1

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server.

If I want to buy a https certificate I think the fee is something like $25 per year per domain. It's a little prohibitive given the nature of the sites.

I don't care about having a 3rd party verify that I'm me. The websites are benign content and I don't ask for any information back from the user. I just want an encrypted connection.

Is there a way for me to set things up so the browser communicates over ssl without giving the uer a scary "identity of server not confirmed" warning?

4

... set things up so the browser communicates over ssl without giving the user a scary "identity of server not confirmed" warning?

Authentication of the server is done to make sure that the communication is done with the expected server instead of some attacker trying to impersonate the server. It is necessary to protect against active man in the middle attacks where the attacker could decrypt and even modify the traffic.

Authentication of the server is thus essential to provide the protection SSL is promising, encryption without authentication is not sufficient. That's why browsers will complain if the certificate can not be properly verified, for example because the issuer of the certificate is not trusted as in case of self-signed certificates or attacks. It would be very bad if the server could just disable this verification since an attacker could then do this too.

If I want to buy a https certificate I think the fee is something like $25 per year per domain.

Since several years it is no longer necessary to actually buy a certificate since there are CA which offer these for free - most prominently Let's Encrypt which started two years ago. Several hosting providers even integrate such free certificates already in their offerings for free and with trivial setup or at least provide instructions on how to setup these certificates yourself. If your hosting provider makes it too hard to use such free certificates you should maybe switch the provider.

  • 1
    Yup, let's encrypt is the solution, and my provider supports it. Thank you! – JoshuaD Dec 16 '18 at 14:09
3

Use lets encrypt to get free SSL certificate.

  • While addressing a wrong claim in the question about the costs of a certificate it does not answer the actual question which is about "Encrypt but not verify sender". It should thus be added as a comment to the question but not as an answer. – Steffen Ullrich Dec 16 '18 at 6:02
  • I thought browser trust LetsEncrypt issued certificate? And it will get rid of the scary warning that OP wanted to solve. Technically speaking letsencrypt can also be used by attacker to do phishing, is that what you mean? In that case, we need to leverage OCSP transparency. But I don't think OP need that from what he is describing. That can save you even if CA is compromised. – Timothy Leung Dec 16 '18 at 7:26
  • "I thought browser trust LetsEncrypt issued certificate?" - correct, but because the browser can properly validate the certificate. The OP is specifically asking about encryption without such validation because he had no idea that free certificates are possible. Again, you correctly address the wrong assumption that certificates cost money but you don't address the question on how to encrypt without verifying the certificate. At the end you point the OP in the correct direction but you don't say that the direction he asked for would not work anyway and would even be dangerous to go. – Steffen Ullrich Dec 16 '18 at 7:31
  • @steffenullrich it is an ab question. The op wants a free SSL certificate. – trognanders Dec 16 '18 at 19:48

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.