<div dir="ltr">Yes, there should a be a tutorial about start working with SSL, something very very easy to understand. It could be a guideline type of thing about what to expect. And should assume, that the very basic words related to certificates are jargon to the intended reader. <br>
<br>- Basic explanation of what a certificate does<div>- Some alternatives, pro/cons of certificates<br>- A few established providers, who are industry reviewed. </div><div>-A general process of what is the minimum things that should happen (should be based upon experience with the established players) etc. A general flowchart (graph)<br>
<br><br>The point is, most SysAdmin, don't know which point exactly they are missing in this vast field, there is trust at stake, security of more than a handful users is at stake, so a SysAdmin should be spoon-fed everything all over again. I know that sounds a bit excessive, but my main point is that there is a lot of noise, around this topic, that is the main bottleneck for many like me. </div>
<div><div class="gmail_extra"><br><div class="gmail_quote">On 12 January 2014 17:48, Andreas Mirbach <span dir="ltr"><<a href="mailto:a.mirbach@me.com" target="_blank">a.mirbach@me.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto"><div>Ok, i see startssl is a little difficult. But we can't provide a how to for that, i think.</div><div>Because every ca has a slightly different process and every ca already provides a how to optain a certificat in there faqs. If your still in trouble i can help you to understand the startssl process. </div>
<div><br></div><div>@all ahmad pionted out that some ssl starters don't realy know how to retrieve a ssl certificate. I can remember my first try on that. So maybe a section that describs the general process of generating a certificat and signing it by a ca would be very helpfull. What do you say?</div>
<div><br></div><div>Regards Andreas Mirbach<br><br>Sent from my iPad</div><div><div class="h5"><div><br>On 12.01.2014, at 06:56, Ahmad Bilal <<a href="mailto:ahmadbilal200854@gmail.com" target="_blank">ahmadbilal200854@gmail.com</a>> wrote:<br>
<br></div><blockquote type="cite"><div><div dir="ltr">Also, I tried StartSSL at first, but got lost somewhere, and gave up in between. So yes, people like me want to improve, just need the light! :)<div><br></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">
On 12 January 2014 11:25, Ahmad Bilal <span dir="ltr"><<a href="mailto:ahmadbilal200854@gmail.com" target="_blank">ahmadbilal200854@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">thanks Rainer and Andreas. Yes, I was aware that its not that safe to trust Godaddy, but to put it honestly, Learning about SSL/TLS/etc is like starting all over again, after barely learning programming. There is not many guides out there easily searchable. It was just coincidence that I find out about BetterCrypto. <br>
<br>I have read the draft, it has been very helpful.. but my opinion is, if the explanations are a bit more simple, than people will benefit even more from it. As I said above, and its also written in the draft, that weak code written by programmers is a big concern. It should not be assumed, that a programmer would learn coding, and then start to learn about cryptography. Instead ideally, one should learn cryptography and programming together, so that means, that midway, where a person has only grasped intermediate concepts in programming, he should be introduced to cryptography. <br>
<br>That means, in short, that it should be assumed that the SysAdmin (at which this initiative is aimed at) can be average SysAdmin, as well as a well established SysAdmin.<br><br>I might be saying what has been already said, many times.. and I mean no offense to anyone. I'm just resonating, what are my honest feelings about this.<div>
<br></div><div>Thanks a lot, I hope to learn a lot around here. </div></div><div class="gmail_extra"><div><div><br><br><div class="gmail_quote">On 12 January 2014 03:16, Andreas Mirbach <span dir="ltr"><<a href="mailto:a.mirbach@me.com" target="_blank">a.mirbach@me.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div>Even if those certificate authorities have not been hacked, you have to ask yourself "do you thrust these thirth party in your chain". For websites that need to be reached over the internet by unknown clients, you need them. But if you know your clients e.g. your companys computer you can/should use your own CAs. In my opinion there should be a more detailed section about certificate authorities. </div>
<div><br></div><div>Andreas Mirbach<br><br>Sent from my iPad</div><div><div><div><br>On 11.01.2014, at 21:36, Rainer Hoerbe <<a href="mailto:rainer@hoerbe.at" target="_blank">rainer@hoerbe.at</a>> wrote:<br>
<br></div><blockquote type="cite"><div><div>Finden SHA1-collisions requires 2**63 tries (may be a bit less). Faking a certificate this way is quite expensive, there are cheaper ways.</div><div><br></div>No you do not be worried, because the security value of those commercial certificates ist near zero anyway. GoDaddy have been insuniated that they have been hacked in the past. The question is why to pay for a certificate of low value, when you can get the same product elsewhere for free, e.g. Startssl.<div>
<br></div><div>- Rainer</div><div><br><div><div>Am 11.01.2014 um 15:02 schrieb Ahmad Bilal <<a href="mailto:ahmadbilal200854@gmail.com" target="_blank">ahmadbilal200854@gmail.com</a>>:</div><br><blockquote type="cite">
<div dir="ltr">I have a question. I recently bought a certificate from godaddy, and during the installation I chose SHA-2, but the Certificate Signing Request in raw form has SHA-1 written on it, and not SHA-2. Should I be worried?<br>
<br><br clear="all"><div><br></div>-- <br><div dir="ltr"><i><b><font face="arial, helvetica, sans-serif">Ahmad Bilal</font></b></i><div><br></div></div>
</div>
_______________________________________________<br>Ach mailing list<br><a href="mailto:Ach@lists.cert.at" target="_blank">Ach@lists.cert.at</a><br><a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" target="_blank">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br>
</blockquote></div><br></div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Ach mailing list</span><br><span><a href="mailto:Ach@lists.cert.at" target="_blank">Ach@lists.cert.at</a></span><br>
<span><a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" target="_blank">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a></span><br></div></blockquote></div></div></div></blockquote></div><br><br clear="all">
<div><br></div></div></div><span><font color="#888888">-- <br><div dir="ltr"><i><b><font face="arial, helvetica, sans-serif">Ahmad Bilal</font></b></i><div><br></div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><i><b><font face="arial, helvetica, sans-serif">Ahmad Bilal</font></b></i><div><br></div></div>
</div>
</div></blockquote></div></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><i><b><font face="arial, helvetica, sans-serif">Ahmad Bilal</font></b></i><div><br></div></div>
</div></div></div>