Client certificate themselves aren't so bad, I use them for my personal sites. But they way startssl used them without accounting for bad browser support is a p

Client certificate themselves aren't so bad, I use them for my personal sites. But they way startssl used them without accounting for bad browser support is a problem. If you accidentally visit their page with the wrong browser (Safari or Chrome, I forget) when you need to renew an expiring client certificate - the browser doesn't download it properly, you can't ever request another one. Anyway, letsencrypt sorts that out.