Oliver's /dev/null replacement

It was a bit of trouble to get it done, even after my purchase was approved. But I have ît now 🙂

Here I just want to share the information with you, since the FAQ on the GoDaddy website wasn’t particularly helpful. I had chosen the multi-domain certificate for up to five domains. It was clear that besides the CN (Common Name) they’d allow me to enter the SANs (Subject Alternative Names). However, this didn’t quite work out. When I had created my CSR (Certificate Signing Request) and tried to submit it, the system refused it and referred me back to the tech support. Darn …

This meant waiting one more day as – due to the timezone difference – the problem would be handled only when it was night in my timezone again. Anyway, I got a reply. Now I had originally pasted my CSR along with the support request in order to help them figure it out. The CSR was complete (with the begin/end markers) so that could be ruled out. However, apparently the CSR parser over there doesn’t like if you enter the SANs already before submitting the CSR, so the final hint from the tech support came in handy: I’d be able to enter the SANs after submitting the actual CSR, so I should try submitting my CSR without SANs. Done – and it worked. So why isn’t this documented in their FAQ? Anyone could have done that easily. The challenging part was originally to get the SANs into the CSR.

But well, it works now. So if anyone else is using these multi-domain certificates from GoDaddy.com, this should help figure out the missing link that wasn’t in the online help 😉

// Oliver

Read the full story here. DHS denying request under FOIA.

PS: If you read the scanned document closely, you notice the two times 8-digit “file number” which could be a date. If this was state of the art three years ago, what’s the state now? Let me guess, there are a bit more than DELL computers affected? … 🙄

Update: There are claims this was a hoax (from 2005). Let’s hope it was. Read here and here.

The sad part, it is actually not incredible enough to find out it is a hoax immediately. One comment on the first of the links reads:

I can not describe my desire to ridicule people who actually buy into this stupid bullshit. I’m even more outraged at people actually trying to prove other people that this is not said bullshit.

Seriously, what are the chances of someone actually getting away with this?

Well, who would get away with becoming US president without actually getting elected the first time, but getting a second term without being thrown out of office and this time even getting elected (although it also smelled fishy)?

I just ordered a five-pack of SSL certificates at GoDaddy.com a few days ago because they have the best offer in that the price is nice and the browsers they cover are virtually 100% of all browsers. The remaining close-to-zero doesn’t need to visit my websites anyway 😆

When paying the thing, I registered with my German postal address, simply because the domains (for which the SSL certs are intended) are registered on it as well. However, I paid the thing with my Icelandic credit card as it is more convenient for me that way, despite the unfortunate difference in the dollar rate (yes, also the ISK has plummeted) or the fact that a registration with my Icelandic (matching) address would have saved me the VAT. That brought the anti-fraud department onto the plan and I got a friendly mail in which I was asked to confirm the purchase and my identity. Due to the fact that I paid with a credit card whose billing address is in a different country than the address of my registration, they thought it was a fraud. I cannot actually think of any fraud where a domain in the hands of the payer (coincidentally the name on my Icelandic credit card is my name ) could be abused in any way. I used the same email address to register at GoDaddy which you can also see on my contact forms 😉

Anyway, now it is kind of stalled. When requested, I sent immediately the front side of my national ID card as a scanned image, although I would have preferred a secure transmission in their customer area or so (which runs over https). After all, privacy was the reason to get SSL certificates in the first place. And now I can only wait. Everyone says they offer a swift service and the emails so far were pretty quickly exchanged. Also I have to take into account the time zone difference. Now that’s the hardship you get from being a world citizen 😉 … let’s see how this turns out.

Greetings to the GoDaddy.com anti-fraud department,

// Oliver

PS: And yes, I understand the skepticism and appreciate the concern. If someone would have used my credit card data to make a fraudulent purchase somewhere, this would hurt all parties except the fraudster. It’s just so damn inconvenient 😉

Update: Issue is resolved. A mail from support got lost on its way, that’s why it seemed to take so long.