3 ms·

Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn

by js4all 15y ago

Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn this when I tried to callout to a web service (with a startcom cert) from Salesforce. Also their certs are only free as long as you don't need to revoke it.

Karunamon 15y ago
Came here to say something like this. While the site is a bit of a pain, and the certs are free, make damn sure you have your site configured the way you want it before you generate the certificate. It's $25 to revoke a cert, i.e. free up the name so you can use it again elsewhere. I used part of my domain name for an XMPP cert that I later wanted to use for a web subdomain with the same name.. nope. Stupid.
- pagekalisedown 15y ago
  Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.
  - cinch 15y ago
    you'd want to revoke it if someone steals your private key.
    - Karunamon 15y ago
      Given the way Startcom operates, that could become expensive quickly. Since your private key is your gateway into your account (Why they went with this method instead of requiring a sensible password is beyond me, it's one of the reasons their site is a huge pain...), theoretically every certificate you own is compromised, and therefore you'd be out $25 for each one. ..ouch!
cinch 15y ago
i once built a clojure web app and used a startssl free certificate. it worked fine after i imported it into the java keystore. i was using OpenJDK under linux. were you using Oracle's java?
- js4all 15y ago
  Yes, it was Oracle's. The problem was on the Salesforce side (as a client). They couldn't verify the chain up to the CA because it is not included in the CA bundle. Adding something on the server side doesn't help here.

3 ms·

Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn

by js4all 15y ago

Karunamon 15y ago
Came here to say something like this. While the site is a bit of a pain, and the certs are free, make damn sure you have your site configured the way you want it before you generate the certificate. It's $25 to revoke a cert, i.e. free up the name so you can use it again elsewhere. I used part of my domain name for an XMPP cert that I later wanted to use for a web subdomain with the same name.. nope. Stupid.
- pagekalisedown 15y ago
  Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.
  - cinch 15y ago
    you'd want to revoke it if someone steals your private key.
    - Karunamon 15y ago
      Given the way Startcom operates, that could become expensive quickly. Since your private key is your gateway into your account (Why they went with this method instead of requiring a sensible password is beyond me, it's one of the reasons their site is a huge pain...), theoretically every certificate you own is compromised, and therefore you'd be out $25 for each one. ..ouch!
cinch 15y ago
i once built a clojure web app and used a startssl free certificate. it worked fine after i imported it into the java keystore. i was using OpenJDK under linux. were you using Oracle's java?
- js4all 15y ago
  Yes, it was Oracle's. The problem was on the Salesforce side (as a client). They couldn't verify the chain up to the CA because it is not included in the CA bundle. Adding something on the server side doesn't help here.