Hi, I'm getting increasingly paranoid. Something I said on a certain social media site several months ago was modified - then reported - then by account was banned until I agreed to delete it. Obviously since what I said was modified I didn't have any issue with deleting it but I want more than just DKIM sigs on my e-mail now. Anyway looking for S/MIME I can use to sign and/or encrypt but mostly sign. Not interested in GnuPG or self-signed S/MIME - I want something that can be trusted because someone else that is trusted actually vouched for me. The "free for personal" S/MIME from Comodo didn't work. Browser said it did but there was nothing to export for me to then import. I suspect it is because I used private browser window, I really don't like the idea of a private key stored in browser anyway. And it never asked for a password to encrypt the private key, nor let me specify key strength (only let me choose between medium and high - I assume high is 4096 but I don't know, it didn't say) Didn't like the "browser generated" process, even if it had worked and generated the final product I could export - I really didn't like the process and have serious questions about the wisdom of a private key without a pass phrase stored in an application that interacts with web sites. Anyway so used openssl to create private key (with aes-256 encryption and pass phrase) and then a CSR. But I can't find anyone who sells certs for S/MIME to send the CSR too. Globalsign but they wanted $89 - no one else. Found a few sites that offered to "send me a quote" that I think were intended for corporate accounts. Where do regular users who just want an inexpensive certificate usable for S/MIME from a CSR generated the traditional way go to buy a cert? -=- Off Topic 2 I'm going to strangle whoever it is at Google that thinks it is a good idea to put so many video results at the top of search results for this kind of thing. I'm really getting sick of how highly ranked videos now are in search engines.
> Am 25.11.2018 um 14:35 schrieb Alice Wonder <alice at domblogger.net>: > > Hi, I'm getting increasingly paranoid. > > Something I said on a certain social media site several months ago was modified - then reported - then by account was banned until I agreed to delete it. > > Obviously since what I said was modified I didn't have any issue with deleting it but I want more than just DKIM sigs on my e-mail now. > > Anyway looking for S/MIME I can use to sign and/or encrypt but mostly sign. Not interested in GnuPG or self-signed S/MIME - I want something that can be trusted because someone else that is trusted actually vouched for me. > > The "free for personal" S/MIME from Comodo didn't work. Browser said it did but there was nothing to export for me to then import. I suspect it is because I used private browser window, I really don't like the idea of a private key stored in browser anyway. And it never asked for a password to encrypt the private key, nor let me specify key strength (only let me choose between medium and high - I assume high is 4096 but I don't know, it didn't say) > > Didn't like the "browser generated" process, even if it had worked and generated the final product I could export - I really didn't like the process and have serious questions about the wisdom of a private key without a pass phrase stored in an application that interacts with web sites. > > Anyway so used openssl to create private key (with aes-256 encryption and pass phrase) and then a CSR. > > But I can't find anyone who sells certs for S/MIME to send the CSR too. > > Globalsign but they wanted $89 - no one else. > > Found a few sites that offered to "send me a quote" that I think were intended for corporate accounts. > > Where do regular users who just want an inexpensive certificate usable for S/MIME from a CSR generated the traditional way go to buy a cert? > > -=- > > Off Topic 2 > > I'm going to strangle whoever it is at Google that thinks it is a good idea to put so many video results at the top of search results for this kind of thing. I'm really getting sick of how highly ranked videos now are in search engines. > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centosGood question. Usually, these are more targeted towards businesses, ordering a number of client-certificates (not just one or two). Do you have a business (your website looks like a business)? Here in Switzerland, we use QuoVadis for these certificates (and the normal ones). I?m not sure if they provide service to US citizens. I suggest you consider subscribing to ProtonMail, if nothing else comes forwards. They?ve got a ?2 years for 1? special up for another couple of hours. Best Regards Rainer
> On Nov 25, 2018, at 8:35, Alice Wonder <alice at domblogger.net> wrote: > > Where do regular users who just want an inexpensive certificate usable for S/MIME from a CSR generated the traditional way go to buy a cert?Have you looked at https://letsencrypt.org? <https://letsencrypt.org/?> Alfred
Am 25.11.2018 um 17:26 schrieb Alfred von Campe:> >> On Nov 25, 2018, at 8:35, Alice Wonder <alice at domblogger.net> wrote: >> >> Where do regular users who just want an inexpensive certificate usable for S/MIME from a CSR generated the traditional way go to buy a cert? > > Have you looked at https://letsencrypt.org? <https://letsencrypt.org/?> > > AlfredLetsencrypt does not sign certificates for use with S/MIME. Alexander
> -----Original Message----- > From: CentOS <centos-bounces at centos.org> On Behalf Of Alice Wonder > Sent: den 25 november 2018 14:35 > To: CentOS mailing list <centos at centos.org> > Subject: [CentOS] [OT] Where to buy S/MIME ?? > > Hi, I'm getting increasingly paranoid. > > Something I said on a certain social media site several months ago was > modified - then reported - then by account was banned until I agreed to > delete it. > > Obviously since what I said was modified I didn't have any issue with > deleting it but I want more than just DKIM sigs on my e-mail now. > > Anyway looking for S/MIME I can use to sign and/or encrypt but mostly > sign. Not interested in GnuPG or self-signed S/MIME - I want something > that can be trusted because someone else that is trusted actually > vouched for me. > > The "free for personal" S/MIME from Comodo didn't work. Browser said it > did but there was nothing to export for me to then import. I suspect it > is because I used private browser window, I really don't like the idea > of a private key stored in browser anyway. And it never asked for a > password to encrypt the private key, nor let me specify key strength > (only let me choose between medium and high - I assume high is 4096 but > I don't know, it didn't say) > > Didn't like the "browser generated" process, even if it had worked and > generated the final product I could export - I really didn't like the > process and have serious questions about the wisdom of a private key > without a pass phrase stored in an application that interacts with web > sites. > > Anyway so used openssl to create private key (with aes-256 encryption > and pass phrase) and then a CSR. > > But I can't find anyone who sells certs for S/MIME to send the CSR too. > > Globalsign but they wanted $89 - no one else. > > Found a few sites that offered to "send me a quote" that I think were > intended for corporate accounts. > > Where do regular users who just want an inexpensive certificate usable > for S/MIME from a CSR generated the traditional way go to buy a cert?Would letsencrypt.org work for you? I use them for my web sites, but unsure if you can do s/mime with them. It's free, and trusted/sponsored by loads of big muckamucks according to their web site. -- //Sorin
On Sun, 25 Nov 2018, Alice Wonder wrote:>I want more than just DKIM sigs on my e-mail now.That digital signature (failing to verify) should be sufficient proof that the content was altered -- it is as strong as S/MIME signing only will provide, i.e., if someone with power over your life can be convinced that you authored an altered/doctored message then whether the DKIM headers or the S/MIME signature was discarded seems pretty immaterial.> Anyway looking for S/MIME I can use to sign and/or encrypt but mostly sign.> The "free for personal" S/MIME from Comodo didn't work. Browser said it did but > there was nothing to export for me to then import. I suspect it is because I > used private browser window, I really don't like the idea of a private key > stored in browser anyway. And it never asked for a password to encrypt the > private key, nor let me specify key strength (only let me choose between medium > and high - I assume high is 4096 but I don't know, it didn't say)Likely being "private" was the issue though I'd expect that if a key won't be stored because the window was private it should refuse to generate a CSR which is what happens though you can't see it. Perhaps you should revoke and reissue, i.e., try again but not private, or it might be on a different tab that you failed to notice. Once you have a signed certificate installed you can export it to a PKCS#12 bundle for which Firefox will require a password. Feel free to delete it from the browser's store once you export it -- I doubt I would; the certificate usage specifier should prevent it being used when visiting a site that allows or requires you to provide a client-side certificate.> But I can't find anyone who sells certs for S/MIME to send the CSR too.Indeed, nothing inexpensive. Supply and demand economics, you want what isn't in much demand so pay a premium. I can't even find it in the OpenSRS reseller panel and they resell everything they can. mozillaZine has a knowledgebase article about it along with possible sources (including signers that are no longer issuing them), see <http://kb.mozillazine.org/Getting_an_SMIME_certificate>. /mark
On 11/25/18 5:35 AM, Alice Wonder wrote:> The "free for personal" S/MIME from Comodo didn't work. Browser said > it did but there was nothing to export for me to then import. I > suspect it is because I used private browser window,Probably, yes.? I've used that service in the past without issue.> I really don't like the idea of a private key stored in browser > anyway. And it never asked for a password to encrypt the private keySetting a password will protect all of the certificates stored by Firefox.? Select: Preferences -> Privacy and Security -> Security Devices (under Certificates) -> Software Security Device -> Change password Chrome may have a similar option, but I don't see it and I don't see documentation for it.\> nor let me specify key strength (only let me choose between medium and > high - I assume high is 4096 but I don't know, it didn't say)There's very little harm in getting a certificate and examining it to find out.? You can destroy it later with no ill effect.
On 11/27/2018 03:33 PM, Gordon Messmer wrote:> On 11/25/18 5:35 AM, Alice Wonder wrote: >> The "free for personal" S/MIME from Comodo didn't work. Browser said >> it did but there was nothing to export for me to then import. I >> suspect it is because I used private browser window, > > > Probably, yes.? I've used that service in the past without issue. > > >> I really don't like the idea of a private key stored in browser >> anyway. And it never asked for a password to encrypt the private key > > > Setting a password will protect all of the certificates stored by > Firefox.? Select: Preferences -> Privacy and Security -> Security > Devices (under Certificates) -> Software Security Device -> Change password > > Chrome may have a similar option, but I don't see it and I don't see > documentation for it.\ > > >> nor let me specify key strength (only let me choose between medium and >> high - I assume high is 4096 but I don't know, it didn't say) > > > There's very little harm in getting a certificate and examining it to > find out.? You can destroy it later with no ill effect. > >I actually went for a more complex scenario, I've created my own CA complete with CRL. It's nice because with S/MIME you really want two certs - one for signing (where ecdsa can be used) and one for when you need to receive encrypted. And I have multiple e-mail accounts I want to do thus with. Could have done self-signed too but this at least allows me to revoke if a device like laptop or phone w/ private key is stolen. Does mean those who want to confirm my messages have to import my root key but that's for them to decide. Web browsers are applications that exist for the explicit purpose of downloading and executing untrusted code. It does not seem like that is a very wise environment to use for generating long term cryptography keys. It really doesn't.