Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by jraedisch | Hacker News Reader

Parent Full thread

jraedisch·

What about using self-signed (and thereby untrusted) certificates?

View on HN

Why do this when letsencrypt.org provides free trusted SSL certs?

There are missing edge cases with this.

Say I want to serve a static HTML website from a Google cloud storage over SSL. No way to do this for free with let's encrypt. 1 click and free with cloud flare.

Is there MITM chance between cloud flare and Google? Yes. For a static website with no login or input from users, seems safer than any free alternative I know of.

Doesn't Google offer a generic domain for you to use, like amazon has s3.amazon.com with some information about your username in the URL or subdomain?

Even if they do, how do you expect to get a valid (i.e. trusted) certificate for an FQDN that ends with ".google.com"?

No you host from your own domain.

https://cloud.google.com/storage/docs/hosting-static-website

Gives you a site at your name.com

Only missing link is the HTTPS which you get with cloud flare

I'd expect they'd use something like star-certs, and give you a heyuser.storagegcd.com

Forgive my ignorance, but what is a "star-cert"?

Oh I think I just used a bit of jargon there. It's canonically called a Wildcard Certificate [0]

[0] https://en.wikipedia.org/wiki/Wildcard_certificate

If CloudFlare pins the certificates then fine, but if it doesn't, you might as well leave the traffic unencrypted.

Reply on news.ycombinator.com