Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by derefr on Tuesday September 08, 2015 @02:37PM
(#10187447)
I'm surprised there's no "CA-tool-as-a-service" where the CA provides an API (and maybe a CLI tool that uses that API) allowing you to automatically request-and-generate certs from their CA server provided it's for a subdomain of a domain you have on your account.
Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by evanosaurus on Tuesday September 08, 2015 @04:11PM
(#10187947)
That's essentially what Let's Encrypt aims to be: https://letsencrypt.org/
Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by fanf2 on Wednesday September 09, 2015 @06:04AM
(#10190589)
Have a look at the "certificate" section of Gandi's API https://github.com/Gandi/gandi.cli/blob/master/gandicli.man....
And check out SSLmate https://sslmate.com/
Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by Daviey on Tuesday September 08, 2015 @06:38PM
(#10188594)
Check out OpenStack's Anchor project, it is exactly this.
If the people behind the post used anchor, then the issues mentioned here would be absolved.
Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by nailer on Tuesday September 08, 2015 @07:17PM
(#10188761)
Nearly every CA has an API already, you can add automated Domain validation yourself over a weekend.
Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by aexaey on Tuesday September 08, 2015 @03:36PM
(#10187735)
Typical way to tackle sub-domains would be to issue a wildcard certificate.
Re:Sslip.io: A Valid SSL Certificate for Every IP Address
by derefr on Tuesday September 08, 2015 @03:48PM
(#10187815)
This would be for subdomains with their own "sovereignty"; e.g. Tumblr or Wordpress blogs, where the subdomain "owner" could conceivably want to issue their own subdomains, or, heaven forbid, do client-cert signing for their subdomain.
> If you have a test domain you can stick it on CloudFlare and get a certificate for free without the private part becoming public.
It all comes down to the fact that CA's don't want you to sign your own certificates, even when it's one of your subdomains unless you pay the big bucks. Best thing to do it still to create your own CA and sign certs for these kinds of things since it's meant for testing and development anyway. It's not that hard, anyone can use some command line can do it.