Hacker News Reader

Comment by __alexs | Hacker News Reader

> I'm in the process of moving any Saas offerings I use off USA-affiliated companies, but it's actually more difficult than I first thought.

You should try finding a SSL cert retailer that's outside of the US. The only ones I could find that would actually sell me certs without a phone call charged at least $200 for a basic certificate. https://swisssign.com/en were the most sensible looking ones I could find.

View on HN

This part doesn't matter. Where your cert comes from is irrelevant.

It has implications for certificate pinning (like that used in Chrome) if you can only pin to CAs that operate in a single regulatory domain.

Indeed, I hadn't considered that.

Though, if you are pinning in an app and not just in-browser, you can bundle your internal CA cert in the binary and sidestep the whole mess.

This is what I advise my customers that have security-sensitive stuff do. The PKI can no longer be trusted.

"No longer"? It could never be trusted, and many of us said so when it was first introduced. It's just taken a while for everyone else to realise that we were right.

There's StartCom (StartSSL) from Israel. Have you tried them? They even offer free SSL certs, by the way.

They are from Israel, a good friend of the US, and for free. What part of that does not scream 'run for the hills' exactly?

Lulzily, a browser trusted CA can actually fuck a customer of that CA slightly less than a non-customer, since you'd at least be vaguely aware of multiple certs issued for the same site from the same CA with different keys (maybe). No one would know if Iran were using a pet CA to go after specific users going to sites which normally used a cert from another CA.

from what I know you never give your private key away, they just sign your public one. so that would be irrelevant.

Reply on news.ycombinator.com