SSL Security Certificate

Wow,
Thanks Jeff, for all the great information.
I really aprereciate it.

I was surprised to see that security software such as SSL had security problems, but on the other hand even software you pay good money for have security holes. Guess that's just the nature of writing thousands of lines of code.

Thanks again for your help -Jason
 
Thank you, Jason...

I'm going to tell you my secret <smile>...

Years ago I sold my share of a small hosting company, and started a new one. I rented a Cobalt RaQ2 (it was a while ago :) ).

I knew a lot about Linux then (I know even more now) but didn't know anything about the Cobalt RaQ gui interface, so I joined the Cobalt mailing list.

Soon I became the "one eyed king in the valley of the blind" and started helping other people on the list; it seemed that with my background in Unix and Linux, learning the Cobalt interface was a piece of cake.

And now my business is 90% supporting other hosting companies with products and services) and 10% hosting customers myself.

I've never advertised my business. I just work hard to be as helpful as I can on the mailing list, and people read the list, and when they need work done, they call on me :) .

So I've decided to be as helpful as I can be on this forum as well :) .

Jeff
 
Great idea Jeff, and also very thoghtful of you.
I have also found that you tend to learn more and faster when you teach others. So it's a win win situation and if you can get some work from it then it pays off double.
I will also do my best to cotrubute on this forum and hope many others will do the same.

Have a nice day -Jason :D
 
RadioShack

Can you please tell me how I can get a cert from Radio Shack?

Thanks
 
radio shack???? you may find they dont sell em ;)

rackshack.net homepage on the right :D
 
The Prohacker said:
https://provos.modernhosting.net

I installed a geotrust cert on that server that was bought from RS..
:D
Click to expand...

I know this is an older post but I just bought a $25 Rackshack GeoTrust cert to go on my site (https://www.artronix.biz). However, when you access my secure site there is a popup security alert that states that the CA Root Certificate is not trusted. I didn't get this when I visited your secure site. Any suggestions on how to solve this?
I contacted Rackshack but they basically said that for that price they could not provide support. I have also contacted GeoTrust and am awaiting their reply.
Thanks.
Craig
 
Arkansas said:
I contacted Rackshack but they basically said that for that price they could not provide support.
Click to expand...

Make sure you have set it up correctly first, once you are sure speak to RS ant tell them its THEIR problem and they need to get it sorted. Good price or bad price the cert should not be issued by yourself and you should have no warning pop-up like that.

Make sure you get it fixed through RS, they are the ones that will be able to help you :)

Chris
 
A rackshack cert only does a basic domain check before giving you a cert. This is enough to protect a control panel, but is not recommended imo to protect a secure order form or a shopping cart.

The pricier certs will check that you have a registered business and some even offer a warranty that covers your transaction.
 
First of all, let it be known that I neither use nor recommend RackShack certs, but mostly because I resell someone else's :) and have been for several years.

Second let me point out my point of view about the guarantee and the so-called "registered business" you write about...

I, too, used to buy certs from one of the big guys (in fact from Verisign, and they certainly weren't cheap).

But let's consider the certs we buy... we either buy certs for ourselves or for our customers.

If we're buying a cert for ourselves we know if we're in business or not; we don't have to prove it to anyone.

And the guarantee doesn't protect us at all; it protects our customer under one very limited circumstance (please read the fine print and you'll see what I mean)...

The guarantee on the cert we buy only protects our customer if we're NOT who we say we are. In other words, if I say I'm (for example only) DirectAdmin, and I get a cert in DirectAdmin's name, and put that cert on an imitation DirectAdmin website, and somehow manage to trick DirectAdmin customers into logging into myseite, and I take money from them under false pretenses, then whoever I took money from will have the money refunded to them under the guarantee.

BUT... and it's a very important but...

If I buy a cert with a $100,000 guarantee, and someone else spoofs my domain and buys a cheap cert without a warranty to protect it... my customer doesn't get anything from the issuer of that cert (because there was no warranty), or the issuer of my cert (because my cert wasn't involved in the transaction).

So no matter how much extra I pay for a cert, my customer gets nothing as long as they end up on my website and I fill my promises. In fact, since the warranty is only that I am who I say I am, there's no benefit to either me or to my customer no matter how high a guaranty I have on the cert I buy.

When I buy a cert for my client, presumably I know they're a business, because I'm doing business with them.

If you really need to know if your client is a real business or not (and remember you don't have to be a business to buy a cert), you should have them pay you by a company check. Presumably if they have a company check they've been able to prove to their bank that they're a business.

The important thing is to make sure that the person who buys the cert for a given website actually has control over that website; we check whois records to see who owns the website, and we contact them at the address listed in the whois record, and wait until we get a reply, before we order the cert for our client.

The vendor who I resell offers certs at different prices, with and without warranty, and no one has ever bought a cert with a warranty from us.
Note that I am not a lawyer, and I recommend you read the warranty carefullly yourself and have your attorney review it, before you decide if it's worth extra money to your company to buy a cert with a warranty.

Jeff
 
I'll try to answer bit by bit
jlasman said:
If we're buying a cert for ourselves we know if we're in business or not; we don't have to prove it to anyone.
Click to expand...

In this case we could just use a self-signed certificate, right? It has the same strength, but is not validated by a third party.
 
The only reason to not use a self-signed cert is that your visitor will see a warning that the cert is self-signed.

Most people don't understand warnings so they'd be confused.

Most people have no idea the purpose of a cert is to validate identity; they presume it's to protect data privacy.

(Actually it does both but the original point of it was to validate identity.)

Jeff
 
jlasman said:
The guarantee on the cert we buy only protects our customer if we're NOT who we say we are. In other words, if I say I'm (for example only) DirectAdmin, and I get a cert in DirectAdmin's name, and put that cert on an imitation DirectAdmin website, and somehow manage to trick DirectAdmin customers into logging into myseite, and I take money from them under false pretenses, then whoever I took money from will have the money refunded to them under the guarantee.
Click to expand...

Exactly, so a consumer whos sees a warranty will feel safe, because if the site is bogus, he will get his money back.

One point for warranties ;)


jlasman said:
If I buy a cert with a $100,000 guarantee, and someone else spoofs my domain and buys a cheap cert without a warranty to protect it... my customer doesn't get anything from the issuer of that cert (because there was no warranty), or the issuer of my cert (because my cert wasn't involved in the transaction).
Click to expand...

If our website has a warranty and if we educate users to only trust websites that get certificates from companies that actually verify the identities, then there is no problem with a spoof domain. There is no way they will get the cert with warranty.

Another point for warranties.
 
jlasman said:
When I buy a cert for my client, presumably I know they're a business, because I'm doing business with them.

If you really need to know if your client is a real business or not (and remember you don't have to be a business to buy a cert), you should have them pay you by a company check. Presumably if they have a company check they've been able to prove to their bank that they're a business.

The important thing is to make sure that the person who buys the cert for a given website actually has control over that website; we check whois records to see who owns the website, and we contact them at the address listed in the whois record, and wait until we get a reply, before we order the cert for our client.
Click to expand...

Actually I don't do all those checkings. If the customer wants a cert with warranty, then my cert provider does all the checking for me. If my customer wants the basic cert, then he will get one as long as he doesn't sell anything on the web with it. Premium certs are not only about security and warranty, but also about marketing imo.
 
jlasman said:
The only reason to not use a self-signed cert is that your visitor will see a warning that the cert is self-signed.

Most people don't understand warnings so they'd be confused.

Most people have no idea the purpose of a cert is to validate identity; they presume it's to protect data privacy.

(Actually it does both but the original point of it was to validate identity.)

Jeff
Click to expand...

I didn't understand you then. If you deal with unknown customers from the web, they probably don't know much about you.

I'm always talking about Premium certs for e-commerce or such, not to secure a cp.
 
Hello,

Great news. This evening a client asked me about CARootCertificates in DA... so I decided to quickly have a look. It was quite simple to add, so it's already coded and will be available for 1.197 :D:D I've tested it with this server temporarily, and woohoo! no popup! :D

For all SSL people, you just need to add:
carootcert=/full/path/to/carootcert

in your directadmin.conf file. You can probably do it now, then it will be instantly active when DA is updated (assuming you use ssl :))

John
 
interfasys said:
Exactly, so a consumer whos sees a warranty will feel safe, because if the site is bogus, he will get his money back.
Click to expand...
Sounds reasonable...

But how does the end customer (your site's customer) know about the warranty? S/he knows about it because there's a seal on the site.

While every forgery I've seen so far is an exact copy of the original site, including any images. Including any warranty seal images.

The forger can even forge an active site seal; that's one that in real time will verify the referrring site is who you think it is.

If our website has a warranty and if we educate users to only trust websites that get certificates from companies that actually verify the identities, then there is no problem with a spoof domain.
Click to expand...
You're writing about educating casual visitors to your site, and to your client's sites. How do you educate them to click on their browser certificate icon? eBay and PayPal have been trying for years, and their sites are (by my experience anyway) the most spoofed on the Internet.

There is no way they will get the cert with warranty.
Click to expand...

They don't need to. The site visitor overwhelmingly doesn't know about warranties.

And in my experience they don't care. I first asked this question for a column I wrote years ago. Everyone polled said the purpose of a cert was to encrypt data; no one (without exception) said it was to assure identity.

Today perhaps there'd be a few.

Yet our experience in selling certs is that only one client has bought a "name-brand" cert; a Credit Union (that's a form of bank, for those of you outside of the US who may not understand the term).

Believe me I'd love to sell certs with warranties; we make significantly more when we do :) . But clients don't seem to think the warranties are valuable.

This is going to be my last post on this subject; it's quite off-topic for this forum.

Jeff
 
You must log in or register to reply here.
Back
Top