6 ms·

A big part of the reason is that free certs exists already (startssl), but it takes A LOT extra work to set it up. The whole point here is that eventually the

A big part of the reason is that free certs exists already (startssl), but it takes A LOT extra work to set it up. The whole point here is that eventually the deployment tool can be integrated in existing server software, such that when you set up your server on your domain, requesting a certificate can be an automatic step that the sysadmin and web developer don't even have to think about. This makes sure encryption will eventually be deployed by default everywhere, because it is literally easier than not to.

drdaeman 11y ago
> free certs exists already (startssl) Nitpick: not for businesses. If you're asking for a certificate for anything that they may suspect has slight relation to any commercial activity, the request will be denied. It may be accepted by chance, but that's unreliable. Companies who don't want to pay currently have only single option - WoSign, and they had started to give out free certificates relatively recently (I heard of them only this February)
- codingminds 11y ago
  We use StartSSL for many business domains and never had any problems
  - nailer 11y ago
    The main thing is your use is outside StartCom's policy. See https://www.startssl.com/policy.pdf https://www.startssl.com/policy.pdf > Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc. StartSSL will make you pay to revoke a certificate if you need to.
    - codingminds 11y ago
      Good point. Interesting, that they never complained about it when we had to resolve some other issues with the cert master
  - bryanlarsen 11y ago
    They have some sort of regex they use to flag business domains. For example, if your domain contains the word 'billing', then they won't give you a cert.
  - SG- 11y ago
    they reject the certificate request if they check the domain and there's content indicating it's a commercial business. if it's an empty site then you're ok.
AndyMcConachie 11y ago
I can't use StartSSL because my DNS registrar doesn't populate whois the way they like it. Also, anyone relying on some sort of whois privacy cannot use StartSSL.
- TurkTurkleton 11y ago
  I didn't have any problems using StartSSL for any of my domains, and they all have whois privacy.
  - aroch 11y ago
    Depending on the privacy providers, the protected email changes after every email it receives. This causes startSSL to deny your certificate requests
- joonoro 11y ago
  I would like to add that from my personal experience I would not recommend the free StartSSL cert for personal use. The certs are free but revoking them costs money, so when the whole Heartbleed thing happened a lot of people got screwed. Regardless of the cert owners ability to pay for it, StartSSL made the web an arguably less secure place with that business decision and many did not pay to revoke their free cert. For a time there were even discussions of removing all the StartSSL certs from Firefox as a result [0]. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=994033 https://bugzilla.mozilla.org/show_bug.cgi?id=994033
toyg 11y ago
I agree but I think registration and configuration should be split a little bit more. I personally won't trust it with my config files (and god knows what other wonderful webserver will emerge next month), but having an automated cert-generation tool is great. Also, they absolutely must improve OSX support. One of the main objectives is to help people who are in the web field but wouldn't otherwise bother learning the intricacies of SSL configuration; these people by and large use Macs.
- Natanael_L 11y ago
  There's alternative tools that use the same standard API, you don't need to use the standard tool. If you want it to only register and authenticate to fetch a cert but not install it, and you want it to just tell you what you need to do so that you can do it manually if you so wish, then that's possible.
- tokenizerrr 11y ago
  > I agree but I think registration and configuration should be split a little bit more. I personally won't trust it with my config files (and god knows what other wonderful webserver will emerge next month), but having an automated cert-generation tool is great. The official client can be ran in 'auth' mode, in which it will not write to your server configs. It can still automate the authentication process for you by looking at where the DocumentRoot is, and placing a file there. But this is also optional, since there is a manual authentication mode as well that just gives you a file, and you'll have to make it available under your domain somewhere and tell it when you've done so. > Also, they absolutely must improve OSX support. One of the main objectives is to help people who are in the web field but wouldn't otherwise bother learning the intricacies of SSL configuration; these people by and large use Macs. They also use Mac on their servers?
  - toyg 11y ago
    > The official client can be ran in 'auth' mode I know, I just think "auth mode" could be a separate tool to improve usability. It might just be an alias, I don't care, but it's easier to remember "get-cert" than yet another double-dash parameter IMHO. > They also use Mac on their servers? No, but very often they develop and try new tools on their Macs. By blowing the mac experience you're forcing them/us to spin up a vm (if you can) and repeat the installation. This raises the bar for adoption a little bit. In these fickle times, it can make the difference between "oh wow this is magic" and "can't be arsed, will check it out later/never".

drdaeman 11y ago

> free certs exists already (startssl) Nitpick: not for businesses. If you're asking for a certificate for anything that they may suspect has slight relation to any commercial activity, the request will be denied. It may be accepted by chance, but that's unreliable. Companies who don't want to pay currently have only single option - WoSign, and they had started to give out free certificates relatively recently (I heard of them only this February)

codingminds 11y ago
We use StartSSL for many business domains and never had any problems
- nailer 11y ago
  The main thing is your use is outside StartCom's policy. See https://www.startssl.com/policy.pdf https://www.startssl.com/policy.pdf > Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc. StartSSL will make you pay to revoke a certificate if you need to.
  - codingminds 11y ago
    Good point. Interesting, that they never complained about it when we had to resolve some other issues with the cert master
- bryanlarsen 11y ago
  They have some sort of regex they use to flag business domains. For example, if your domain contains the word 'billing', then they won't give you a cert.
- SG- 11y ago
  they reject the certificate request if they check the domain and there's content indicating it's a commercial business. if it's an empty site then you're ok.

AndyMcConachie 11y ago

I can't use StartSSL because my DNS registrar doesn't populate whois the way they like it. Also, anyone relying on some sort of whois privacy cannot use StartSSL.

TurkTurkleton 11y ago
I didn't have any problems using StartSSL for any of my domains, and they all have whois privacy.
- aroch 11y ago
  Depending on the privacy providers, the protected email changes after every email it receives. This causes startSSL to deny your certificate requests
joonoro 11y ago
I would like to add that from my personal experience I would not recommend the free StartSSL cert for personal use. The certs are free but revoking them costs money, so when the whole Heartbleed thing happened a lot of people got screwed. Regardless of the cert owners ability to pay for it, StartSSL made the web an arguably less secure place with that business decision and many did not pay to revoke their free cert. For a time there were even discussions of removing all the StartSSL certs from Firefox as a result [0]. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=994033 https://bugzilla.mozilla.org/show_bug.cgi?id=994033

toyg 11y ago

I agree but I think registration and configuration should be split a little bit more. I personally won't trust it with my config files (and god knows what other wonderful webserver will emerge next month), but having an automated cert-generation tool is great. Also, they absolutely must improve OSX support. One of the main objectives is to help people who are in the web field but wouldn't otherwise bother learning the intricacies of SSL configuration; these people by and large use Macs.

Natanael_L 11y ago
There's alternative tools that use the same standard API, you don't need to use the standard tool. If you want it to only register and authenticate to fetch a cert but not install it, and you want it to just tell you what you need to do so that you can do it manually if you so wish, then that's possible.
tokenizerrr 11y ago
> I agree but I think registration and configuration should be split a little bit more. I personally won't trust it with my config files (and god knows what other wonderful webserver will emerge next month), but having an automated cert-generation tool is great. The official client can be ran in 'auth' mode, in which it will not write to your server configs. It can still automate the authentication process for you by looking at where the DocumentRoot is, and placing a file there. But this is also optional, since there is a manual authentication mode as well that just gives you a file, and you'll have to make it available under your domain somewhere and tell it when you've done so. > Also, they absolutely must improve OSX support. One of the main objectives is to help people who are in the web field but wouldn't otherwise bother learning the intricacies of SSL configuration; these people by and large use Macs. They also use Mac on their servers?
- toyg 11y ago
  > The official client can be ran in 'auth' mode I know, I just think "auth mode" could be a separate tool to improve usability. It might just be an alias, I don't care, but it's easier to remember "get-cert" than yet another double-dash parameter IMHO. > They also use Mac on their servers? No, but very often they develop and try new tools on their Macs. By blowing the mac experience you're forcing them/us to spin up a vm (if you can) and repeat the installation. This raises the bar for adoption a little bit. In these fickle times, it can make the difference between "oh wow this is magic" and "can't be arsed, will check it out later/never".