7

I have a sub domain from no-ip.org. I would like to get a free SSL certifcate for my domain. Is this even possible to do for a subdomain and if so what are my options?

  • Can you clarify what you mean by a "sub domain"? Do you mean something like "example.com" that's registered to you and owned by you? Or do you mean something like "moose.example.com", where someone else owns "example.com" and lets you have use "moose" without actually owning anything? If the former, you can get free SSL certificates. If the latter, you probably can't get them at any price. (Since you don't own anything and SSL certificates prove ownership.) – David Schwartz May 29 '12 at 6:13
  • its the latter. – Sab May 29 '12 at 6:32
  • Then you need to get a "real" domain and use a CNAME entry to point it to the "borrowed" domain. Then you can get a free SSL certificate for the "real" domain -- since you can prove you own it. – David Schwartz May 29 '12 at 6:52
  • Actually, StartCom will issue a certificate under these circumstances so long as the domain owner submits an authorization letter that they can verify. – David Schwartz May 29 '12 at 8:00
  • @DavidSchwartz And how exactly are you supposed to get a provider such as dyn.com to fill out such a letter for you? (Also, StartCom won't do this for the level1 [free] cert) – Michael Dec 31 '14 at 18:25
10

There are at least three options for using a certificate with a web or mail server:

Option 0: Obtain a certificate from Let's Encrypt

Let's Encrypt may be a way for you to have free, browser-trusted SSL certificates. This is a new option since this question was asked.

Let's Encrypt works a little differently than other CAs. You install a small agent on your server, and it renews your certificate automatically every few months.

I can't quite tell if this option works yet, because there are a few GitHub issues discussing a change to allow No-IP domains to work with their service:

Even if this doesn't work today, keep an eye on it, because it seems it will be ready soon.

Option 1: Obtain an SSL certificate signed by a certificate authority (CA)

The advantage of using a certificate signed by a CA is that your visitors will automatically trust your certificate. Operating systems and web browsers ship with a list of trusted root certificates, and only certificates signed by those trusted certificates are considered trusted by default.

The disadvantage is that most of the CAs included with major operating systems and browsers charge money for their services.

CAs do offer certificates for subdomains; however, they generally have some sort of simple verification process to prove you have control of that subdomain. Different CAs may have different policies about issuing certs for subdomains of no-ip.org and other dynamic DNS providers.

A small list of potential CAs you might investigate are:

Option 2: Obtain an SSL certificate from a web-of-trust provider

The only web-of-trust provider I'm aware of is CAcert.org. This is a certificate authority that provides free SSL certificates. However, the certificates do not verify anything about your domain until enough other CAcert.org users have verified your identity. Once you've earned enough "assurance points", you can add a name to your certificate and have longer expiration dates.

However, I don't believe CAcert.org's root certificate is included in most browsers by default. Your visitors will need to install this root certificate or else they'll get the Scary Certificate Warning:

Untrusted certificate error

Option 3: Generate a self-signed certificate

If you really cannot purchase a certificate, you can create a self-signed certificate. This doesn't require any CA, but others computers will not automatically trust your certificate. Guests visiting a website secured by a self-signed certificate will receive the Scary Certificate Warning.

Depending on your system, there are different ways to do this. If you are using OpenSSL, you can use the instructions provided by Akadia.com:

# Generate a private key
openssl genrsa -des3 -out server.key 1024

# Generate a certificate signing request (CSR)
openssl req -new -key server.key -out server.csr

# Generate the self-signed certificate
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

You would then install server.cst in your web server of choice.

| improve this answer | |
  • So are there no free ssl certifiactes for subdomains – Sab May 29 '12 at 5:18
  • @Sab: Self-signing a certificate is free, but isn't trusted by browsers by default. This is a trade-off you must make. A CA getting their root certificate included with browsers is expensive; I'm not aware of any who bear that cost without charging customers for that service. – Stephen Jennings May 29 '12 at 5:27
  • Okay. I guess i have to figure some other way. – Sab May 29 '12 at 5:53
  • Basically, we have to pay a CA to be visible on the internet... Are browser vendors paid by CAs to refuse to trust non CA certified certificates? Why would browsers not accept Option 2 root certificate otherwise? – Shautieh Sep 9 '16 at 9:32
  • @Shautieh Inclusion in a browser's root CA list grants tremendous power because an insecure or malicious CA threatens the security of all websites. So, the browser vendors have to make a critical decision: What CAs should be trusted by everyone? According to this ticket, CAcert did not pass an audit, so their request to be included in Mozilla was rejected. This is Mozilla's inclusion policy, to see how seriously they take this decision. – Stephen Jennings Sep 9 '16 at 15:46
1

You can get a free certificate for subdomains for 90 days from Comodo SSL. This is the only one I've found that is provided by a ubiquitously trusted certificate authority, free, and valid for subdomains. I've personally used it with my free domain provided by no-ip. Unfortunately it's only valid for 90 days, after that it's $100/year (or less for a multi-year commitment).

| improve this answer | |
  • 1
    When I try this approach, it tells me that an account already exists for the domain above mine (e.g. I try to send a CSR for michael.example.com, which I own, and it tells me an account already exists for example.com, which I do NOT own.) – Michael Dec 31 '14 at 18:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.