# Why Does this Website Generate SSL Warnings?

**Update:** Some of the information below is out of date. As of 2011-Jan-23 I
have replaced my free [CAcert](https://www.cacert.org/) certificate with a free
[StartCom](https://www.startssl.com/) certificate which has much more browser
coverage. Every time I posted a link to my blog I was getting more comments
about the SSL setup than the article I was posting about.

I've been asked a few times recently why this website has started generating
<abbr title="Secure Socket Layer">SSL</abbr> certificate warnings. People
mistakenly think that my setup is broken in someway, that I've made some sort of
mistake and that my website is somehow insecure because of it. However, my SSL
setup is the way it is by design.

In the past, I used [RapidSSL](https://www.rapidssl.com/) for my certificates as
they were reasonably cheap. It bothered me that I had to pay anything for SSL
certificates though. It doesn't cost anything to generate one; just a few cpu
cycles. The cost is to cover the fact that they have to "validate" that you own
the domain you're buying the certificate for. Well nowadays the validation
pretty much comprises of sending an email to an admin email address, and maybe
making an automated phone call. How much does that cost? A fraction of a penny?
And yet they charge ridiculous fees... 50 dollars or more per year is not an
unusual price. The infrastructure required to run a <abbr title="Certificate
Authority">CA</abbr> with automated validation, isn't difficult to build; I'm
sure I could put one together in a weekend.

So back to my website. People assume that my certificate is "self signed" when
they see the warning. This is not the case. My certificate is signed by
[CAcert](https://www.cacert.org/). They're just like any of the other CAs except
that they're a none profit organisation, their certificates are free, and their
root isn't in your browser yet. Their "none <abbr title="Extended
Validation">EV</abbr>" validation is just as comprehensive as any of the other
CAs. If you want to manually install the CAcert root certificate, just go to
[this page](https://www.cacert.org/index.php?id=3) and select the appropriate
link for your browser/OS. Then my site, and any other site using CAcert, wont
generate these warnings for you anymore.

I would expect most people aren't interested in installing SSL root certificates
manually and that's fair enough. The beauty of my setup is that you get to
manually decide whether or not you trust the certificate, rather than having a
CA do it for you. Even if you don't trust the certificate, what's the harm in
continuing anyway if you're not going to be posting personal information or
login credentials? That's your call to make. I'm a pragmatist though, so if this
website was anything other than a technical blog for geeks to read, I would
still be using a certificate signed by one of the CAs in your browser. I know
that in general people don't like these warning messages and think something
iffy is going on when they see them. My audience should be tech-savvy enough to
understand what is going on when they see the warning when visiting my website
though.

EV certificates are an entirely different matter. I have no problem with them
costing more money. EV certificates exist to prove to the user that they aren't
just talking to the domain they think they're talking to, but that they're also
talking to the correct company. This level of validation obviously costs more
money.

My hope is that one day I will be able to publish a fingerprint of my SSL
certificate in the DNS, secured by DNSSEC, and that would be enough to prove to
your browser that the correct certificate is being used. People who want to use
a CA to vouch for their cert are welcome to do so, but those of us who want to
"self vouch" for free, would also have that option. This would even be useful
for people with certificates signed by one of the CAs in your browser; at the
moment, hundreds of CAs can generate valid certificates for their domain, but
with the additional DNS check, the user would know that the certificate was
vouched for by a known CA **and** the person running the domain.

[StartSSL](https://startssl.com/) was mentioned to me because they offer some
free certificates, but also have their root in some browsers. I was going to try
them out but I was put off when I tried to log in using Firefox, was redirected
to [https://auth.startssl.com/](https://www.wikipedia.org/wiki/StartCom), and
was shown the following error message: "An error occurred during a connection to
auth.startssl.com. SSL peer was unable to negotiate an acceptable set of
security parameters." If they can't make SSL work on their own website for
Firefox users, why should I have any confidence in them? I also tried connecting
using openssl from a [Debian](https://debian.org/) box without luck.