undefined | Better HN

0 pointsbelorn10mo ago0 comments

to quote the article (or rather, the 2023 article which is the one mentioning the number 3).

"Somehow, a couple of weeks ago, I found this other site which claimed to be better than LE and which used relatively simple HTTP requests without a bunch of funny data types."

"This is when the fine print finally appeared. This service only lets you mint 90 day certificates on the free tier. Also, you can only do three of them. Then you're done. 270 days for one domain or 3 domains for 90 days, and then you're screwed. Isn't that great? "

She don't mention what this "other site" is.

0 comments

jchw10mo ago

FWIW, it is ZeroSSL. I want there to be more major ACME providers than just LE, but I'm not sure about ZeroSSL, personally. It seems to have the same parent company as IdenTrust (HID Global Corporation). Probably a step up from Honest Achmed but recently I recall people complaining that their EV code signing certificates were not actually trusted by Windows which is... Interesting.

killjoywashere10mo ago

IdenTrust participates in the US Federal PKI ecosystem, so they likely have strong incentives to charge exorbitantly. Those free certs are probably meant to facilitate development of gov-specific capabilities by random subcontractors long enough to figure out how to structure a contract mod that passes the anticipated cost onto the government.

Don’t hate the player, hate the game.

AStonesThrow10mo ago

> Honest Achmed

I had to stop and Google that, wondering if it was a pastiche of “Akbar & Jeff’s Certificate Hut”...

https://bugzilla.mozilla.org/show_bug.cgi?id=647959

jchw10mo ago

I'm glad to give you an xkcd 1053 moment. Honest Achmed is one for the books.

arccy10mo ago

Google's CA offers them for free via ACME https://pki.goog/

jchw10mo ago

That's pretty cool, though it does seem that you need to authenticate with a GCP account. A little bit less convenient. I do think there are actually a few other providers of ACME out there that require registration beforehand, ZeroSSL actually offers it without pre-registration like Let's Encrypt.

birktj10mo ago

Buypass provides ACME certificates as well [1]. The usage limits are not quite as generous as LE, but they work pretty well in my experience.

[1] https://www.buypass.com/products/tls-ssl-certificates/read-m...

rmetzler10mo ago

A while ago I saw that acme.sh now uses ZeroSSL by default.

https://github.com/acmesh-official/acme.sh/blob/42bbd1b44af4...

_hyn310mo ago

"We now have another confirmation on Twitter that remote code is executed and a glimpse into what the script is... it appears to be benign."

https://github.com/acmesh-official/acme.sh/issues/4659

It was not. Don't use acme.sh.

1 more reply

nickf10mo ago

ZeroSSL is owned by Identrust, but the infra is operated by another CA. Also Microsoft killed EV codesigning early last year - not stopping it working, just making it identical to ‘normal’ codesigning certs.

mkup10mo ago

Could you please provide more info on this topic, e.g. a link? I intended to buy EV code signing certificate as a sole proprietor to fix long-standing problem with my software when Windows Defender pops up every time I release a new version. Is EV code signing certificate no longer a viable solution to this problem? Is there no longer a difference between EV and non-EV code signing certificate?

2 more replies

j / k navigate · click thread line to collapse