Top all-time · #4175
SSL.com
Company blog · ssl.com/blogssecuritysystems
SSL.com is the company blog at ssl.com, writing about security and systems. Since 2017, 19 different Hacker News readers have linked it 20 times, most often “ECDSA vs. RSA”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers cite SSL.com's articles and guides as references on TLS handshakes, OCSP and revocation, certificate types, and sample revoked and expired certificates for testing.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
SSL.com provides SSL/TLS & digital certificates to secure and encrypt data with our 4096-bit SSL/TLS Certificates, trusted by all popular browsers.
Most-linked posts?
- /certificates/code-signing/buy/2 people · 2 mentions · first linked 2021-06-10
- /article/how-do-browsers-handle-revoked-ssl-tls-certificates/2 people · 2 mentions · first linked 2020-11-27
- ECDSA vs. RSA2 people · 2 mentions · first linked 2018-08-20
- /article/dv-ov-and-ev-certificates/2 people · 2 mentions · first linked 2017-01-10
What Hacker News says?
Chrome doesn't use online OCSP checking, and it's optional in Firefox. Both browsers support OCSP stapling, which doesn't violate privacy and has better failure modes, as well as certificate revocation lists. Because online OCSP checks damage privacy and don't help much with security, browsers are moving away from them: https://www.ssl.com/article/how-do-browsers-handle-revoked-s...
Comment linking /article/how-do-browsers-handle-revoked-ssl-tls-certificates/
on “macOS has checked app signatures online for over 2 years”Submitted How Do Browsers Handle Revoked SSL/TLS Certificates? as a story · 3 points
HN discussion> To put this in context, whenever you connect to a secure website, OCSP is used to make sure the certificate is still valid This is not how any browser implements it today. Browsers either do not check (Chrome, Safari) or check but fail open (Firefox, Edge). I'm not aware of any browser that fails closed in its default configuration. More: https://www.ssl.com/article/how-do-browsers-handle-revoked-s... Browsers pri…
Comment linking /article/how-do-browsers-handle-revoked-ssl-tls-certificates/
on “Apple’s Anti-Tracking Plans for iPhone”Submitted Ecdsa vs. RSA as a story · 2 points
HN discussionSimilar articles for reference: 1. https://www.ssl.com/article/ssl-tls-handshake-overview/ 2. https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... 3. https://hpbn.co/transport-layer-security-tls/ Also note the delay created by each step in (3).
Comment linking /article/ssl-tls-handshake-overview/
on “How HTTPS Handshake Happens”Submitted ECDSA vs. RSA as a story · 2 points
HN discussionACME https://guide.actalis.com/ssl/activation/acme Google https://pki.goog/ SSL.com https://www.ssl.com/blogs/sslcom-supports-acme-protocol-ssl-... ZeroSSL https://zerossl.com/documentation/acme/ I don't actually think Cloudflare runs an ACME Certificate Authority. They just partner with LetsEncrypt? Edit: Looks like they don't run any CA, they just delegate out to a bunch of others https://developers.cloudflare.com…
Comment linking /blogs/sslcom-supports-acme-protocol-ssl-tls-certificate-automation/
on “Upcoming Changes to Let's Encrypt Certificates”Submitted What SSL's Root Migration Means for You – Ssl.com as a story · 1 points
HN discussionOV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for: DNS Name=nytimes.com DNS Name=*.blogs.nytimes.com DNS Name=*.blogs.stg.nytimes.com DNS Name=*.dev.nytimes.com DNS Name=*.nyt.com DNS Name=*.nytimes.com DNS Name=…
Comment linking /article/dv-ov-and-ev-certificates/
on “HTTPS on NYTimes.com”Submitted Current state of TLS session resumption tracking as a story · 1 points
HN discussionhttps://www.ssl.com/article/dv-ov-and-ev-certificates/ There are several types of certificate. The most basic is DV where you only need to upload a file or modify DNS record to prove you own a domain. EV certs used to be visually distinct in browsers but it was shown to not be that useful and in fact counterproductive. The browsers are going in opposite direction: show nothing special for HTTPS, and show red warning…
Comment linking /article/dv-ov-and-ev-certificates/
on “Does my site need HTTPS?”I don't agree that this is a positive development if a resilient worldwide PKI is desired. 1. We have seen how Cloudflare can "break the Internet" due to their position as a SPoF. Let's Encrypt also became a SPoF as their popularity grew. 2. Cloudflare's main service depends on breaking the trust model of TLS, which is to say that users must be assured that they can communicate with a server without the possibility…
Comment linking /products/website-security/tls-ssl/single-domain/free-dv/
on “Building a certificate authority for the whole Internet”Ah it's gone up a bit since I last looked, and you have to hunt around but the base cost seems to be $129: https://www.ssl.com/certificates/code-signing/buy/ That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.) Also, it seems that the LARGE cost for the EV cer…
Comment linking /certificates/code-signing/buy/
on “Lockdown.exe: Block unknown apps via Windows software restriction policy”"Someone had to actively choose to serve content over http in 2026." To be fair, people actively choose to do this every day For example, millions of people actively choose to do this for HTTP-01 ACME challenges https://www.ietf.org/rfc/rfc8555.txt https://letsencrypt.org/docs/challenge-types/ Certificate authorities also actively choose to do this for 1. TLS Certificates For example, http://www.ssl.com/repository/S…
Comment linking /repository/SSLcom-RootCA-ECC-384-R1.crt
on “That's Not How Email Works, HSBC”I am using these now for testing revoked and expired certs: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls...
Comment linking /sample-valid-revoked-and-expired-ssl-tls-certificates/
on “Badssl.com (2017)”I felt the same so I've built https://cert.chief.app . Also had to find another source for revoked test certificates for the homepage examples and found them here: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls... . The badssl ones are expired too which means they are no longer revoked since revocation only lasts the lifetime of the certificates, which makes sense of course.
Comment linking /sample-valid-revoked-and-expired-ssl-tls-certificates/
on “Badssl.com (2017)”well, to be fair, https://zerossl.com/pricing/ has a "free" column :) On the other page, https://zerossl.com/features/acme/ it looks like free acme certificates can have a wildcard records (*.example.com). https://www.sslforfree.com/ claims they use zerossl and support wildcard records. Also, one of others you mentioned also has a free acme option, but without mentioning wildcards: https://www.ssl.com/how-to/order-f…
Comment linking /how-to/order-free-90-day-ssl-tls-certificates-with-acme/
on “Plaintext HTTP in a Modern World”The links you provide do not properly support what you say, imply, or claim. The three links I provide below contradict the claims that are objectively discern-able. The rest is ignored. What I actually said is common knowledge in the field and best practice, more importantly its not just me saying it; it is well known in industry, see [1][2][3]. There is no need for any further correspondence here. [1] https://www.…
Comment linking /blogs/what-is-certificate-pinning/
on “Certificate will expire on 14 March – update Firefox to prevent add-on breakage”Browsers already support certificate based authentication equivalent to SSH key based authentication. In practice, it is difficult to prevent (and impossible to detect) an unauthorized user from misusing the authentication either by stealing the browser certificate or simply using an unattended browser window for unauthorized access. https://www.ssl.com/how-to/configuring-client-authentication... https://medium.com/…
Comment linking /how-to/configuring-client-authentication-certificates-in-web-browsers/
on “Ask HN: Were SSH keys ever considered for browser authentication?”Well, firstly, buying certs is optional. You can distribute via the Microsoft Store and they'll sign for you. That's a $19 one time fee, no subscription. It's by far the cheapest way to distribute signed software on Windows. Conveyor can prepare everything and do the upload for you. So this stuff only applies if you don't want to go via the store. Now you picked DigiCert and their cloud HSM solution. They're unfortu…
Comment linking /certificates/code-signing/buy/
on a deleted thread
