Free SSL

Is it feasible for use with PGP encrypted forms only, not commerce?

[jec2002]

Hi Guys. I would appreciate any expert advice you can give me on the following situation.

I run a non-commercial literary dot org. There is no exchange of money anywhere on the site. I would like to enable users to submit comments via PGP encrypted forms, which would not be effective unless I also used SSL. But I don't want to pay for a certificate. Can I use Free SSL? I am presuming that any objections a browser might display about the certificate would be mute insofar as money is not at risk, only comments. Is this feasible?

I would appreciate your help on this. Thanks. -- Jim

[dingman]

PGP encrypted forms? huh? I use PGP (well, actually I use GPG) and I use home-brew SSL certs. Not sure how you'd incorporate PGP encryption into a form without making things hard on the user, though.

[jec2002]

Hi Dingman. The idea is to send the form via encrypted email. Do you know what I mean?

Also, can you give me any starters on home brew certificates. Can you tell me where I can find a good tutorial on installation? Thanks.

[msr986]

Some of this is going to depend on your host. What kind of hosting do you have? Do they even provide SSL? Some hosts have 'shared' certificates that you can use for a small monthly charge.

[jec2002]

Yes, my host is addr.com, and they have SSL. They offer a shared certificate, but I'm a writer and I'm VERY poor, for now anyway, so I don't want to spend any money if I can avoid it. I tried to generate a certificate using telnet and Apache commands, and I got to a certain point and needed something I didn't have; something I had to get from an issuer. That was months ago. Today, I started researching the project again, and I found Free SSL which offers a free public key (or private key) and I think that's what I needed. So I want to try it again. I really don 't know what I'm doing until I try. I understand as I go along. I was just wondering if you knew where I might find a tutorial that goes through the process for an Apache UNIX host.

Hey, thanks for helping out. I appreciate it.

Anything more you can tell me? -- Jim

[dingman]

For making home-brew certificates, I use the 'mod-ssl-makecert' script that comes with the 'libapache-mod-ssl' package in Debian. It's like falling off a log. This might also help. [ibiblio.org...]

As for sending forms by encrypted e-mail, do you mean using 'action="mailto:your@address"' or to you mean to write a server-side script that will encrypt the message and send it to you? I don't think there is any way to enforce use of PGP with the first one, but with the second it shouldn't be too hard.

[jec2002]

I'm talking about the latter, which I started reading about this morning at [columbia.edu...] Any idea where I might get a freely available script that would encrypt an email on my server?

The HOWTO link you provided is excellent. That will do just fine. Thank you very much.

If you can't help me with a link to the encrypting link, I'll find it on my own -- in a couple of hours. I appreciate your help. Best to you. -- Jim

[dingman]

I'm afraid I don't know where to find such a script. It falls pretty squarely into the realm of things I'd just write if I had any use for them. At the moment, I don't have any forms that I expect people to send sensitive information through, so I don't have one ready-made.