5 ms·

Shared SSL certificates from CloudFlare are also loaded with porn sites. For https://www.binarysludge.com https://www.binarysludge.com SANs: sni29282.cloudflar

• AlyssaRowan 12y ago
  Wouldn't help in general. Firstly, lots of sites on Sky's default block list aren't porn. Secondly, StartSSL is a terrible certificate authority who charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines. Perhaps wait for Let's Encrypt later in the year instead. Thirdly, this also affects shared hosting. We are now out of IPv4 addresses in RIPE, and we need encryption everywhere - IPv6 is one solution but SNI and shared hosting is an essential transitional tool. That's why CloudFlare have deployed it the way they have. Censorship simply can't be allowed to stand in the way. Sky need to fix their shit here, which is to say, turn it back off by default.
  • geographomics 12y ago
    > charges for revocations (even after Heartbleed) in clear contravention of CA/B Forum guidelines The guidelines don't state that revocations must be free of charge, where are you getting that from?
    • claudius 12y ago
      Point 7.1.2.8 states that "the CA Will revoke the Certificate for any of the reasons specified in these Requirements". This is a warranty made by the CA towards all "Certificate Beneficiaries", which includes "All Relying Parties who reasonably rely on a Valid Certificate", i.e. the general public. Unfortunately, it is not made absolutely clear what "reasons specified in these Requirements" means. There are a couple of occurrences of "the CA SHALL revoke if X", but these are obviously not binding. However, nowhere does it say that failure to pay on the side of the certificate recipient would be a reason for the CA not to do their job. I would also find it very weird if the quality of warranties made by a CA towards me depended on someone else paying the CA some money – in other words, I’m fine with the CA charging its customers to revoke certs, I’m not fine with the CA not revoking if its customers fail to pay. EDIT: Link to PDF: https://cabforum.org/wp-content/uploads/BRv1.2.3.pdf https://cabforum.org/wp-content/uploads/BRv1.2.3.pdf
      • geographomics 12y ago
        But if you look at the bylaws of the CA/B forum [1], they explicitly exclude discussion of "pricing policies, pricing formulas, prices or other terms of sale" as part of their mandate. So we can't assume a position for or against revocation charges - it's just not within the scope of the guidelines. Which are non-binding and advisory anyway. [1] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-Bylaws-v.1.2.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-Byl...
        • claudius 12y ago
          I’m not against revocation charges per se, I’m against charges being paid prior to revocation. So a CA including something like “if we have revoke this cert, you have to pay 20$, we will revoke under these circumstances: …” would be perfectly fine with me – terms in legal contracts requiring one party to pay a certain amount if certain situations arise are not uncommon, so I don’t think this would have legal issues. My problem is really that a CA says “we know this cert is bad but won’t revoke it, sorry about that”, just because the owner of the cert (someone absolutely irrelevant to me) doesn’t pay up.
  • sublimino 12y ago
    Wasn't suggesting StartSSL as a solution for the OP, just as an aside on CF's SSLs. But https://letsencrypt.org/howitworks/technology/ https://letsencrypt.org/howitworks/technology/ looks great, thanks. Bring on Summer 2015. Probably a good time to name-drop https://www.blocked.org.uk/ https://www.blocked.org.uk/ to verify blocked domains too.
  • jsprogrammer 12y ago
    What is the reason for the shared certificates?
    • captn3m0 12y ago
      Cloudflare is offering free SSL certificates to anyone. Using shared certificates keeps the costs down.
      • jsprogrammer 12y ago
        In what way does it keep costs down?
        • captn3m0 12y ago
          Cloudflare has to issue a single SSL certificate that is shared across multiple sites. The cost of a certificate is not proportional to the number of alternative names in the certificate, and is a fixed cost. As a downside to this, they have to use SNI, which is not supported in any IE+XP combination, along with a few older mobile browsers as well.
          • kelnos 12y ago
            You're mistaken; certs with multiple SANs don't make use of SNI. SNI is used (required) when you have multiple distinct certs. CloudFlare is not using SNI likely specifically because of the IE+XP issues (among others) that you point out.
            • captn3m0 12y ago
              Yeah, I got the two mixed up. SNI doesn't mean multiple hostnames on a cert. It means multiple certs on the same IP. However, due to high costs behind getting IP addresses, CloudFlare does use SNI for its free tier. Its paid customers on the other hand get their own IP per hostname.
        • kelnos 12y ago
• tallanvor 12y ago
  If the customer can't afford to pay $20/month to use SSL from Heroku (which does seem to be a rather outrageous amount), they're not going to be able to afford to upgrade to the CloudFlare plan that allows them to use a custom SSL certificate.
  • sublimino 12y ago
    CloudFlare offer free, "flexible" Universal SSL https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl - although it is terminated at their servers and still communicates with the target server via HTTP. This is what I'm using for a simple blog. > Flexible SSL: There is an encrypted connection between your site visitors and CloudFlare, but not from CloudFlare to your server. > You do not need an SSL certificate on your server. > Visitors will see the SSL lock icon in their browser. It can be upgraded to full "strict" SSL all the way to the host with paid plans. This security model obviously comes with some compromises, especially on login forms, as the user has been taught to expect the browser's padlock sign to signal an encrypted connection to the host.