 CAs, it's likely that the same person/organisation attempted attacking others and failed.

One interesting thing about that incident is that Startcom never released a report to state exactly what had happened, which is in contrast with some other hacking incidents they suffered. If what Comodhacker said was true (that he had been able to communicate with the NSM), then they definitely were hacked -- just not critically.

dimension7• 13 years ago

Excellent guide but unfortunately StartSSL does not support all top-level domains. I went through the trouble of registering with StartSSL, they even issued a client certificate for my email account at .tk domain, but they refuse to issue SSL server certificates for any .tk domain.

Even though this is a perfectly legitimate top-level domain (yes I paid for a real .tk domain, and I fully control the DNS settings just as any other domain — it is not a free web-based redirect domain, which the Tokelau NIC also offers), StartSSL does not let you choose it when requesting a certificate. They have a drop-down of supported TLDs, but .tk is nowhere to be found (and you cannot edit the HTML to submit this domain anyways, it will be rejected by the server). Initially this appeared to be a simple omission, but investigating further revealed it was an intentional decision to not allow issuance of SSL certs to .tk due to "abuse".

Quite annoying to have purchased an apparently legitimate domain, only to discover it is considered "second-class" by certain online services. Now I am faced with a decision to buy another new domain at a more reputable TLD, switch all my servers and services over, or find another SSL issuer which supports .tk. CACert appears promising, also issuing certs for free, but sadly they are not widely accepted by browser vendors. A paid SSL authority would likely issue a cert for .tk, but at this point I'm inclined to not use SSL at all, or stick with my own self-signed certs (I mainly use my server for personal services, so wide accessibility is not a major concern, but having a "real" trusted cert would be nice).

Does anyone else have any experience with acquiring SSL certs for less popular TLDs? I picked .tk because a short and easily recognizable domain was available, got in before many of the better names were snatched up as in .com, etc, but perhaps giving in and buying a longer domain name at a popular TLD is worth it if it means StartSSL and other services will consider it more trustworthy.

jakebellacera• 13 years ago

.tk domains are probably restricted because they're free to register, thus are heavily associated with abuse. Abusive websites with certs that haven't been caught could be misleading to users. That's my guess, anyway.

jafaku• 13 years ago

StartSSL will also refuse to give you a certificate based on some sort of blacklist of words, which they won't disclose. I remember they didn't even want to tell me why they refused my domain, I had to send many emails asking for more information, until the guy answering finally decided to tell me.

vangale• 13 years ago

I had StartSSL certs for a .ST site and it worked fine.

wtn2• 13 years ago

I was under the impression the private key for authentication to the StartSSL site was generated in the browser with the keygen tag, not on the server…

Tortoise• 13 years ago

It is. The website is wrong. Assuming your browser implements it securely, it's no less safe than generating it client-side with openssl.

konklone6• 13 years ago

Oh, whoops. Can you recommend how I should change the text? Anything you can link to to show me what you mean?

tootie• 13 years ago

Using HTTPS everywhere doesn't really help much. It doesn't help at all if the surveillers either have your cert or access to decrypted traffic inside the firewall. Any PII being sent over the wire should most definitely be encrypted, but encrypting my access to a news site isn't really hiding anything. The requested URL still need to be unencrypted, you'd just be encrypting content that is already availble unencrypted.

dangrossman3• 13 years ago

The requested URL still need to be unencrypted

The SSL connection is set up before the HTTP request is sent; that's why the dedicated IP per domain is required, since the domain (Host header) is part of the request as well. The URL you're accessing is not sent in the clear.

cbr• 13 years ago

Partly. On a modern system with SNI the hostname is sent in the clear. This removes the requirement for a dedicated IP per domain with SSL for those users, but until SNI everywhere you still need one.

schoen• 13 years ago

The particular publicly-available information that people are interested in is privacy-sensitive. It's easiest to see this by thinking about articles on sexual, medical, and religious topics at Wikipedia (or WebMD!). Although the information is public, users don't want others on the network to know that they read it.

And on some networks, the content of news articles that we might think of as totally innocuous is considered very sensitive, and the network operator might try to block it. The most familiar example might be news about annual commemorations of 6/4. Using HTTPS provides resistance against content-based censorship because the network operator doesn't know when users are reading the specific things that they wanted to prevent them from reading.

bad_user2• 13 years ago

It can get worse than people snooping on what you're reading ... they can also modify the content. In many places, like at cheap motels or providing free Wifi, they inject ads into content pages or other crap.

So how do you know if the content you're reading has not been tampered with? You don't, unless the connection is encrypted.

nilved• 13 years ago

This isn't strictly related to this post, but I've always thought that the idea of paying a fee for SSL certificates was a bad one. Time spent buying and setting up an SSL certificate would be better spent making your site available as a Tor hidden service.

icebraining2• 13 years ago

I'd rather disconnect my web server, it'd take less effort and receive the same number of visitants.

chc4• 13 years ago

Just going to throw out that if you use a Cloudflare business plan, you can just tick a couple of boxes and get SSL for free.

andrewvc• 13 years ago

What, I thought you had to pay? Yup, it says you have to pay

chc4• 13 years ago

You have to pay for the business plan. If you're already paying for that, the SSL is free. Unless they've changed how it works and I've just gotten grandfathered in or something.

tlrobinson• 13 years ago

While I like Cloudflare, it's worth noting you give up true "end to end" encryption SSL normally provides. It's entirely possible for Cloudflare to allow others to eavesdrop on your traffic, and in fact I think the connections between Cloudflare and your servers are normally unencrypted.

Basically, using Cloudflare SSL is good for protecting your customers from eavesdroppers on WiFi, not so good for protecting against NSA surveillance. But it's probably better than nothing.

chc4• 13 years ago

Whether the connection between you and Cloudflare is encrypted is up to you. It's right in the same box as the option to turn on encryption in the first place.

huhtenberg3• 13 years ago

Oh, the sweet irony -

SSL’s not perfect, but we need to make surveillance as expensive as possible

immediately followed by -

And hey, bonus: more complete referrer information in Google Analytics

Make up your mind already. Are you against the surveillance or for it? You can't really sit with one ass on two chairs.

--

(edit) Point being is that if you are pulling the anti-surveillance card, then you shouldn't really be siphoning off your visitors data to Google.

doppel• 13 years ago

I wouldn't exactly categorize "everyone can see your data" and "we can now track your movement on our own site" together.

The idea of surveillance, in this case, is that no 3rd parties can snoop on your data. If you are actively using a site, it should be under the assumption that they can and will track anything you do on their site.

huhtenberg3• 13 years ago

no 3rd parties can snoop on your data

And Google is what... ?

greyfade2• 13 years ago

I think the idea is to make MitM snooping more difficult, not necessarily data collection by a third-party.

I agree, though, it is kind of silly, knowing that Google has been complying with large numbers of FISA requests.

konklone6• 13 years ago

Google Analytics data is anonymized and aggregated - it's very different than request patterns and sessions tied to a specific IP.

alextingle2• 13 years ago

/etc/hosts...

   # Screw Google...
   127.0.0.1	www.google-analytics.com
   127.0.0.1	ssl.google-analytics.com

Tichy• 13 years ago

Are you sure they only use one domain? Perhaps for analytics, but there is also adsense, doubleclick and who knows what else.

imaginator• 13 years ago

StartSSL offer a great service.

If you'd rather use the Java Keytool to manage your certs, I wrote up this guide on making it work with StartSSL. https://buddycloud.org/wiki/buddycloud_SSL_setup

Should just be a copy paste, wait, paste, export job.

espeed6• 13 years ago

Make sure you do not use compression with SSL.

Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See...

SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1

BREACH Attack (HTTP Compression): http://breachattack.com, http://security.stackexchange.com/questions/39925/breach-a-n...

CRIME Attack (SSL/TLS/SPDY Compression): http://en.wikipedia.org/wiki/CRIME_(security_exploit), http://security.stackexchange.com/questions/19911/crime-how-...

konklone6• 13 years ago

SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com

I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544

ivanr8• 13 years ago

Thanks. We also have a step-by-step configuration guide called SSL/TLS Deployment Best Practices. I've just submitted it here:

    https://news.ycombinator.com/item?id=6447518

In the nutshell, it's a continuously updated "everything you need to know" about SSL/TLS.

espeed6• 13 years ago

Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" (http://colin.percival.usesthis.com, http://www.daemonology.net/blog/2009-09-28-securing-https.ht...).

In his 2010 talk "Everything you need to know about cryptography in 1 hour" (http://blip.tv/fosslc/everything-you-need-to-know-about-cryp...), Colin also recommends limiting SSL use to a confined area.

Amazon does this.

For example, Amazon.com only uses only SSL when you log in, check out, or access "Your Account". Everywhere else Amazon.com uses HMAC request signatures over HTTP, similar to how AWS API requests are signed.

See "Signing AWS API Requests" (http://docs.aws.amazon.com/general/latest/gr/signing_aws_api...)

To Colin and the other security professionals on HN:

  * Is limiting SSL still recommended in spite of the trend toward Always-On-SSL?

  * What are the current best practices and tradeoff considerations of this approach?

TomGullen• 13 years ago

We just scored F: https://www.ssllabs.com/ssltest/analyze.html?d=scirra.com

But I'm not quite sure what I need to do to make it better?

bitwizzle• 13 years ago

While it's true that you should disable compression, most browsers disable it client-side now so this isn't a huge issue. As for BREACH, HTTP compression has a huge performance benefit, so it's not really feasible to disable it. Unfortunately, it's pretty difficult to protect the attack using other methods.

barrydahlberg2• 13 years ago

Can you please clarify exactly what you mean by compression? Is this referring to typical gzip compression in HTTP results or something else?

cenhyperion• 13 years ago

Is this referring to typical gzip compression in HTTP

Yes. It's a major vulnerability discovered in the past few months that significantly weakens the crypto.

Website Describing the attack: http://breachattack.com/

Django Blog Post: https://www.djangoproject.com/weblog/2013/aug/06/breach-and-...

espeed6• 13 years ago

Yes, BREACH exploits HTTP body compression so this means typical gzip compression in HTTP results (see http://breachattack.com, http://en.wikipedia.org/wiki/HTTP_compression#Security_impli...).

Full Paper: "BREACH: Reviving the CRIME Attack" (http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%2...)

elchief5• 13 years ago

Don't use HTTP compression on private responses when using TLS. It's okay to HTTP compress publicly available images/scripts/stylesheets

wglb• 13 years ago

Well, be careful that it is just the body that gets compressed.

The vulnerability occurs when the cookie is part of the compression payload. Although that does depend on the attacker being able to control what gets sent.

chris_mahan2• 13 years ago

When it's harder to get SSL working than to install debian stable on a machine, I'd say SSL is too hard.

astrodust4• 13 years ago

This is mostly the fault of the SSL certificate providers, which vary in complexity between the obnoxious GoDaddy and even more obtuse and impossible to deal with.

Compounding this, the configuration file formats for each web server platform vary wildly, selecting the correct format and installing it properly can be tricky.

Making matters worse, it's very easy to set up something that looks like it's working, but is actually broken on some subset of the browsers out there.

These problems can be solved with better standards, better documentation, testing tools, and most of all, providers that actually care about the user experience they're selling.

chris_mahan2• 13 years ago

Can't the providers be disposed of, and replaced with an open-source automated system?

derstang• 13 years ago

For another point of view...free is what you get http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_sta...

brubaker• 13 years ago

I tend to take people that have a running douchey commentary with a grain of salt.

Plus he was going for validation, which isn't free and is a pretty obnoxious process regardless of who you go with.

hcarvalhoalves2• 13 years ago

If browsers got fixed to not freak out on self-signed certificates, this wouldn't even be an issue, HTTPS could be a default.

mcv3• 13 years ago

But how do you distinguish a self-signed certificate from a MITM NSA-signed one?

0x006A• 13 years ago

NSA does not use self-signed certificates for MITM, they have access to certificate authorities to get there own certificates that show up as valid in your browser.

AnthonyMouse• 13 years ago

Sort of. You actually do need to know when a certificate is self-signed because it means the connection isn't authenticated even if it's encrypted.

But what they ought to do is to accept the self-signed certificate, show something other than the usual lock icon but do the encryption anyway, and then freak out if the certificate changes before it expires.

hcarvalhoalves2• 13 years ago

The point is, sometimes you just don't care about authority, you just care about the encryption.

HTTPS with self-signed certificates is better than moving plaintext over the wire, in the same way PGP is better than moving plaintext over the wire. It doesn't matter that you don't have a "trusted" peer to tell you this PGP signer is who it says it is. As long as you can trust you acquired his key in a secure way (e.g., out-of-band), it's better than the alternative.

Plus, MITM concerns over self-signed certs are moot. This vulnerability exists at the DNS level anyway.

nwh2• 13 years ago

MITM would be unnoticeable then.

zobzu5• 13 years ago

Unless you visited the site before. (like ssh). Or if the trust was provided through another channel (DNS).

mrb• 13 years ago

Summary: obtain a certificate from StartSSL. They provide free certificates as long as it is for an individual, not a company's website. Their process to get a cert is a little more difficult that the competition, but konklone.com provides a nice step-by-step guide.

cpncrunch3• 13 years ago

Nope, you can use it for a company as well.

elchief5• 13 years ago

If you read their terms, and I have, you definitely can't use the free certs for shopping or banking sites. It's kind of vague as to whether you can use it for a commercial site that doesn't involve shopping or banking though.

yeukhon• 13 years ago

StartSSL has some complains in the past. See this (paid user, but why would they provide a free SSL ...?) http://danconnor.com/post/50f65364a0fd5fd1f7000001/avoid_sta...

mcv3• 13 years ago

Is it irony that Safari considers his $0 certificate unsafe, or did he simply get what he paid for?

aroch2• 13 years ago

Safari (wel, the OSX Keychain) doesn't include StartCOM in it's Truststore -- which I'm pretty OK with. I revoke it from all my trsutstores

gmac3• 13 years ago

(a) That's not my experience. This site of mine is secured with a StartCom cert, and Safari has always been perfectly happy with it: https://mappiness.me

(b) Why? I understood they were among the better providers.

astrodust4• 13 years ago

It checks out okay for me (Safari) and with a testing tool: http://www.digicert.com/help/

conductor• 13 years ago

As you can see, StartSSL will believe you own the domain if you control webmaster@, postmaster@, or hostmaster@ with the domain name

I see a potential vuln here for free e-mail services. If one manages to register one of those addresses he can create a trusted certificate and use it for MITM.

joosters• 13 years ago

Several paid-for certificates from a few CAs do just the same. If you're paying $0 for a certificate, don't expect more than ~$0 worth of identity checks!

It also highlights a critical SSL issue; there's really little strength in the concept of a certificate proving the identity of anyone.

icebraining2• 13 years ago

That's why no free mail servers allow you to do that.

cpeterso2• 13 years ago

You can also get free SSL certificates from LOLroot CA!

http://lolroot.ca/

mmagin• 13 years ago

That's dumb.

If you're going to install a new root certificate on all your client machines, you could just as well generate your own CA inside your organization and do the same thing without trusting some third party.

(Edit: I think I've been trolled.)

GoodIntentions• 13 years ago

Ya Think?

"Self-signed certs as a service! IN THE CLOUD! Need Support for your self-signed cert? 5k/year - 1 (800) 555 - 5549"

I wonder if they have an affiliate program

AhtiK2• 13 years ago

And hey, bonus: more complete referrer information in Google Analytics

It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information".

Did anyone get lucky with getting 100% of google search keywords after switching to SSL?

slig• 13 years ago

They don't provide that anymore, even if you're on HTTPS.

I had this same question on a yesterday's thread: https://news.ycombinator.com/item?id=6438992

bigiain4• 13 years ago

What he meant was that Google Analytics will correctly identify visitors coming from a link on a SSL secured site (for example https://news.ycombinator.com ) if your set is SSL secured as well - all browsers strip the referrer header if they're going from an https page to an http one.

Google search queries/keywords are a different issue - Google is intentionally making it impossible to see most of those (presumably, they've got a plan about how to sell that information to marketers using Adwords…)

AhtiK2• 13 years ago

Many thanks for clearing that up! I had no idea browsers strip referrer headers with https->http navigation.

valtron4• 13 years ago

As I understand it, (correct me if I'm wrong), https has two parts:

1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating)

2. Authentication: protects from MITM (e.g. someone changing the data en-route)

For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to having everyone use encryption.

Why isn't it possible to opt for only #1? It should be as simple as adding "Encrypt +All" to your apache settings.

mikeash2• 13 years ago

I believe the problem is that it's impossible to distinguish between "the remote server doesn't care about authentication" and "the remote server cares about authentication, but your traffic to it is being intercepted and modified by an eavesdropper who is retransmitting the data without the authentication flag".

You can opt for only #1, but virtually every browser will put up gigantic warnings about it because it's indistinguishable from a MITM attack.

valtron4• 13 years ago

Unencrypted communication is also indistinguishable from a MITM attack.

dragonwriter• 13 years ago

You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.)

Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is inherently being handed off through a number of intermediaries to an endpoint. If you don't know who the endpoint is, it doesn't do you any good to know that your connection is secure from you to the endpoint.

valtron4• 13 years ago

Still, having #1 is still better than neither. Instead of the NSA (sorry for beating a dead horse) simply siphoning your plaintext off the wire, isn't it more secure if you force them to have to actively fudge every single key exchange in order to read your traffic?

(The "locks on doors" argument.)

tedunangst3• 13 years ago

I agree and disagree. Not all adversaries have active intercept capabilities. Some are just passive. Defending against them isn't entirely pointless.

I really, really dislike the CA cabal. Self signed "encrypt only" certs combined with auto cert pinning in browsers would probably solve 99% of the problem.

dendory• 13 years ago

This is kind of glossing over the point. We all know SSL is good and should be used everywhere. But the simple fact is that to have a fully capable SSL server you need two things: A certificate and a unique IP. There are firms now offering free certificates, but not everyone has the choice to select them. And IP certainly aren't free on most hosts. Sure there are always solutions, like moving to a self hosted model and so on, but it is a significant inconvenience for most.

jackalope• 13 years ago

SSL/TLS is entirely a server/client exchange that has absolutely nothing to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.

al2o3cr• 13 years ago

Mostly true now, but not historically true - until SNI [1] was rolled out widely, implementing SSL absolutely required a dedicated IP. Short story shorter, the TLS handshake happens before the Host: header exchange in HTTP; before SNI there wasn't any way for a host that responded to multiple names to identify which cert to use for the handshake.

[1] SNI - http://en.wikipedia.org/wiki/Server_Name_Indication

zmmmmm• 13 years ago

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free?

I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying activity that makes PRISM look tame. Just curious what others think about this?

lem72• 13 years ago

This is my thoughts exactly.... Cue Conspiracy Theory

gsnedders• 13 years ago

And how do they guarantee identity for zero cost to them? To actually meet all the CA requirements to be a default trusted root isn't easy.

bigiain4• 13 years ago

Like all inexpensive ssl certs, the only guarantee of identity is "domain validation" -if you can read mail going to webmaster@, hostmaster@, Postmaster@, or the email address in a Whois lookup for the domain in question, they'll provide you with a signed key for that domain.

There are higher levels of validation - "business validation" usually involves faxing someone copies of various government supplied paperwork and receiving phone calls on publicly available phone numbers (which is just "outsourcing the identity guarantee" to yellow pages or Dun and Bradstreet.) "EV" validation ( for "green address bar as well as padlock icon" security requires all that plus spending lots of money.

lwf• 13 years ago

With StartCom, you just send them a CSR and they sign it. They don't get access to your key.

StartCom passed an outside audit and is included in most modern browsers by default, indicating that they at least trust StartCom.

They charge for the work they have to do. So, EV and identity validation cost money. Most "domain validated" certs are basically no work, as you can see from the incredibly cheap prices other SSL vendors offer them at.

makomk3• 13 years ago

Actually, the default is for StartCom to generate your private key for you. They do let you generate your own private key and just upload the CSR though.

zobzu5• 13 years ago

making certs doesn't take money. verifying you own the domain (lowest level cert) doesnt take money. all this is fully automated, everywhere. Being an SSL provider is a juicy business once you get things rolling.

Now then again, it dosn't matter if you trust them or not, because your browser trust them for you. using another provider will not make you have a better trust in the sites you browse. Any of the providers can compromise everyone elses trust, as long as they're trusted by the browser.

And thats why the current SSL trust scheme sucks, by the way.

zobzu5• 13 years ago

(note: in chrome this is not 100% true, some certs are pinned by having their trust hardcoded. its a very small list, require browser update, and of course, you're still trusting a large CA anyway)

micahflee2• 13 years ago

It doesn't particularly matter if people trust StartSSL, it matters if browsers trust them (which they do).

There are about 100 root CAs, and something like 1000 CAs if you include intermediates (controlled by ~650 different organizations - https://www.eff.org/observatory), and browsers trust ALL of them. All it takes is one to issue a malicious cert, or to get hacked, to do a MITM attack on ANY domain without showing a browser warning.

The trustworthyness of a single CA doesn't make a difference, because if any CA isn't trustworthy then an attacker can use them instead the other ones. This is the problem with CAs, and the problem with centralized trust systems in general. There are hundreds of weak points.

But also, StartSSL does fairly thorough identity verification. I've had to send them photos of my passport and talk to them on the phone to do identity verification. It's also worth noting that it's the CA that both https://www.eff.org/ and https://pressfreedomfoundation.org/ use.

As long as there's a broken CA system, the choice of CA does not matter in the slightest as long as it's trusted by browsers. Users only care if it breaks a website with a scary warning, but if it doesn't, it doesn't matter. There's no need to spend money.

StartSSL does charge if you have more than very basic needs, like if you want multiple alt names, or if you want a wildcard. But it's still cheaper than the competition.

paulgerhardt• 13 years ago

it matters if browsers trust them (which they do).

We had endless problems with StartSSL on mobile browsers. They have only recently been added to the latest Windows Mobile 8 repo and you can forget about any phone OS (except iOS) that was released before 2012.

The thing with SSL providers is most people think if it works on Chrome and IE they're set, but for certain businesses they need something that will work on the Wii Browser, an IBM Power System, or an older dumbphone. SmartTV's in particular are pretty annoying to get any CA list because whoever implemented the browser portion on the devices probably just imported some random Java lib from circa 2002.

If you are doing something small and personal, StartCom is just fine. If you're running a business, at some point it may become inevitable that you switch to oldest provider you can reasonably sign up for, in particular one of the Original Three (Thawte, GlobalSign, or Verisign). If you're running a non-profit advocating for privacy and cryptography where a large number of your users may be based in the middle east running on legacy hardware, you may want to take a cursory look to see if your users are getting any cert problems and get a cert from Thawte (the cheapest of the three - though you will need to chain to an intermediary cert if you got with their 123 option).

olefoo• 13 years ago

Just because you're paranoid...

And to further your paranoia, the NSA and Israeli intelligence orgs have form on doing each others dirty work.

But what that really points out is the brokenness at the heart of the PKI system as it's currently implemented.

When was the last time you audited your browsers trust store?

autoreverse• 13 years ago

Globe SSL https://globessl.com/ has domain validated certs at $24 per 3 years.

I've been using these since 2011 (starting with one year certs before switching to 3 years later) with no problems.

kijin• 13 years ago

If you don't have a dedicated IP for each domain, and if you need to support clients who can't use SNI (IE on Windows XP, Android 2.x, etc.), here's a simple solution:

Use a different port number.

https://example-domain.com:12345/ is a completely different website from https://another-domain-on-same-ip:32412/.

No need for a dedicated IP address. No need for wildcard certs, SNI, or any of that fancy stuff. Sure, it's ugly. But it works with every browser (even IE6), and it's not like anybody is actually going to type that into an address bar. You'll be redirecting your HTTP website to your HTTPS website anyway, aren't you?

You can only have two of the following three: (1) shared IP, (2) pretty URLs, and (3) legacy client support. Choose which two you want to have.

mike-cardwell2• 13 years ago

A lot of corporate networks only allow machines to connect outwards on a certain whitelisted range of ports, ie 80 and 443. A certificate warning for ancient clients because you're using SNI is a much better failure mode than a connection error.

jlgaddis• 13 years ago

Note that in addition to using it for your web site, you can also use this same certificate for e-mail, assuming you run your own mail server.

Long story short: I recently moved my e-mail from Google Apps to a machine under my control. As part of that project, I "redeemed" an unused SSL certificate I had purchased a while back for Postfix and Dovecot.

(While I paid for mine, you can use a self-signed one and most MTAs won't complain or refuse to deliver mail, if memory serves.)

Abundnce10• 13 years ago

And hey, bonus: more complete referrer information in Google Analytics for people visiting from sites already using HTTPS (like Hacker News)

If I enable SSL on my website do you think I will be able to get the referring keyword from Google? Now that Google is making all searches secure about 80% of the searches show up as 'Keyword Unavailable'. http://searchengineland.com/post-prism-google-secure-searche...

ck2• 13 years ago

Don't forget to enable ssl stapling which is now available in both nginx and apache and supported in firefox 25 and newest Chrome.

Sami_Lehtinen• 13 years ago

Because certs are so easy to get, it's better to use fingerprint identification for sites, to make sure it's right one. That's what I've been doing for ages, with https, and smtps. I'll be blogging about it soon.

waaatwaaat• 13 years ago

Why r u decrypting your private encrypted key? To use for csr request? Can't u do car request with private encrypted key? And why point nginx/apache/watevr at the decrypted private key? Sounds unsecure?

jbarrec• 13 years ago

Thank you so much for sharing this!!

IgorPartola• 13 years ago

This is where domain registrars should give you a basic wildcard SSL cert for free when you register the domain. There is no reason why you should get that separately. The first registrar to realize that it is basically free to them to provide you the SSL cert and bundle the two things together wins.

I also wonder if advances in DNSSEC will help eliminate various SSL cert dealers: if you have a secure way to prove that example.com translates to a given IP, and DNSSEC could distribute the public cert for HTTPS in some standard manner, then CA's have no reason to exist anymore. See http://blog.huque.com/2012/10/dnssec-and-certificates.html for a decent discussion of this.

Edit: even better, if I could provide a secure way for you to communicate with my site over HTTPS without relying on a CA, I could also provide you my public GPG key securely. That way you know that me@example.com really has the certificate with ID DEADBEEF. Of course you don't know that I am Igor Partola is who claims to own igorpartola.com, but at least you can securely associate the email address with the GPG key, which is good enough if you, let's say, only know me as my online identity and only care to communicate with me about things related to that identity.

For example, if you found a project of mine on GitHub, and found a huge security flaw in it, you might want to securely email me an exploit and a patch without advertising the vulnerability to the world. It's good enough to have the email/GPG key association without needing to authenticate my real-life identity.

nasalgoat• 13 years ago

On a side note, which cert provider you go with can dramatically effect your latency times.

In testing, we found that DigiCert was 50-100ms faster on queries than our existing GoDaddy certificate, based on the location of their CA hosts.

The improved response time resulted in a 15% increase in traffic on our API.

megaframe• 13 years ago

Been wanting this for a long time but didn't know of a free vendor and didn't seem worth paying for (just for my personal use)... now I got it working on everything but OSX, it just does not seem to want to accept the cert.

Switch to HTTPS Now, For Free

Related Stories