Hacker News Reader

Comment by jrockway | Hacker News Reader

This is why I have my own CA. Too bad the router manufacturers don't do the same; let the router generate a key-signing request, paste it into the manufacturer's site (with a "real" SSL cert), download file suitable for providing to the router, enjoy secure VPN.

Oh yeah, but that would add like fifty cents to the cost of every $150 VPN router, and we can't have that!

View on HN

Fifty cents and another ten dollars or more to deal with the extra tech support.

When you unpack and plug-in a router, it automatically gets the current time without any tech support. Why not get an SSL cert too?

That works, but unless the router manufacturer has a sub-CA of a CA present in all browsers, the above "extra tech support" is very true. And those sub-CAs are expensive.

Cisco can probably afford it.

But remember, we're only talking about SSL-based VPN boxes here. Joe Average does not buy these, and the people that do are willing to pay; handling more than one connection does require some not-tiny hardware. (I have a Soekris router, and Gigabit Ethernet makes pf max-out the CPU at around 300Mbps. OpenVPN... sooner. And this thing was $300. :)

Maybe it'd be a one time fee for somebody like Cisco that can afford the intermediate CA process, but I've looked into this for my own company and there's no way we can afford this. Nor is there any affordable option to prepurchase device certificates that I can find. If anybody actually has an idea on how to ship devices with unique certificates signed by a CA accepted by the majority of browsers, I'd love to hear it.

Reply on news.ycombinator.com