11 ms·
Termination of StartCom business
- stevekemp 9y agoAs predicted in the past, this is the end result of lots of shady behaviour from WoSign/StartCom. Some previous discussion is here: https://news.ycombinator.com/item?id=12582534 https://news.ycombinator.com/item?id=12582534
- deleted 9y ago[deleted]
- pferde 9y agoApparently, they also sent out an e-mail with the same text to their customers, with an addendum that they are going to try to get a certificate for each customer with other CAs, and that to opt-out, one has to send them an e-mail. I found that addendum quite strange. Such thing should be opt-in, in my opinion.
- jstanley 9y agoText of the email is here: https://pastebin.com/6BCCFtJx https://pastebin.com/6BCCFtJx
- cdancette 9y agoI received the email, and I agree, I thought "Just leave me and my certificates alone would you?" They did enough damage already
- ahoka 9y agoMaybe you get a shiny new Turk Trust cert in exchange. Who knows.
- therein 9y agoWhy Turk Trust?
- delta1 9y ago... basically the top google search result https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
- stryk 9y agoI have no idea if 'Turk Trust' is even a real CA or if you made up the name in jest. I'm honestly scared to Google it and find out, in slight fear of finding out that is an actual CA. (Not to get too political here, but given Turkey's current government, I'm not sure how anyone in their right mind would 1- trust them to say or do _anything_, and 2- trust SSL encryption certs coming out of there)
- Shoothe 9y agoAt least it's not Honest Achmed's Used Cars and Certificates ;) https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959
- Macha 9y agoInterestingly: > Eddy Nigg (StartCom) > Comment 11 • 7 years ago > According to http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/ and https://wiki.mozilla.org/CA:Information_checklist https://wiki.mozilla.org/CA:Information_checklist apparently fails to comply to the audit requirements amongst other things at the moment. Should a valid audit statement be published and confirmed by an authorized auditor, I guess Mozilla could consider a discussion to include this CA.
- NetOpWibby 9y agoLMAO
- jwilk 9y agoIt's real: https://bugzilla.mozilla.org/show_bug.cgi?id=1007683 https://bugzilla.mozilla.org/show_bug.cgi?id=1007683
- nurettin 9y agoI'm Turkish and I agree. Also, Turk trust got involved in a controversy where they admitted that they leaked a private key. https://www.google.com.tr/amp/s/nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/amp/ https://www.google.com.tr/amp/s/nakedsecurity.sophos.com/201...
- mike-cardwell 9y agoProbably just a roundabout way to say that they're selling their customer data and you have to contact them to opt out.
- Matt3o12_ 9y agoThank you very much for pointing out about the opt-out crap. I also got the email but I didn’t bother to read past the first paragraph because I stopped using them as soon as I switched to cloudlfare for my certificates. I always hated their interface but as a broke high school student I couldn’t afford to have a paid certificate. Thankfully we have Let’s Encrypt now
- Matt3o12_ 9y agoI have received a follow up email by them in a very timely manner: > Hi, > > Sure, we will record your user ID and your details won't be transferred to other CA, as the alternative CA option is for those who need it. > > Best regards, > StartCom Certification > Authority
- nvr219 9y agoI got the email. Here is the full text: This is an automatically generated email, please do not reply. Dear customer, As you are surely aware, the browser makers distrusted StartCom around a year ago and therefore all the end entity certificates newly issued by StartCom are not trusted by default in browsers. The browsers imposed some conditions in order for the certificates to be re-accepted. While StartCom believes that these conditions have been met, it appears there are still certain difficulties forthcoming. Considering this situation, the owners of StartCom have decided to terminate the company as a Certification Authority as mentioned in Startcom´s website. StartCom will stop issuing new certificates starting from January 1st, 2018 and will provide only CRL and OCSP services for two more years. StartCom would like to thank you for your support during this difficult time. StartCom is contacting some other CAs to provide you with the certificates needed. In case you don´t want us to provide you an alternative, please, contact us at certmaster@startcomca.com Please let us know if you need any further assistance with the transition process. We deeply apologize for any inconveniences that this may cause. Best regards, StartCom Certification Authority
- justinjlynn 9y agoAmusing that they couldn't get the encoding correct on their final email either.
- nneonneo 9y agoIt’s correct in the email I received. It’s a non-ascii apostrophe so I guess certain mail clients might not handle it correctly?
- nvr219 9y agoI copied and pasted from Outlook... probably Outlook's fault honestly.
- LukeShu 9y agoIn the email I received, it's a non-ASCII apostrophe encoded in UTF-8. The email headers say "Content-Type: text/html; charset=iso-8859-1", but then the HTML body says "<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>". Clients that give preference to the header will get it wrong. The full raw email: https://lukeshu.com/dump/startcom-email.txt https://lukeshu.com/dump/startcom-email.txt
- rspeer 9y agoIt's funny that this message appears next to a cheery pitch offering you a StartCom EV certificate for "Only US$199.90". Yes, I know that changing website templates requires effort, and that's effort that they no longer have any reason to spend.
- Walkman 9y agoFinally! They did shady practices for a long time despite multiple warnings.
- gatmne 9y agoGood riddance. Shady tactics and holding web security hostage has no place in this industry. I'm amazed they lasted as long as they did.
- kyriakos 9y agoEven though it ended badly they were the first to offer free certificates.
- pcunite 9y agoI think dealers give away coke at the onset, no?
- k33n 9y agoNo. No they don't. Coke is a very expensive product.
- GuB-42 9y agoI've met a lot of dealers and I am still waiting for my free coke... Free certificates were free, no trick. Of course they recommended their paid offer, but there is nothing wrong with that. You may argue that StartSSL turned some webmasters into https addicts but it is not exactly a bad thing isn't it? Remember that Let's Encrypt didn't exist back then.
- jsmthrowaway 9y agoYou’re thinking of other drugs with intensely addictive properties, like heroin. Cocaine is way too expensive to hand out much more than a free bump or two, maybe a line, and that’s not necessarily enough to addict someone. Some people can do all the blow they want and not get addicted at all, which is obviously not a good RoI for the dealer. So I hear, anyway...
- jcoffland 9y ago> Some people can do all the blow they want and not get addicted at all Many users think they are such a person.
- NetOpWibby 9y agoI got this email and thought it was spam. I think I sent it to ReScam.
- jwilk 9y agoThis was discussed ~2 weeks ago: https://news.ycombinator.com/item?id=15721234 https://news.ycombinator.com/item?id=15721234
- shawkinaw 9y agoOK, so is there another place I can get free S/MIME certificates?
- sigjuice 9y agoI’m hoping Let’s Encrypt will do S/MIME someday. Most email clients support S/MIME.
- elgaton 9y agoCOMODO seems to be the only CA that still offers them: https://www.comodo.com/home/email-security/free-email-certificate.php https://www.comodo.com/home/email-security/free-email-certif...
- linkmotif 9y agoI had an interesting experience with these guys. About 3 years ago I registered the domain "getmoneymakemoney.com" and got a free StartSLL cert from them. Three days later they revoked it because they said the domain sounded like a scam site. I called them and tried arguing to no avail. I said it was just an adaptation of line from a rap song and hosted my personal blog (which it did!) but they didn't care. Go figure. Never understood why they cared so much about my site but then accrued all the negative publicity they did.
- magnat 9y agoI've got similar experience. It turned out my (four letter) domain is one letter away from some other domain and was detected as a typosquatting. Only way to get certificate from them would be to undergo Extended Verification.
- sillysaurus3 9y agoI like the spirit behind this idea, but in practice I guess it's tricky. "gail.com" is probably one of the most valuable typo squats, but it's also someone's name.
- wolf550e 9y agoNote that these are not the same people. StartCom was sold to WoSign, and it is WoSign who terminated StartCom business after ruining the StartCom name. StartCom actually tried to be good net citizens.
- Operyl 9y agoWell, besides charging ludicrous amounts of money for certificate revocations in light of major internet events..
- Raed667 9y agoI have sent them an email to opt out and received the following response : "Hi, Sure, we will record your user ID and your details won't be transferred to other CA, as the alternative CA option is for those who need it. Startcom certification Authority"