4 ms·
The $24.90 fee also applies to paying Class 2 customers. Only EV certificates get free revocation from StartCom. My own personal blog (not very critical) has a
by guan 13y ago
The $24.90 fee also applies to paying Class 2 customers. Only EV certificates get free revocation from StartCom.
My own personal blog (not very critical) has a Class 2 certificate, and I decided to switch to a Comodo PositiveSSL ($5/year for 5 years) and not revoke the StartSSL one.
- pezz 13y agoExactly what I did. I mean, damn people who use a free thing that then get screwed, through no fault of their own, not wanting to be charged $25 for a part of the service that they would never need to use otherwise. You're either free, or you're not -- StartSSL is a mish-mash of "free" and opportunistic costs.
- guan 13y agoI think some people are exaggerating how aware Class 1 customers were of the revocation policy. It’s in the FAQ, but the site also advertises “100% Free”. I think the expectation is that free services have automated infrastructure, and that they’re a way to advertise your paid services—and I did, in fact, start out as a Class 1 and later paid for Class 2.
- yeukhon 13y agoI don't see where it said $5/year. Right now it costs $50 per year. EDIT: Are resellers like them more trustworthy? I understand that big CA often sells out to smaller CA and smaller CA sell out to even smaller CA. But how trustworthy are ssls.com and namecheap? EDIT Okay. I see. namecheap has been running since 2001 which means it has been doing business pretty well :) So why are they cheaper? Because namecheap are the one managing all the accounts and Comondo is only doing validation?
- jgillich 13y agoIt's a lot cheaper when you buy it through resellers (like NameCheap).
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- guan 13y agoI went through ssls.com, which for some reason is cheaper than Namecheap even though they’re owned by Namecheap.
- aroch 13y agohttp://cheapsslsecurity.com/ http://cheapsslsecurity.com/ is one such reseller. I use them for cheap PossitiveSSL certs for my sites.
- jeremyjh 13y agoI'm really confused. If you think your original certificate may have been compromised, the only reason to get a new certificate would be to protect your users from a MITM attack. Since you have not revoked your old certificate, you have done nothing to reduce this risk.
- guan 13y agoThis is all kind of pointless for my silly personal blog, so you could view it as a symbolic way of registering my displeasure with StartCom ;-) To answer your question, suppose I think my key has been compromised. Then I don’t want to continue using that key because non-MITM’ed communication between my server and the client is compromised. So I generate a new key, and I’d like a a new certificate for that new key—the old one won’t work (Apple Secure Transport bug notwithstanding). My users are still vulnerable to a MITM attack, yes. --edit: assuming that the user’s connection uses a non-PFS cipher suite.
- guan 13y agoTo put it more succinctly: my private key has potentially been compromised, not my certificate. By generating a new private key (which implies a new certificate), I can protect against non-MITM eavesdropping for non-PFS ciphers.