which certification authority

jeffjohn

Which ca do you have success with?
I am using "no-ip" with Abyss X1. When I tried the Verisign and the Thwarte trial certificates, they did not work. Two possible reasons occur to me; firstly that they are not compatible and secondly, as I entered under "Company" a name that probably they won't find registered, does this produce a non-compliant certificate - if so, can I leave this blank?
Have you found any reliable and free ways to get a working ca ?
Thanks Jeffjohn

olly86

It looks like your asking how to get a free SSL certificate certified / signed by a CA, this is not possible. You need to buy an SSL certificate from them.
You can get a cheapish cert from godaddy.com

Moxxnixx

jeffjohn wrote
Have you found any reliable and free ways to get a working ca ?

Check out StartCom Free SSL. They offer free yearly certificates.
Aprelium suggested them several months ago. They work very well.

jeffjohn

Thanks for comments - I tried to use startSSL but the problem seemed to be that you can't register a sub-domain. i.e. myname.co.uk is fine and produces a certificate. but jeff.myname.no-ip.com can not be used. Hence my problem how do you get a cert that is acceptable on the WebServer using a no-ip service?
StartSSL kindly responded to my inquiry so if i get a solution, I'll post it. Unless of course, someone already can tell me!! jeffjohn

jeffjohn

Well i got a reply, but I'm about to give up!!!
QUOTE....
"First of all you have to load the mod_ssl module. Many distributions and packages have this module shipped by default, otherwise check the documentation of Apache how to do this.
To configure a default SSL/TLS aware virtual server, you should add at least the following lines to your httpd.conf or ssl.conf file:
LoadModule ssl_module modules/mod_ssl.so
Listen 443
<VirtualHost _default_:443>
DocumentRoot /home/httpd/private
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile /usr/local/apache/conf/ssl.crt
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key
SSLCertificateChainFile /usr/local/apache/conf/sub.class1.server.ca.crt
SSLCACertificateFile /usr/local/apache/conf/ca.crt
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog /usr/local/apache/logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
Download the ca.crt and sub.class1.server.ca.crt for the above configuration. Make sure to change the path according to your apache installation. For windows you need to use something like c:\apache\httpd."
I feel pretty sure this is not the answer to my question! Any comments?

jeffjohn

ok ...My understanding and progress so far... StartSSL enables an Authorised Signed Cert using a verifiable Domain and e-mail as authentication. However if you are using a dynamic IP address with say "no-ip" their sub-domain addressing format is not acceptable. I
proceeded with the Abyss Request Cert. my domain:myname.co.uk and my e-mail:name @myname.co.uk.
This eventually produces a signed authorised certificate. BUT for the domain supplied. This Cert can be inserted in to the Signed SSL Certificate Abyss Console and switch to HTTPS (443).
Accessing the Server, the Client will get "Unauthorised Site" warnings as the "no-ip" domain name is not recognised. Its origin though is clearly shown as yours. The Browser warning can then be over-ridden by choice, and access enabled. Whether this is an improvement on self-signed certification is a moot point!
I'm hoping someone more knowledgeable can throw more information and light on this subject!

aprelium

jeffjohn,
The instructions they sent you are specific to Apache. If you are using Abyss Web Server, we suggest that you refer to http://www.aprelium.com/abyssws/articles/request-cert-ca.html which provide similar instructions to perform the same action but using the console of our software.
Now, regarding a no-ip.com subdomain, it may be difficult to get a certificate for a subdomain you do not own. So the easiest to do is to register a top level domain name and use it with your no-ip.com account.
Getting a certificate for a top level domain name is not a problem as long as you can prove your identity (this depends on the certification authority but most of them do not care and will just check the domain name whois information and match them with yours).

jeffjohn

Many thanks - that is indeed what I discovered; got the authorised certificate with my top-level domain name and e-mail address. Used that with Abyss and no-ip sub-domains - all works really fine, excepting that Browsers give a warning that CA addresses differ. In Mozilla Firefox a simple 'accept' command appears to work effortlessly and is remembered though IE7 is harder to persuade and WMA music play in Media Player is blocked.

anybody

Moxxnixx wrote

jeffjohn wrote
Have you found any reliable and free ways to get a working ca ?
Check out StartCom Free SSL. They offer free yearly certificates.
Aprelium suggested them several months ago. They work very well.

Yeah, they work only if they are known by the developers of, um, web browsers. I've been there and done that and now I just have to ask, have you tried your site/s in different web browsers lately?
Last time I checked their stuff didn't work with and still doesn't work with Internet Explorer. There is no freakin' way your going to run your own store if their stuff isn't recognized by every web browser out there. I'd seriously want something with allot more guarantee then StartCom.

StartCom wrote
Where, when?
Many software vendors like Mozilla (Firefox) and Apple (Safari) provide built-in support of the StartCom Certification Authority. Sometimes however it's required to import our CA certificate into your browser.

Moxxnixx

anybody wrote
Last time I checked their ~censored~ didn't work with and still doesn't work with Internet Explorer. There is no freakin' way your going to run your own store if their ~censored~ isn't recognized by every web browser out there. I'd seriously want something with allot more guarantee then StartCom.

It is highly advised to purchase a certificate from a reliable certificate authority if you plan to run an ecommerce site.
And no, I didn't test them on different browsers as I have no need for a certificate.
I was just testing the installation process when Aprelium first included the SSL option.

jeffjohn

well moxxnixx, I'm not expressing any favouritism but personally I found StartCom SSL to do everything it claimed; it is a brilliant free service. Are you sure you imported their CA certificate into your IE7 browser??
That said if trading commercially, then of course you would be advised to opt for recognised Verisign etc etc. who will idemnify you.

Moxxnixx

jeffjohn,
I wasn't the one having problems with StartCom. It was the guy above my previous post. ;)

anybody

Moxxnixx wrote

anybody wrote
Last time I checked their ~censored~ didn't work with and still doesn't work with Internet Explorer. There is no freakin' way your going to run your own store if their ~censored~ isn't recognized by every web browser out there. I'd seriously want something with allot more guarantee then StartCom.
It is highly advised to purchase a certificate from a reliable certificate authority if you plan to run an ecommerce site.
And no, I didn't test them on different browsers as I have no need for a certificate.
I was just testing the installation process when Aprelium first included the SSL option.

Your talking to a guru here man... You don't need to explain anything to me...
Why advise anything to anyone that can't give them a 100% guarantee? If all your doing is testing then StartCom is your best choice, after all they do have a free option but free is not always your best choice.
RapidSSL.com is your best choice they are cheap and they work with your common web browsers. The two that concern me the most are Firefox and Internet Explorer. They are the most widely used browsers in the world. That is a 100% guarantee. By the way CubeCart uses RapidSSL if you choose to test it out with different browsers. Another tip for you is RapidSSL is a reseller for GeoTrust and what is funny is how both of them aren't even on the list you found on wikipedia.org. ;-\

jeffjohn

moxxnix - quite correct; my humblest apologies! jeffjohn
too much haste, I guess!

anybody

Yeah, well, free must be your choice considering your asking for help with SSL for abyss x1 and no-ip.com. If you checked out that page on wikipedia.org that Moxxnixx posted you'd see that StartCom is not trusted by internet explorer at all so if this is something more then just testing then your just out of luck with anyone using internet explorer to access your site.

venkat20

olly86 wrote
It looks like your asking how to get a free SSL certificate certified / signed by a CA, this is not possible. You need to buy an SSL certificate from them.
You can get a cheapish cert from godaddy.com

I got SSL Certificate in http://www.tucktail.com/

jeffjohn

Yep- thanks guys , I can see that you are absolutely correct! jeffjohn

anybody

Moxxnixx wrote

jeffjohn wrote
Have you found any reliable and free ways to get a working ca ?
Check out StartCom Free SSL. They offer free yearly certificates.
Aprelium suggested them several months ago. They work very well.

They work only if your browser supports them; Firefox supports them but they do not work with internet explorer.

http://cert.startcom.org/ wrote
Many software vendors like Mozilla (Firefox) and Apple (Safari) provide built-in support of the StartCom Certification Authority. Sometimes however it's required to import our CA certificate into your browser.

like internet explorer.
If your goal is to explore to learn new things then startcom.org is the answer for you. Now if your setting up a professional site that needs a 100% guarantee then startcom.org is not the answer. Your customer isn't going to take the time to install startcom.org's certificate just so it works with their chosen browser internet explorer. You can't do this for them. they have to make the choice on their own to install the certificate so their browser works with your site.