3 ms·
Now that StartSSL is effectively deceased, is there a commercial CA that supports the ACME protocol? Or is the ACME protocol a vanity project unique to Let's E
by stonogo 10y ago
Now that StartSSL is effectively deceased, is there a commercial CA that supports the ACME protocol? Or is the ACME protocol a vanity project unique to Let's Encrypt?
I manage several dozen certificates; I was very pleased when StartSSL offered an automated API to work with. Despite their flaws, they offered EV certs, wildcards, and automated one-shots, and it was very convenient.
I'd gladly pay for this functionality, preferably while supporting standards-based ACME functionality... but so far it seems Let's Encrypt is the only one playing that game, and their featureset is crap for anything but their very narrow use case.
Any advice, HN?
- agwa 10y agoI'm the founder of SSLMate, which resells Comodo and GeoTrust certs with an automated, ACME-like API: https://sslmate.com https://sslmate.com Our API predates ACME, but we'll most likely be implementing ACME once it's finalized.
- scrollaway 10y agoWhat's your take on the Comodo trademark claim on Let's Encrypt, and all the BS that ensued? https://news.ycombinator.com/item?id=11964583 https://news.ycombinator.com/item?id=11964583 I personally immediately replaced all of my and my company's comodo certificates with DigiCert ones.
- abraae 10y agoCrazy Comodo. When that happened I resolved to never renew or buy new Comodo certs. It might be that Comodo backed away from that ridiculous plan but to be honest I don't really care - the CEO portrayed himself as a douche and it seems safe to assume they're a toxic company.
- agwa 10y agoThe incident was terrible, but it is not a reflection on how their CA is run. They run a trustworthy CA and employ some really awesome and competent people (e.g. Rob Stradling) who actively contribute to improving the Web PKI, such as by (co-)authoring the CAA, Must-Staple, and Certificate Transparency standards. They run https://crt.sh https://crt.sh, which is an invaluable resource for investigating Web PKI problems (the Mozilla report and associated mailing list threads are peppered with crt.sh links). If their trademark filings had amounted to actual legal threats against Let's Encrypt I would hesitate to send them business, but it seems more like their CEO is just a giant blowhard. The good they do makes up for it. In contrast, I'm much more appalled by Symantec/GeoTrust's misdeeds (e.g. issuing unauthorized "test" certificates for google.com, badly botching the SHA-1 deprecation, cross-signing the US Federal PKI). I think Symantec is incompetent and contributes negatively to the Web PKI. I no longer issue their certificates by default, and am going to replace them with a different CA.
- scrollaway 10y agoThanks for the insight!