4

My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. I'm guessing the trust you're getting is a way to show you're not a phishing website or something (even though I've seen very convincing SSL certificates on phishing websites).

Anyway, I have an API which just needs encrypted communication between a client and web server. I don't need the trust factor that $200-per-year certificates offer, because users aren't even using a web browser to use my API - they're using some code they've written themselves and the URL is hard-coded into their applications.

Unfortunately working with SSL certificates is tricky for most new developers (whom will be using my API) if the certificate is self-signed. Most programming frameworks will throw an exception if the untrusted certificate isn't imported, etc. It's too annoying and will drive developers away from my service. However, not encrypting traffic is just not an option.

All I need is for web traffic to be encrypted and for developers who use my API to not have to jump through hoops. The mechanism for doing encryption is free and open source, and I don't want to have to buy added 3-rd party "trust".

TLDR / Conclusion: Is there any way to generate a free SSL certificate that will be trusted by most programming frameworks? OR, are there any other options for secure communication over HTTP without a purchased SSL certificate?

Improve this question
4
  • Here's the problem: encrypted to whom? What good is scrambling your message to avoid eavesdroppers when you don't have a way to confirm who you're actually sending the message to? Maybe you're just encrypting it to the eavesdropper! If not encrypting your traffic is not an option, then neither is not verifying the recipient, full stop.
    – Stephen Touset
    Mar 28, 2014 at 6:54
  • @StephenTouset Wouldn't an eavesdropper have to solve some type of near-impossible discrete logarithm problem to listen to open communication? If an Eavesdropper initiates communication with my server, that's ok because it requires authentication.
    – JSideris
    Mar 28, 2014 at 18:44
  • What stops me from sitting in-between traffic from a client and your server, and pretending to be your server?
    – Stephen Touset
    Mar 28, 2014 at 20:46
  • There are many possible solutions here, but my API is for commercial purposes (so StartSSL isn't an option), and other free ones I've seen aren't trusted. For now, I've decided to go with the lean approach to the API - I'll start it off unencrypted (unless people want to use the self-signed certificate) and buy an SSL certificate as soon as someone starts paying to use it.
    – JSideris
    Mar 29, 2014 at 5:33

5 Answers 5

Reset to default
0

no, it's not possible for free because the trust-chain can't be established.

Your visitors may have access to some CA's by default, because those CA's have made investments to establish themselves as root CA's in the most common browsers/operating systems (or made it) etc. Without there being a free one you can't establish a free trust-chain, so a visitor can't verify anything you're providing isn't a lie.

edit: Scott Helme's link wasn't one I was aware of. Looks like for some purposes there may indeed be a free method: https://startssl.com/?app=40 I can't see the details on what CA key they're using / the browsers it appears in, but assume it's there.

Improve this answer
10

You can try StartSSL who will issue you a free SSL certificate that will be trusted. I use one of their certificates on my blog and yes, it really is free. Their site doesn't have the best user interface admittedly, but if you can live with that, this sounds like your best option.

Improve this answer
3
  • 4
    +1 for StartSSL. Their SSL certificates are free for noncommercial use, otherwise you have to pay a reasonably small fee (individuals: 60$ to validate identity, after that you can get a certificate that's valid for two years; twice as much if you want to get the cert for a company). For this fee, you will among other things wildcard certificates and code signing. Their customer service is also very responsive. The website may seem odd at first, but it's easy to get used to it.
    – Rob W
    Mar 28, 2014 at 8:24
  • StartSSL, however, does charge for revoking a certificate, which costs $25. And unfortunately, they require revoking a certificate before allowing you to create a new one…
    – Debilski
    Apr 11, 2014 at 19:19
  • As everyone is now realising after the Heartbleed bug. Still, the chances of you having to revoke are normally pretty slim. Best to only have a small chance of needing to pay than to always have to pay!
    – Scott Helme
    Apr 12, 2014 at 14:14
0

There aren't a lot of options here once self signed certs are out of the mix. But check out cacert.org I've heard (some) positive things about it. It's mission seems to fit your use case, it's certainly not a high quality, high trust cert, but it may well meet your needs.

Improve this answer
0

Sorry, but what you're asking for isn't possible. You can only have two out of three: Free as in beer, zero hassle, or security. It is possible to not pay for a certificate and have a no-hassle solution, but the drawback is obvious. Of course you can also pay up for a certificate, and users can easily use our website/service, but you'd be out a few beers.

There is a way to keep your money and encrypt your connections. The basic idea is to use OpenSSL to generate a certificate, use that on your web service, and send the public key to your users. They will have to install it in their browsers. But this method can be a hassle, especially if you expect to have a lot of users, or if you don't have some other secure channel for sending data to them in advance.

Improve this answer
0

There is a 'free' SSL initiative called CA Cert.

Unfortunately not many (popular) OS's or browsers come with it's root CA installed per default, but it is easy to install for your end-users. See here for more info: http://wiki.cacert.org/InclusionStatus

Depending on your needs you must be 'assured' by some other members of CA Cert. Please look here for more info on what you could do (and not) with certain assurance status: http://wiki.cacert.org/FAQ/Privileges

This assurance process makes this CA maybe even more secure and trusted then other CA's, which in general do nothing more then a check on your domain's whois info or something like that. Unfortunately it does not have the funding to get a proper audit (at least I can see all initiatives for an audit where not updated since 2010 or so), which weakens the whole trust in this CA a bit.

I think it is secure enough for the thing you want to do with it. Please do not forget to check your SSL configuration (when publicly avaiable) with the SSLLabs website from Qualys. This scans for common SSL configuration errors, which is at least as important as not using self-signed certificates.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .