4 ms·

Slightly off-topic but, in your opinion, how does StartSSL compare to CAcert? I'm about to jump and would like to know where I'm landing.

LeoPanthera 12y ago
The CAcert root cert is trusted almost nowhere, so they are not comparable. StartSSL certs are trusted by almost all major OSs and browsers.
- igravious 12y ago
  Thank you kind sir, good to know - hope this helps someone. I had the impression that CAcert were fairly legit.
  - e12e 12y ago
    They are, but they're not included in various browsers for various reasons -- so they are "legit", but they are not easy to use for use-cases where you don't have a modicum of control over clients (can install, or ask clients to install, cacert root keys). Please don't suggest that cacert is much less secure than trusting a handful of government CAs by default (or even much less secure than certain commercial CAs). Cacert isn't perfect, but it is an interesting and important project. It's a pity Debian ended up stripping cacert IMNHO. Anyway, it is healthy to be sceptical, for some more info, see eg: http://lwn.net/Articles/590879/ http://lwn.net/Articles/590879/
dspillett 12y ago
I've not used CACert since investigating a few years ago. At that time it was the case that their CA certs were not trusted by many platforms (i.e. most Windows users) so if you have users on those platforms their certificates are no better than self-signed ones for those users - this made them unacceptable for what I was doing at the time. If http://en.wikipedia.org/wiki/CAcert.org http://en.wikipedia.org/wiki/CAcert.org is up-to-date then this has not changed. StartSSL's certificates are accepted by all major platforms (including all Windows desktop variants from XP upwards since ~2009), though there are gaps in this coverage. The stock browser and mail client in at least some relatively recent variants of Windows Phone didn't like them last time I tried. They should be trusted by Android since 2.2, though I believe there are issues with some builds of 2.2/2.3.x (I've not heard of trouble with later versions). StartSSL's interface can be quite clunky but I've never had it fail. Certificates usually come through in good time (often faster than certain paid certificates I could mention). The "non commercial use" clause added to the terms for the free certificates in recent times may be a problem for some. As I've not really used CACert I can't comment on how they compare on these matters.

LeoPanthera 12y ago

The CAcert root cert is trusted almost nowhere, so they are not comparable. StartSSL certs are trusted by almost all major OSs and browsers.

igravious 12y ago
Thank you kind sir, good to know - hope this helps someone. I had the impression that CAcert were fairly legit.
- e12e 12y ago
  They are, but they're not included in various browsers for various reasons -- so they are "legit", but they are not easy to use for use-cases where you don't have a modicum of control over clients (can install, or ask clients to install, cacert root keys). Please don't suggest that cacert is much less secure than trusting a handful of government CAs by default (or even much less secure than certain commercial CAs). Cacert isn't perfect, but it is an interesting and important project. It's a pity Debian ended up stripping cacert IMNHO. Anyway, it is healthy to be sceptical, for some more info, see eg: http://lwn.net/Articles/590879/ http://lwn.net/Articles/590879/

dspillett 12y ago

I've not used CACert since investigating a few years ago. At that time it was the case that their CA certs were not trusted by many platforms (i.e. most Windows users) so if you have users on those platforms their certificates are no better than self-signed ones for those users - this made them unacceptable for what I was doing at the time. If http://en.wikipedia.org/wiki/CAcert.org http://en.wikipedia.org/wiki/CAcert.org is up-to-date then this has not changed. StartSSL's certificates are accepted by all major platforms (including all Windows desktop variants from XP upwards since ~2009), though there are gaps in this coverage. The stock browser and mail client in at least some relatively recent variants of Windows Phone didn't like them last time I tried. They should be trusted by Android since 2.2, though I believe there are issues with some builds of 2.2/2.3.x (I've not heard of trouble with later versions). StartSSL's interface can be quite clunky but I've never had it fail. Certificates usually come through in good time (often faster than certain paid certificates I could mention). The "non commercial use" clause added to the terms for the free certificates in recent times may be a problem for some. As I've not really used CACert I can't comment on how they compare on these matters.