10 ms·

Most StartSSL certs will stay compromised

84 points by aroch 13y ago

2close4comfort 13y ago
Now this seems like something that StartSSL would want to be in front of rather than risk everything by having compromised certs out there with their name on them. I would think that kind of behavior would put their CA status at risk...
- makomk 13y ago
  They are in front of it, they've intentionally decided to continue charging for revoking these certificates.
  - sigzero 13y ago
    Which they are 100% in the right to do by the way. StartSSL is a business.
    - MereInterest 13y ago
      And then people are 100% in the right to no longer trust StartSSL certificates.
      - wlesieutre 13y ago
        Or at the very least, StartSSL certs issued before yesterday.
        aroch 13y ago
        No, any StartSSL cert. There are still unpatched systems and there likely will be for quite some time. Just because there's a CVE doesn't mean everyone updated
        wlesieutre 13y ago
        Sure, and there are also StartSSL certs used on systems that don't use OpenSSL. Do we just nuke every certificate, destroy their business, and force people with secure computers to buy new ones elsewhere even though their servers weren't affected by heartbleed? Because that option sucks too.
        claudius 13y ago
        As a user, I much prefer that my browser and my OS never ever again show a StartSSL-signed cert as valid over even just one compromised cert being displayed with a fancy lock. How StartSSL is going to achieve that, I don’t care, but neither do I care whether or not they go out of business over this.
      - shimon_e 13y ago
        Who is suppose to pay for staff time require to manually maintain the revoke list? BTW, revoking a cert doesn't stop it from being used in the wild as plenty of clients will still see it a valid cert. We are basically screwed until all current certs expire.
        dpark 13y ago
        Why would the revoke list need manual maintenance? Are they running a root CA on pen and paper?
      - toomuchtodo 13y ago
        Who am I going to trust less? StartSSL certs? Or OpenSSL? I'm not saying I don't appreciate the hard work the two OpenSSL developers put into the code. But its incredulous that we're upset a business would give away a service due to an event completely out of its control.
        pra 13y ago
        As it was out of the customers' control as well. Or should we have audited OpenSSL?
        toomuchtodo 13y ago
        I would argue that something that is the underlying component of e-commerce, privacy, and security for the majority of Internet activity should probably be audited.
      - latortuga 13y ago
        This is utterly ridiculous. These people signed up for a free SSL certificate knowing that revocations would cost them money. Enforcing a contract that both parties willingly agreed to does not make them untrustworthy, it demonstrates that their customers carry immense senses of entitlement. There are tons of SSL certificate providers out there. Their business model was not a secret when folks signed up.
        sparkie 13y ago
        The business model an practices of the company are completely irrelevant to the people concerned in this case though - the users of the web browser. They never signed up for shit, and they have no incentive to trust a business which refuses to invoke compromised certs because people are unwilling to pay. Yes, this doesn't make them untrustworthy as a business, since their business model was known - it does make them untrustworthy as a party which is meant to be securing the web though - because they'll be failing at it spectacularly. Again: I never signed up to shit, and their business model means shit to me too - I just want some degree of security when browsing.
        MereInterest 13y ago
        I am not their customer. At most, I am their customers' customer. Why do I have any obligation toward StartSSL? If StartSSL is free to choose a business model, then others are free to make judgment based on that business model. Should the customers of StartSSL pay the revocation fee? Yes. Should StartSSL be required to give free revocations? No. Are either of those at all relevant to whether or not I should trust StartSSL certificates, given that they are less likely to be revoked when they need to be revoked?
      - lern_too_spel 13y ago
        The other responders have no idea what you're talking about. You're right, of course, but I suspect most other CA's certificates should also not be trusted even though they don't have this revocation hurdle because a lot of these certificates were given to unsophisticated users who aren't going to revoke compromised certificates anyway.
      - bsder 13y ago
        By that logic, we should remove every CA. At least StartSSL will have good certificates for everybody in their free tier in 12 months. Can any of the other CA's make that claim? So, are you going to lead the charge at the rest of the CA's? And, I suspect that StartSSL couldn't possibly handle every single person calling them up to revoke a certificate right now. And that is NOT their fault--they didn't cause this bug.
      - epsylon 13y ago
        People would better be advised not to trust admins who can't shed 20 bucks for their users' security. Most likely these are the same admins to whom you certainly wouldn't want to give an email, password or any sort of confidential information.
- revelation 13y ago
  Their CA status is not at risk, was never at risk and will not be at risk in the future. Mozilla has made their stance clear that once you are in, you will never be removed (unless you were compromised, at which point they'll happily add your new CA). I'll certainly not claim that we can magically make TLS work by starting to enforce the requirements we put on CAs. But we should call Mozilla out for their strongly worded letters and other nonsense to get some momentum for better solutions. The first step is admitting you have a problem.
  - klapinat0r 13y ago
    Incorrect. DigiNotar[1] was permanently removed. Quoting Mozilla[2]: "This is not a temporary suspension, it is a complete removal from our trusted root program." [1]: https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudule... [2]: https://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/ https://blog.mozilla.org/security/2011/09/02/diginotar-remov...
    - revelation 13y ago
      They were removed for being compromised and went bankrupt before trying again. I don't see how that invalidates what I said. Meanwhile, CAs that have issued CA=yes certs remain, but you know, Mozilla wrote them a letter reminding them on security best practices.
      - klapinat0r 13y ago
        True that they went bankrupt, but they filed on Sep 20th 2011, and the Mozilla decision to permanently remove them was a week prior or at least on Sep 2nd 2011; thus "unless you were compromised, at which point they'll happily add your new CA" is not correct. EDIT: To clearify, this is the phrase that we seem to be arguing about: Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort. (from the Mozilla Security Blog link above). They were effectively out in the cold, not "in once you're in" after the incident.
mike-cardwell 13y ago
They should have taken this as a marketting opportunity and offered up free revocations for a week.
- akerl_ 13y ago
  I think that would have been a successful PR move, but deciding if they're rather have the money or goodwill is their choice to make. They told people upfront what the costs were, I don't fault them for following through with that.
shimon_e 13y ago
If someone stole your certs you are basically screwed until they expire. Currently most browsers don't check if certs are revoked.
- sanderjd 13y ago
  This is a good point that seems to keep being ignored: do revocations even matter? Are browser makers planning on changing their defaults with regard to revocations? Is somebody planning a widespread consumer education campaign regarding revocation? If not, this whole issue seems like a bunch of noise that doesn't have much real impact.
  - riquito 13y ago
    For example at Mozilla there are discussions about it, I suspect it's happening for other browsers too: https://lists.mozilla.org/listinfo/dev-security-policy https://lists.mozilla.org/listinfo/dev-security-policy
    - sanderjd 13y ago
      Any links to specific threads? I don't find anything when searching that list for "revocation" or "revoke", though there seem to be lots of threads about CAs in general, so maybe there's relevant discussion in some of those.
      - brohee 13y ago
        https://groups.google.com/forum/#!searchin/mozilla.dev.security.policy/OCSP/mozilla.dev.security.policy/mwmg2X74vlI/fYEljQnJVN4J https://groups.google.com/forum/#!searchin/mozilla.dev.secur... for example (3 years old). The right keyword to search for is OCSP, because CRLs are completely impractical in the browser. But then we have the issue that OCSP is a pretty retarded protocol. OCSP stapling helps with some issues, but there is still the issue that it doesn't really check if a certificate is valid, but whether a certificate bearing the given serial number is valid. Which didn't help AT ALL when using MD5 collisions people managed to create multiple certificates under the same serial number.
larkinrichards 13y ago
As a free SSL provider I think this is entirely valid for them to charge for revocations. Plus, it's entirely possible that not all people using certificates from StartSSL are using OpenSSL. It's the cert owner's prerogative to ensure their certificate is properly secured. There's no reason for debian/mozilla to remove StartSSL from their CA lists. If you have StartSSL and you used OpenSSL 1.01f or another vulnerable version, pay the $25 and move on-- it's cheaper than if you used godaddy.
- steveklabnik 13y ago
  It is totally valid for you to be a jerk, and then it is totally valid for other people to call you out on being a jerk. Yes, maintaining a revocation list costs them time and money. But this is a Big Deal. Extenuating circumstances. They have a social responsibility here, and they're failing at it.
  - akerl_ 13y ago
    They do not have a social responsibility. It is totally valid for people to call them out for not going above and beyond, but that doesn't mean Mozilla/Debian/etc should be popping them out of CAs. The mob is welcome to mob, but Mozilla and Debian shouldn't be making decisions based on the whims of the mob.
    - steveklabnik 13y ago
      If you can't trust the certificates they produce, then they should be removed. And there will be a lot of valid-but-dangerous certs in the wild from them.
      - akerl_ 13y ago
        No more than from people who charge to reissue but not for revocation.
        steveklabnik 13y ago
ridruejo 13y ago
What are good alternatives to StartSSL? Either free or moderately priced
- sliverstorm 13y ago
  I've been using PositiveSSL. I am paying less than $10 a year for a basic cert, revocation is free. I don't know anyone else who uses it, but there's nothing not to like so far, unless you are the sort who expects to pay nothing at all for your certs.
  - yebyen 13y ago
    This is the SSL cert provider used by Namecheap, I just got my first SSL cert signed here, the experience was smooth. The longest delay in the whole process was from my own mailserver at the verifying site listed in the WHOIS record, which does greylisting (so it usually takes about 30 minutes to start exchanging mail with anyone you haven't received mail from before, since the server has to wait for them to retry...) The whole process was smooth as butter, $9 later I have SSL support on my site.
  - PaulBurke 13y ago
    Today I was searching for PositiveSSL Certificate for my website. I Googled and found many online store offers PositiveSSL Certificate, but there were major difference on price. I've found some stores offers PositiveSSL at $49/Year, $19.95/Year, $12/Year, $9/Year & $5.99/Year. I want that PositiveSSL certificate for 5 Years. SO I've bought it from CheapSSLSEcurity at only $4.80/Year. I loved their service. The certificate was issued minute and its now live on my website. Thanks and Regards Paul Burke
notdonspaulding 13y ago
Let me see if I have this straight: Alice's Lemonade Stand charges $0.25 for a cup of ice-cold lemonade, and has a recycling bin that her customers can use for free. meanwhile, down the street: Bob's Lemonade Stand gives out free lemonade, and charges $0.25 to use their recycling bin. The message here is basically "boycott Bob for his anti-recycling business practices", right? Seems like a distinction without a difference to me.
- aegiso 13y ago
  Except the cups must be recycled where you bought them, and when they accidentally turn out to be super toxic Bob insists the recycling fee was clearly posted. I don't know who's right here, but it's definitely not that simple.
  - akerl_ 13y ago
    It really is that simple. Bob didn't know the cups were toxic, there's no way he could have know, every lemonade stand had toxic cups, and he didn't raise the price of recycling in response. Bob isn't responsible for letting people off the hook due to circumstances outside of his control.
    - cpach 13y ago
      Well, this is not like the first time the TLS stack has a disastrous vulnerability. I think that giving out free certificates and charging for revocations is bad business since it sets bad incentives. Better then to charge upfront for issuing the certificates.
      - brohee 13y ago
        Because taking money to issue certificates sets good incentives...
        cpach 13y ago
        Well, I’d say the most valuable data is generally TLS-protected. E.g. Gmail, Outlook.com, Dropbox, etc. I sure would like to see even better TLS adoption rates than what the web currently has, but I don’t think that we should compromise the trustworthiness of the certificates in order to achieve this goal. What makes the CA-issued certificates trustworthy is that they are in fact verified to belong to the legitimate owner of the domain. Doing the verification and maintaining the CA’s infrastructure is not free so I don’t think it’s very surprising that the vendors charge for their service.
mapgrep 13y ago
Are there any cert providers who have particularly solid reputations? I get basic certs via my domain provider Gandi, they run ~$17 year (12 euros), or $160 for wildcard which seems steep.
- dm2 13y ago
  Comodo PositiveSSL for $9 / year and $99 for wildcard. Multi-domain (100 domains or subdomains) for $30. https://www.namecheap.com/security/ssl-certificates/comodo.aspx https://www.namecheap.com/security/ssl-certificates/comodo.a...
  - PaulBurke 13y ago
    Comodo Positive SSL for $9/Year offered by namecheap is really very much cheap in price, but there is one more SSL certificate vendor "CheapSSLSecurity" that offers comodo Positive SSL at only $5.99/Year and if you are purchasing it for 5 year then the price is most cheapest at $4.80. For Wildcard SSL Certificate I've found that "CheapSSLSecurity" offers it at $72.95/Year and $58.36 for 5 Year. I bet no one can beat CheapSSLSecurity's price.
- oijaf888 13y ago
  http://ipxcore.com/ssl/ http://ipxcore.com/ssl/ has GlobalSign certs for $15/year or $42/year for a wildcard
madsushi 13y ago
If it was a StartSSL security leak, then I would expect them to give away revocations for free. But if YOU, the customer, leaked your own private key by running some bad software? That's simply not their fault, nor their problem.
- serge2k 13y ago
  Why should revocations cost money?
  - epsylon 13y ago
    Why shouldn't they?
- oakwhiz 13y ago
  StartSSL is actually causing a problem, though. With a regular CA, you pay upfront, and you can revoke and reissue with no problems. If you trust a CA that does this, you can count on the fact that anybody buying a cert from that CA has the ability to grab a brand new certificate whenever they want until the expiration period. But with a CA like StartSSL, they give out certificates without guaranteeing that websites using those certificates have the ability to regenerate their certificate. If a website gets compromised, since they haven't paid upfront, you don't know if they will pay to reissue. They might just keep quiet and pretend there was no security breach, instead of doing the proper thing and renewing the certificate. If you know they paid upfront, you can be more sure that they will take advantage of the free renew upon a security breach. I find this issue to be vaguely similar to the difference between socialist healthcare systems and privatized healthcare systems. If everyone is guaranteed to have healthcare because it must be paid through their taxes, then people are generally healthier since they are encouraged to go to the doctor. But if you must pay a bill whenever you receive healthcare, people might be encouraged to forego treatment or checkups that could catch deadly diseases in an early phase before they become life-threatening. I don't really think this is a good analogy though because the other pros and cons of both healthcare systems don't map well to this problem.
  - ampersandy 13y ago
patio11 13y ago
Pathological customers: when you give them free stuff, they will demand more free stuff, and if you refuse them more free stuff, they will do their darndest to destroy your business. Meanwhile, look at all the nonsense that e.g. GoDaddy (who also charges for revocations) is not getting right now. Because the folks with altered understandings of reality got scared away by the $20 or whatever it costs on year 1, and are plaguing StartSSL instead.
- cpach 13y ago
  Business owners, beware. Try to find a business model that doesn’t attract patological customers.
- notdonspaulding 13y ago
  I wonder what percentage of StartSSL's customers are actually pathological though? I mean, are there cases where the pathological customer is a justifiable cost of doing business? Is StartSSL one of those cases?
- lucb1e 13y ago
  > Pathological customers: when you give them free stuff, they will demand more free stuff, and if you refuse them more free stuff, they will do their darndest to destroy your business. I guess you caught me. On the other hand, at the time I started using StartSSL, the cheapest non-free certificate provider I could find charged something like €70 a year, which was more than it was worth to me. Just two days ago I happened to look for cheap certificates again and found one for €9, and I'd totally pay that as long as my real name can stay anonymous (like now with StartSSL, my name isn't included in the certificate). So it also has much to do with how much you charge. Free is a special price and may make people ask for unreasonable things, but if the choice is between nothing or more than it was worth, that choice is very easy. Then when shit hits then fan...
- makomk 13y ago
  If you read the linked thread, some of their paying customers are apparently unhappy about being charged $25 per certificate to revoke them. (In some cases, this could cost substantially more than they paid for the certificates in the first place.)
gbl08ma 13y ago
I'm worried that StartSSL free certs will stop being trusted. I run a service (tny.im) where HTTPS is not essential, but I like to provide it, to secure logins if not for anything else. However, I make little to no money from that website, and so I rather not invest much money in it. By the price SSL certs go, if StartSSL became untrusted, I'd have no choice but remove SSL support, or issue my own certificate which is as bad as not having HTTPS. StartSSL plays an important role in ensuring that all websites, no matter how small, can provide https access. I recommend it to people that are just launching a service; their reaction often is like "SSL? You know how much that costs? I can barely pay for the server!" but they happily go through the trouble of installing a StartSSL cert when they understand that it will only cost them the effort. Without StartSSL these people would never implement https, if for some reason they didn't want to spend money with their project as is often the case with things done in their spare time. Personally this is even more disgusting, because I know for sure that my certificate has not been compromised: two days ago my service was hosted on a server with OpenSSL 0.9.8, and today I was forced to migrate to a new server due to issues unrelated to Heartbleed, and the certificate was not installed before updating OpenSSL to a patched version. And as some users have said, other people may be using StartSSL free certs on systems that don't even use OpenSSL. There's also something we should not forget: free StartSSL certificates are only valid for one year. That means that any cert will only be compromised for, at most, a year. My cert will expire in June, and then I'll be able to issue a new one, which (even if I wasn't sure the current one isn't) definitely isn't compromised.
- driverdan 13y ago
  You can't afford $20 a year for a cert? Drink a few less coffees during the year.
  - gbl08ma 13y ago
    Things add up, you know... $20 for a cert, plus $10 for a domain, and not even taking into account the server, it's $30. Now imagine you have five or six side-projects, you may not be willing to spend $150 per year to maintain them, especially when you get little to nothing in return. It's not like every website must have a profitable business plan just to be online and secure...
azov 13y ago
As an end-user I couldn't care less about CAs, their business models, and the way they handle revocations. All I care about is that if I see a lock icon in my address bar I can be sure that the page I'm looking at comes from whom I think it comes from. This is what should be driving Mozilla's decisions, not the moral aspects of charging for revocations.
- Perceptes 13y ago
  Very well stated. You should consider submitting this to their mailing list discussion on the topic.
digitalabyss 13y ago
Red Hat Enterprise Linux Server release 5.6 is still supported and ships with OpenSSL 0.9.8e which is not vulnerable. I am sure there are other examples as well. If I had a StartSSL certificate and the browsers started to remove support of them or warn that my site has a StartSSL certificate signed before a certain date and cant be trusted I would be really pissed. I have always felt there was conflict between system administrators wanting proven and stable versus developers wanting bleeding edge. I have given up the fight when it comes to web development and use Ubuntu 12.04LTS which still is not bleeding edge enough for most of my dev's. For infrastructure components outside of web development though I dont think its a safe assumption that people are on a vulnerable version. This is a prime example of why I would never give anything away free. Unrelated to SSL certificates; I rather throw out my old equipment than give it away since the people I give it too will never be happy and don't understand its free for a reason and demand support. The fact that you cant afford something better does not give you rights to it.
res0nat0r 13y ago
Shouldn't this post be titled: Most StartSSL certs will stay compromised because their customers are too cheap to pay to fix them?
- drdaeman 13y ago
  Right, but... I have about 30 certificates from StartSSL. Four second-level domains, and best security practices recommended having a separate key per service, so web server has its own keys, so is email server, XMPP and so on. The idea was that if one's compromised - others would hopefully remain safe. Call me names, but I'm not going to shell out $750.
dm2 13y ago
How long would it take their staff to revoke a single certificate? $25 seems expensive for something that can't take more than 5 minutes per certificate, unless there is more to it than I'm aware of. I guess it doesn't really matter to them if they lose several free customers. https://twitter.com/startssl/status/453631038883758080 https://twitter.com/startssl/status/453631038883758080 They're probably making a ton of money from this, in the long run I'm not sure it'll be worth it though.
- cpach 13y ago
  5 minutes of their employees’ time probably cost more than that. And of course it would be silly for a business like this to charge for cost instead of value.
  - dm2 13y ago
    Automate it and charge $1.
joeyh 13y ago
StartSSL revoked one of my certs on request the night Heartbleed came out. I mentioned heartbleed in the form. However, that was a $24.90 gamble.. They could just has easily billed me. Especially if you have a lot of different certs, that gamble may not be worth it. Also, I'm a paying customer, having gone through their process to get a wildcard cert. A free customer may have different results. And then, browsers don't check SSL cert revocations, and the infrastructure to check reovocations is apparently broken too. So this is a gamble with not much of a payoff.
felix 13y ago
Is there any actual data anywhere (ANYWHERE) that suggests this is the case? Or statistically more the case than any other CA with a more traditional payment model? Or is this hand wringing about the stupid people who got the free certificate from the stupid company that likes to give away free certificates but under normal circumstances they might actually charge people for some other part of the service that almost no one ever uses?

84 points by aroch 13y ago

Now this seems like something that StartSSL would want to be in front of rather than risk everything by having compromised certs out there with their name on them. I would think that kind of behavior would put their CA status at risk...

makomk 13y ago
They are in front of it, they've intentionally decided to continue charging for revoking these certificates.
- sigzero 13y ago
  Which they are 100% in the right to do by the way. StartSSL is a business.
  - MereInterest 13y ago
    And then people are 100% in the right to no longer trust StartSSL certificates.
    - wlesieutre 13y ago
      Or at the very least, StartSSL certs issued before yesterday.
      - aroch 13y ago
        No, any StartSSL cert. There are still unpatched systems and there likely will be for quite some time. Just because there's a CVE doesn't mean everyone updated
        wlesieutre 13y ago
        Sure, and there are also StartSSL certs used on systems that don't use OpenSSL. Do we just nuke every certificate, destroy their business, and force people with secure computers to buy new ones elsewhere even though their servers weren't affected by heartbleed? Because that option sucks too.
        claudius 13y ago
        As a user, I much prefer that my browser and my OS never ever again show a StartSSL-signed cert as valid over even just one compromised cert being displayed with a fancy lock. How StartSSL is going to achieve that, I don’t care, but neither do I care whether or not they go out of business over this.
    - shimon_e 13y ago
      Who is suppose to pay for staff time require to manually maintain the revoke list? BTW, revoking a cert doesn't stop it from being used in the wild as plenty of clients will still see it a valid cert. We are basically screwed until all current certs expire.
      - dpark 13y ago
        Why would the revoke list need manual maintenance? Are they running a root CA on pen and paper?
    - toomuchtodo 13y ago
      Who am I going to trust less? StartSSL certs? Or OpenSSL? I'm not saying I don't appreciate the hard work the two OpenSSL developers put into the code. But its incredulous that we're upset a business would give away a service due to an event completely out of its control.
      - pra 13y ago
        As it was out of the customers' control as well. Or should we have audited OpenSSL?
        toomuchtodo 13y ago
        I would argue that something that is the underlying component of e-commerce, privacy, and security for the majority of Internet activity should probably be audited.
    - latortuga 13y ago
      This is utterly ridiculous. These people signed up for a free SSL certificate knowing that revocations would cost them money. Enforcing a contract that both parties willingly agreed to does not make them untrustworthy, it demonstrates that their customers carry immense senses of entitlement. There are tons of SSL certificate providers out there. Their business model was not a secret when folks signed up.
      - sparkie 13y ago
        The business model an practices of the company are completely irrelevant to the people concerned in this case though - the users of the web browser. They never signed up for shit, and they have no incentive to trust a business which refuses to invoke compromised certs because people are unwilling to pay. Yes, this doesn't make them untrustworthy as a business, since their business model was known - it does make them untrustworthy as a party which is meant to be securing the web though - because they'll be failing at it spectacularly. Again: I never signed up to shit, and their business model means shit to me too - I just want some degree of security when browsing.
      - MereInterest 13y ago
        I am not their customer. At most, I am their customers' customer. Why do I have any obligation toward StartSSL? If StartSSL is free to choose a business model, then others are free to make judgment based on that business model. Should the customers of StartSSL pay the revocation fee? Yes. Should StartSSL be required to give free revocations? No. Are either of those at all relevant to whether or not I should trust StartSSL certificates, given that they are less likely to be revoked when they need to be revoked?
    - lern_too_spel 13y ago
      The other responders have no idea what you're talking about. You're right, of course, but I suspect most other CA's certificates should also not be trusted even though they don't have this revocation hurdle because a lot of these certificates were given to unsophisticated users who aren't going to revoke compromised certificates anyway.
    - bsder 13y ago
      By that logic, we should remove every CA. At least StartSSL will have good certificates for everybody in their free tier in 12 months. Can any of the other CA's make that claim? So, are you going to lead the charge at the rest of the CA's? And, I suspect that StartSSL couldn't possibly handle every single person calling them up to revoke a certificate right now. And that is NOT their fault--they didn't cause this bug.
    - epsylon 13y ago
      People would better be advised not to trust admins who can't shed 20 bucks for their users' security. Most likely these are the same admins to whom you certainly wouldn't want to give an email, password or any sort of confidential information.
revelation 13y ago
Their CA status is not at risk, was never at risk and will not be at risk in the future. Mozilla has made their stance clear that once you are in, you will never be removed (unless you were compromised, at which point they'll happily add your new CA). I'll certainly not claim that we can magically make TLS work by starting to enforce the requirements we put on CAs. But we should call Mozilla out for their strongly worded letters and other nonsense to get some momentum for better solutions. The first step is admitting you have a problem.
- klapinat0r 13y ago
  Incorrect. DigiNotar[1] was permanently removed. Quoting Mozilla[2]: "This is not a temporary suspension, it is a complete removal from our trusted root program." [1]: https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudule... [2]: https://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/ https://blog.mozilla.org/security/2011/09/02/diginotar-remov...
  - revelation 13y ago
    They were removed for being compromised and went bankrupt before trying again. I don't see how that invalidates what I said. Meanwhile, CAs that have issued CA=yes certs remain, but you know, Mozilla wrote them a letter reminding them on security best practices.
    - klapinat0r 13y ago
      True that they went bankrupt, but they filed on Sep 20th 2011, and the Mozilla decision to permanently remove them was a week prior or at least on Sep 2nd 2011; thus "unless you were compromised, at which point they'll happily add your new CA" is not correct. EDIT: To clearify, this is the phrase that we seem to be arguing about: Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort. (from the Mozilla Security Blog link above). They were effectively out in the cold, not "in once you're in" after the incident.

mike-cardwell 13y ago

They should have taken this as a marketting opportunity and offered up free revocations for a week.

akerl_ 13y ago
I think that would have been a successful PR move, but deciding if they're rather have the money or goodwill is their choice to make. They told people upfront what the costs were, I don't fault them for following through with that.

shimon_e 13y ago

If someone stole your certs you are basically screwed until they expire. Currently most browsers don't check if certs are revoked.

sanderjd 13y ago
This is a good point that seems to keep being ignored: do revocations even matter? Are browser makers planning on changing their defaults with regard to revocations? Is somebody planning a widespread consumer education campaign regarding revocation? If not, this whole issue seems like a bunch of noise that doesn't have much real impact.
- riquito 13y ago
  For example at Mozilla there are discussions about it, I suspect it's happening for other browsers too: https://lists.mozilla.org/listinfo/dev-security-policy https://lists.mozilla.org/listinfo/dev-security-policy
  - sanderjd 13y ago
    Any links to specific threads? I don't find anything when searching that list for "revocation" or "revoke", though there seem to be lots of threads about CAs in general, so maybe there's relevant discussion in some of those.
    - brohee 13y ago
      https://groups.google.com/forum/#!searchin/mozilla.dev.security.policy/OCSP/mozilla.dev.security.policy/mwmg2X74vlI/fYEljQnJVN4J https://groups.google.com/forum/#!searchin/mozilla.dev.secur... for example (3 years old). The right keyword to search for is OCSP, because CRLs are completely impractical in the browser. But then we have the issue that OCSP is a pretty retarded protocol. OCSP stapling helps with some issues, but there is still the issue that it doesn't really check if a certificate is valid, but whether a certificate bearing the given serial number is valid. Which didn't help AT ALL when using MD5 collisions people managed to create multiple certificates under the same serial number.

larkinrichards 13y ago

As a free SSL provider I think this is entirely valid for them to charge for revocations. Plus, it's entirely possible that not all people using certificates from StartSSL are using OpenSSL. It's the cert owner's prerogative to ensure their certificate is properly secured. There's no reason for debian/mozilla to remove StartSSL from their CA lists. If you have StartSSL and you used OpenSSL 1.01f or another vulnerable version, pay the $25 and move on-- it's cheaper than if you used godaddy.

steveklabnik 13y ago
It is totally valid for you to be a jerk, and then it is totally valid for other people to call you out on being a jerk. Yes, maintaining a revocation list costs them time and money. But this is a Big Deal. Extenuating circumstances. They have a social responsibility here, and they're failing at it.
- akerl_ 13y ago
  They do not have a social responsibility. It is totally valid for people to call them out for not going above and beyond, but that doesn't mean Mozilla/Debian/etc should be popping them out of CAs. The mob is welcome to mob, but Mozilla and Debian shouldn't be making decisions based on the whims of the mob.
  - steveklabnik 13y ago
    If you can't trust the certificates they produce, then they should be removed. And there will be a lot of valid-but-dangerous certs in the wild from them.
    - akerl_ 13y ago
      No more than from people who charge to reissue but not for revocation.
      - steveklabnik 13y ago

ridruejo 13y ago

What are good alternatives to StartSSL? Either free or moderately priced

sliverstorm 13y ago
I've been using PositiveSSL. I am paying less than $10 a year for a basic cert, revocation is free. I don't know anyone else who uses it, but there's nothing not to like so far, unless you are the sort who expects to pay nothing at all for your certs.
- yebyen 13y ago
  This is the SSL cert provider used by Namecheap, I just got my first SSL cert signed here, the experience was smooth. The longest delay in the whole process was from my own mailserver at the verifying site listed in the WHOIS record, which does greylisting (so it usually takes about 30 minutes to start exchanging mail with anyone you haven't received mail from before, since the server has to wait for them to retry...) The whole process was smooth as butter, $9 later I have SSL support on my site.
- PaulBurke 13y ago
  Today I was searching for PositiveSSL Certificate for my website. I Googled and found many online store offers PositiveSSL Certificate, but there were major difference on price. I've found some stores offers PositiveSSL at $49/Year, $19.95/Year, $12/Year, $9/Year & $5.99/Year. I want that PositiveSSL certificate for 5 Years. SO I've bought it from CheapSSLSEcurity at only $4.80/Year. I loved their service. The certificate was issued minute and its now live on my website. Thanks and Regards Paul Burke

notdonspaulding 13y ago

Let me see if I have this straight: Alice's Lemonade Stand charges $0.25 for a cup of ice-cold lemonade, and has a recycling bin that her customers can use for free. meanwhile, down the street: Bob's Lemonade Stand gives out free lemonade, and charges $0.25 to use their recycling bin. The message here is basically "boycott Bob for his anti-recycling business practices", right? Seems like a distinction without a difference to me.

aegiso 13y ago
Except the cups must be recycled where you bought them, and when they accidentally turn out to be super toxic Bob insists the recycling fee was clearly posted. I don't know who's right here, but it's definitely not that simple.
- akerl_ 13y ago
  It really is that simple. Bob didn't know the cups were toxic, there's no way he could have know, every lemonade stand had toxic cups, and he didn't raise the price of recycling in response. Bob isn't responsible for letting people off the hook due to circumstances outside of his control.
  - cpach 13y ago
    Well, this is not like the first time the TLS stack has a disastrous vulnerability. I think that giving out free certificates and charging for revocations is bad business since it sets bad incentives. Better then to charge upfront for issuing the certificates.
    - brohee 13y ago
      Because taking money to issue certificates sets good incentives...
      - cpach 13y ago
        Well, I’d say the most valuable data is generally TLS-protected. E.g. Gmail, Outlook.com, Dropbox, etc. I sure would like to see even better TLS adoption rates than what the web currently has, but I don’t think that we should compromise the trustworthiness of the certificates in order to achieve this goal. What makes the CA-issued certificates trustworthy is that they are in fact verified to belong to the legitimate owner of the domain. Doing the verification and maintaining the CA’s infrastructure is not free so I don’t think it’s very surprising that the vendors charge for their service.

mapgrep 13y ago

Are there any cert providers who have particularly solid reputations? I get basic certs via my domain provider Gandi, they run ~$17 year (12 euros), or $160 for wildcard which seems steep.

dm2 13y ago
Comodo PositiveSSL for $9 / year and $99 for wildcard. Multi-domain (100 domains or subdomains) for $30. https://www.namecheap.com/security/ssl-certificates/comodo.aspx https://www.namecheap.com/security/ssl-certificates/comodo.a...
- PaulBurke 13y ago
  Comodo Positive SSL for $9/Year offered by namecheap is really very much cheap in price, but there is one more SSL certificate vendor "CheapSSLSecurity" that offers comodo Positive SSL at only $5.99/Year and if you are purchasing it for 5 year then the price is most cheapest at $4.80. For Wildcard SSL Certificate I've found that "CheapSSLSecurity" offers it at $72.95/Year and $58.36 for 5 Year. I bet no one can beat CheapSSLSecurity's price.
oijaf888 13y ago
http://ipxcore.com/ssl/ http://ipxcore.com/ssl/ has GlobalSign certs for $15/year or $42/year for a wildcard

madsushi 13y ago

If it was a StartSSL security leak, then I would expect them to give away revocations for free. But if YOU, the customer, leaked your own private key by running some bad software? That's simply not their fault, nor their problem.

serge2k 13y ago
Why should revocations cost money?
- epsylon 13y ago
  Why shouldn't they?
oakwhiz 13y ago
StartSSL is actually causing a problem, though. With a regular CA, you pay upfront, and you can revoke and reissue with no problems. If you trust a CA that does this, you can count on the fact that anybody buying a cert from that CA has the ability to grab a brand new certificate whenever they want until the expiration period. But with a CA like StartSSL, they give out certificates without guaranteeing that websites using those certificates have the ability to regenerate their certificate. If a website gets compromised, since they haven't paid upfront, you don't know if they will pay to reissue. They might just keep quiet and pretend there was no security breach, instead of doing the proper thing and renewing the certificate. If you know they paid upfront, you can be more sure that they will take advantage of the free renew upon a security breach. I find this issue to be vaguely similar to the difference between socialist healthcare systems and privatized healthcare systems. If everyone is guaranteed to have healthcare because it must be paid through their taxes, then people are generally healthier since they are encouraged to go to the doctor. But if you must pay a bill whenever you receive healthcare, people might be encouraged to forego treatment or checkups that could catch deadly diseases in an early phase before they become life-threatening. I don't really think this is a good analogy though because the other pros and cons of both healthcare systems don't map well to this problem.
- ampersandy 13y ago

patio11 13y ago

Pathological customers: when you give them free stuff, they will demand more free stuff, and if you refuse them more free stuff, they will do their darndest to destroy your business. Meanwhile, look at all the nonsense that e.g. GoDaddy (who also charges for revocations) is not getting right now. Because the folks with altered understandings of reality got scared away by the $20 or whatever it costs on year 1, and are plaguing StartSSL instead.

cpach 13y ago
Business owners, beware. Try to find a business model that doesn’t attract patological customers.
notdonspaulding 13y ago
I wonder what percentage of StartSSL's customers are actually pathological though? I mean, are there cases where the pathological customer is a justifiable cost of doing business? Is StartSSL one of those cases?
lucb1e 13y ago
> Pathological customers: when you give them free stuff, they will demand more free stuff, and if you refuse them more free stuff, they will do their darndest to destroy your business. I guess you caught me. On the other hand, at the time I started using StartSSL, the cheapest non-free certificate provider I could find charged something like €70 a year, which was more than it was worth to me. Just two days ago I happened to look for cheap certificates again and found one for €9, and I'd totally pay that as long as my real name can stay anonymous (like now with StartSSL, my name isn't included in the certificate). So it also has much to do with how much you charge. Free is a special price and may make people ask for unreasonable things, but if the choice is between nothing or more than it was worth, that choice is very easy. Then when shit hits then fan...
makomk 13y ago
If you read the linked thread, some of their paying customers are apparently unhappy about being charged $25 per certificate to revoke them. (In some cases, this could cost substantially more than they paid for the certificates in the first place.)

gbl08ma 13y ago

I'm worried that StartSSL free certs will stop being trusted. I run a service (tny.im) where HTTPS is not essential, but I like to provide it, to secure logins if not for anything else. However, I make little to no money from that website, and so I rather not invest much money in it. By the price SSL certs go, if StartSSL became untrusted, I'd have no choice but remove SSL support, or issue my own certificate which is as bad as not having HTTPS. StartSSL plays an important role in ensuring that all websites, no matter how small, can provide https access. I recommend it to people that are just launching a service; their reaction often is like "SSL? You know how much that costs? I can barely pay for the server!" but they happily go through the trouble of installing a StartSSL cert when they understand that it will only cost them the effort. Without StartSSL these people would never implement https, if for some reason they didn't want to spend money with their project as is often the case with things done in their spare time. Personally this is even more disgusting, because I know for sure that my certificate has not been compromised: two days ago my service was hosted on a server with OpenSSL 0.9.8, and today I was forced to migrate to a new server due to issues unrelated to Heartbleed, and the certificate was not installed before updating OpenSSL to a patched version. And as some users have said, other people may be using StartSSL free certs on systems that don't even use OpenSSL. There's also something we should not forget: free StartSSL certificates are only valid for one year. That means that any cert will only be compromised for, at most, a year. My cert will expire in June, and then I'll be able to issue a new one, which (even if I wasn't sure the current one isn't) definitely isn't compromised.

driverdan 13y ago
You can't afford $20 a year for a cert? Drink a few less coffees during the year.
- gbl08ma 13y ago
  Things add up, you know... $20 for a cert, plus $10 for a domain, and not even taking into account the server, it's $30. Now imagine you have five or six side-projects, you may not be willing to spend $150 per year to maintain them, especially when you get little to nothing in return. It's not like every website must have a profitable business plan just to be online and secure...

azov 13y ago

As an end-user I couldn't care less about CAs, their business models, and the way they handle revocations. All I care about is that if I see a lock icon in my address bar I can be sure that the page I'm looking at comes from whom I think it comes from. This is what should be driving Mozilla's decisions, not the moral aspects of charging for revocations.

Perceptes 13y ago
Very well stated. You should consider submitting this to their mailing list discussion on the topic.

digitalabyss 13y ago

Red Hat Enterprise Linux Server release 5.6 is still supported and ships with OpenSSL 0.9.8e which is not vulnerable. I am sure there are other examples as well. If I had a StartSSL certificate and the browsers started to remove support of them or warn that my site has a StartSSL certificate signed before a certain date and cant be trusted I would be really pissed. I have always felt there was conflict between system administrators wanting proven and stable versus developers wanting bleeding edge. I have given up the fight when it comes to web development and use Ubuntu 12.04LTS which still is not bleeding edge enough for most of my dev's. For infrastructure components outside of web development though I dont think its a safe assumption that people are on a vulnerable version. This is a prime example of why I would never give anything away free. Unrelated to SSL certificates; I rather throw out my old equipment than give it away since the people I give it too will never be happy and don't understand its free for a reason and demand support. The fact that you cant afford something better does not give you rights to it.

res0nat0r 13y ago

Shouldn't this post be titled: Most StartSSL certs will stay compromised because their customers are too cheap to pay to fix them?

drdaeman 13y ago
Right, but... I have about 30 certificates from StartSSL. Four second-level domains, and best security practices recommended having a separate key per service, so web server has its own keys, so is email server, XMPP and so on. The idea was that if one's compromised - others would hopefully remain safe. Call me names, but I'm not going to shell out $750.

dm2 13y ago

How long would it take their staff to revoke a single certificate? $25 seems expensive for something that can't take more than 5 minutes per certificate, unless there is more to it than I'm aware of. I guess it doesn't really matter to them if they lose several free customers. https://twitter.com/startssl/status/453631038883758080 https://twitter.com/startssl/status/453631038883758080 They're probably making a ton of money from this, in the long run I'm not sure it'll be worth it though.

cpach 13y ago
5 minutes of their employees’ time probably cost more than that. And of course it would be silly for a business like this to charge for cost instead of value.
- dm2 13y ago
  Automate it and charge $1.

joeyh 13y ago

StartSSL revoked one of my certs on request the night Heartbleed came out. I mentioned heartbleed in the form. However, that was a $24.90 gamble.. They could just has easily billed me. Especially if you have a lot of different certs, that gamble may not be worth it. Also, I'm a paying customer, having gone through their process to get a wildcard cert. A free customer may have different results. And then, browsers don't check SSL cert revocations, and the infrastructure to check reovocations is apparently broken too. So this is a gamble with not much of a payoff.

felix 13y ago

Is there any actual data anywhere (ANYWHERE) that suggests this is the case? Or statistically more the case than any other CA with a more traditional payment model? Or is this hand wringing about the stupid people who got the free certificate from the stupid company that likes to give away free certificates but under normal circumstances they might actually charge people for some other part of the service that almost no one ever uses?