SSLMate Blog

https://sslmate.com - being able to get fresh certificates in less than a minute right from the command-line is amazing.

Check out my startup, SSLMate: https://sslmate.com. What sets SSLMate apart is that we're working on making SSL certificate management extremely easy on Linux servers. You buy certs from the command line in a single step that takes a minute or less and automates important details like bundling the chain certificate. You can set up a cron job for automatic renewals. Even well-run sites have been known to forget or botch cert renewals, and we want to put an end to that by automating everything. Many features are in the pipeline and will be announced in the coming weeks. Regarding EV certs, they're not worth the extra money and inconvenience. They provide no additional security, and the assurance they provide visitors is highly questionable (e.g. see shiftpgdn's comment about how switching to a non-EV cert resulted in absolutely no change in order metrics: https://news.ycombinator.com/item?id=8344666).

Awesome! I love CT logs and use a service called Cert Spotter [0] to notify me every time a new cert is generated for one of my domains. This knocks out their Q1 goal [1], I'm very excited about their Q2 goal of Multi-Perspective Validation [2]. It will make getting a cert issued to a malicious actor via BGP hijacking much more difficult. I'm also excited about them getting a ECDSA root certificate and was bummed out when it de-prioritized from being a 2018 feature, but Multi-Perspective Validation is certainly a better priority. All this provided for free, lets encrypt is certainly one of my favorite non-profits [3]. [0] https://sslmate.com/certspotter/ [1] https://letsencrypt.org/upcoming-features/ [2] https://letsencrypt.org/2018/12/31/looking-forward-to-2019.html [3] https://letsencrypt.org/donate/

I agree with the value of monitoring the CT's since it provides a lot of useful information, but since I do not use any FB account (needed for the link above), I prefer https://sslmate.com/ which will warn (email or api) you when new certificates (for "your" domain) have been logged to CT.

Quick plug for a company I've used: SSLmate (http://sslmate.com) makes cert purchase (for those whom need this) painless and fast. They use Comodo and Geotrust FWIW. I've had my own pain with Comodo through other resellers, and moved on to sslmate and godaddy. Recently moved my home blog (http://scalability.org) to LE. Work (http://scalableinformatics.com) is using godaddy for now, though thinking hard on using sslmate going forward for it (because ... godaddy).

SSLmate (https://sslmate.com/) actually makes things similarly simple — I've been using them for a few months now.

SSLMate seems pretty easy as well: https://sslmate.com/ (No affiliation, I just saw their HN post some time before)

Have a look at the "certificate" section of Gandi's API https://github.com/Gandi/gandi.cli/blob/master/gandicli.man.rst And check out SSLmate https://sslmate.com/

I highly recommend SSLMate too. Buying a SSL cert via CLI and automatic SSL renewal and updates via cronjob make it awesome. Not to mention it has configuration templates that make getting a best practice config for almost everything you would use a SSL cert on. https://sslmate.com/blog/post/sslmate_mkconfig

sslmate is the one I'd suggest. They are cheap, easy to use, developer friendly, and no BS. https://sslmate.com/

I've had a lot of good experiences lately using SSLMate (https://sslmate.com/) to automatically buy, download, generate chains, and renew certificates. Then, I use Mozilla's SSL configuration generator (https://mozilla.github.io/server-side-tls/ssl-config-generator/) to set up the cypher suite. Those two together will have get you running very quickly. It's certainly a good idea to know what you're dealing with, but there are smart people behind both of these services that really simplify things.

It should be as easy as installing WordPress, yes. That should be the ultimate goal of the whole discipline of encryption and security: orders of magnitude easy-to-use. SSLmate's[1] `sslmate buy www.example.com` does everything (private key, CSR generation, cert signing) but installation. It automatically maintains the certs too. It's currently a commandline tool. [1]: https://sslmate.com

I would approach the issue rom the opposite direction. What is the minimum failure of any CA required for me to get popped? If some malicious actor goes through the effort to get me, how many other clients/servers on the internet can get from the same CA breach / malicious cert? How would you know to un-trust a CA you already trust until after the incident (a malicious certificate issued) had already happened? Even if the incident happened, someone still needs to alert you to un-trust the CA involved. That takes time. History of mistakes / bad decisions by cert authorities: https://sslmate.com/resources/certificate_authority_failures > who is issuing certificates some lunatic wrote nonsense into, but which you trust Do you know every CA your OS and each browser trusts out of the box? Have you done an audit of each one of them? Does an audit 100% prevent a breach from happening in the future? What are the odds that their policies are perfectly followed every time and that no employee in the right place can be bribed/blackmailed? Remember Cert Authorities are watering holes. Almost all of the internet trusts a few of them. By breaching one (which may be very significant, either technically or reputationally), the payoff can be massive.

https://sslmate.com/ - not used, but bookmarked.

BTW, all the recent certificate shenanigans have invovled for-profit CAs [1]. [1]: https://sslmate.com/resources/certificate_authority_failures

The flipside of the same technical points is https://sslmate.com/blog/post/entrust_distrust_more_disruptive_than_in… where some non-browser clients don't handle this, or worse, handle it incorrectly.

It prevents attack vectors that involve attacker-owned certificate authorities as well as compromised certificate authorities from exposing user-data. https://sslmate.com/resources/certificate_authority_failures

Indeed it is. Sorry. I missed the Pricing section in the top left. I think you might be served well showing that information directly on the product page [0] or linking directly to it there. This would be especially helpful on mobile where discoverability of the menu isn't as good as on desktop since it's hidden behind a click. Your other product pages are better at showing this information. [0]: https://sslmate.com/certspotter/

Yeah, Cert Spotter does this (https://sslmate.com/certspotter/). It's a huge help both to be able to monitor cert issuance for a domain and all of its subs, and to be reminded when a cert is expiring.

> 4. Key rotation: Again, I know of only one web server that does this by default and automatically (cough Caddy). This misses the point, because whilst nginx/Apache don't handle this for you - the automated ACME clients like Certbot (and e.g. Lego) do and will ensure you get a fresh keypair used for renewals. >5. Certificate transparency: As of now, there is not enough useful consumption of CT logs. We have TBs of data but no one to read them. Don't these sort of monitoring services already exist? https://sslmate.com/certspotter/ https://developers.facebook.com/tools/ct/ I don't disagree adoption is probably low but it seems more appropriate for a specialised service (as part of your existing monitoring infrastructure) to handle this.

It's also the case for Firefox. It's because Erlang uses a symantec-owned certificate, while Symantec is now distrusted. https://sslmate.com/blog/post/ct_redaction_in_chrome_53 https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/eUAKwji…

you can monitor certificate transparency for new certificates of your domain see https://sslmate.com/certspotter/ or do it on your own.

> "So to be sure nobody issued a cert for one of my properties I would have to check regularly on CT logs to be sure that only certs requested by me are issued." CertSpotter does this for you automatically: https://sslmate.com/certspotter/

"Your private SSL key is generated on your system and is never transmitted in any way to our servers. The sslmate command is a simple script that anyone can examine to verify that this is true." https://sslmate.com/faq

> Root cause: Symantec was willfully disregarding industry regulations by issuing trusted certificates without proper authorization. Source: https://sslmate.com/certspotter/failures “Willfully” is the key word here. The business side of running a CA is fundamentally at odds with the security side. A few short-sighted decisions by business-minded managers with their eyes set on profits can completely eviscerate the security side of a company, and it’s possible that nobody remains at Symantec who has the combination of security knowledge + internal political power + will. There’s also the Trustico fiasco. Trustico revoked 50,000 Symantec-issued certificates in a shockingly bad way. Because policies allowed for certificates with compromised public keys to be revoked, Trustico intentionally compromised the private keys in order to achieve the desired revocation. https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/wx… > As one of Symantec's former largest partners - my personal opinion and personal experience is that Symantec is a company that thrives on recklessness and one that I wouldn't trust nor deal with. You can see more bad behavior here—Symantec is seen as a reckless company, and Trustico (recklessly) cuts ties with Symantec for its business needs. Both actors are bad enough that their relationship reflects poorly on both of them. I’m sure there are some people who could fix this problem in six months, but I bet they don’t work for Symantec…