Hacker News Reader

Comment by Alupis | Hacker News Reader

This is about to become a massive issue for Godaddy SSL users[1] seeing that Godaddy has still not added their G2 CA server (which signs all SHA-2 certs at Godaddy) to the default truststore for Java and some other devices/languages/platforms!

[1] http://stackoverflow.com/questions/18746565/godaddy-ssl-cert...

View on HN

Excellent; this should be another reason for some people to no longer be a client of one of the worst companies in the tech sector today.

I'll leave CA recommendations to those who deal with them more than I, but if you use Godaddy as a registrar I would urge you to switch to Gandi.net (or namecheap.com if you cannot afford Gandi).

I second this. It's an excellent reason to switch away from GoDaddy!

gandi.net, namecheap.com are both good alternatives.

Note that Gandi do not offer SHA-2 certificates at all at the moment.

https://twitter.com/gandibar/status/508001036653826049

Google is a decent registrar now that I've moved some domains to them... although I don't know if they offer SSL yet directly, I think they recommend a few 3rd parties though.

Google is only available in the US.

There is a cross certificate at https://certs.godaddy.com/anonymous/repository.pki (click on "GoDaddy G1 to G2 Cross Certificate")

If the G2 CA is signed by their other CAs which are in the trust root, you can just add it to the chain you're serving, right?

mappu no, G2 is it's own root, but there are ways to get it to work -- but it's rather impractical for deployed applications to public users, etc. They expect it to "just work". So, as the post mentions... the current only work-around is to get a SHA-1 cert from Godaddy's Class 2 CA server (which sings all SHA-1 certs).

I really think people need to dog on Godaddy more about this. It's not really excusable to be a half-assed CA today...

Reply on news.ycombinator.com