4 ms·

http://startssl.com/ http://startssl.com/ . $0/year. No bullshit.

by jvehent 12y ago

pdw 12y ago
Well, as long as you don't want to revoke your certificate...
- mkonecny 12y ago
  Yep, costs some money to revoke, and in light of heartbleed, they probably made some money. But I like the fact I can re-issue unlimited certificates forever, and pay for revocation only when the rare heartbleed-like vulnerability happens.
iancarroll 12y ago
$60 if you want to use it commercially...
- xcrunner529 12y ago
  Yep. cannot be used commercially. People forget that.
- techsupporter 12y ago
  $120 if you want to use a business name. $60 for individual validation (that's a pain in the hind end) and $60 for business name (which involves handing over tax records and private information about business operators).
  - mmastrac 12y ago
    I didn't have to hand over private information beyond my address -- I sent them my incorporation records and a way to verify the company existed in the public register. I completed the entire business validation in a single night.
ceejayoz 12y ago
Having gone through both systems, $2 isn't much to pay for a much better experience.
wlesieutre 12y ago
The revocation fee that everyone had to pay after heartbleed could be described as bullshit.
- dmm 12y ago
  They charge for things that impose costs on them: hosting revocation info and higher levels of identity verification.
  - Karunamon 12y ago
    The CRL file(s) could be hosted on any CDN worth their salt for less than the price of 4 people regenerating certs. SNI is also an option for newer clients. It's pure profit/rent seeking. That same $25 applies regardless of the reason. OpenSSL compromised? Fuck you, pay me. Miskeyed the CN? Fuck you, pay me. Want a different type of cert for the same domain? (XMPP instead of web?) Fuck you, pay me. You get the idea. It doesn't cost $25 for a few byte fingerprint to be automatically appended to the end of a file. In some of these cases they don't even need to revoke the other cert, just delete the erroneously created one from their system because it was never used anyways! Never mind the fact that their UI would have been an embarrassment a decade ago, and they absolutely require certificate-based login to get into the UI, which is a huge PITA.
    - iancarroll 12y ago
      > The CRL file(s) could be hosted on any CDN worth their salt for less than the price of 4 people regenerating certs. SNI is also an option for newer clients. Have you seen the article with Cloudflare and Globalsign's CRL?
Artemis2 12y ago
It's pretty bad though. Remember Heartbleed when people couldn't revoke their compromised certificates? Also, if you read the Namecheap promotion page, they explain that they are donating $0.5 to Fight for the Future for every purchased certificate.
- icebraining 12y ago
  Also, if you read the Namecheap promotion page, they explain that they are donating $0.5 to Fight for the Future for every purchased certificate. Yes, but you can donate almost 4x that with the money you save. It's hardly a reason to choose Namecheap. I always found those "$x from your purchase will be donated" annoying. How about you let me keep my $0.5 and I'll donate it to whoever I want? I might not even want to support the organization they chose!
- mikeash 12y ago
  You mean, when people didn't want to pay $25 to revoke compromised certificates. It's not like this was a secret or people couldn't afford it. They just felt that they should get something for free that the other party thought should have a price.
- tzs 12y ago
  > Also, if you read the Namecheap promotion page, they explain that they are donating $0.5 to Fight for the Future for every purchased certificate I don't trust Fight for the Future. Too many times I've gone to the page for one of their causes, and found a prominent form asking for my email, sensationalistic claims about the issue that included outright factual errors, and no link to the actual text of whatever bill they were up in arms about. Why not donate to the EFF instead? The EFF is occasionally wrong, too, but I never get the impression when the EFF is wrong that they are deliberately being wrong in order to stir up more interest. Also, EFF donations are tax deductible.
ivraatiems 12y ago
I tried to use StartSSL to secure a small non-profit website which happened to (totally separately) process donations through PayPal, and I was unable to get them to comprehend that PayPal provides its own security and their certificate would not be involved in any monetary transactions. They insisted they couldn't authorize a certificate for an organization that dealt with money in any way, which, as far as I know, disqualifies essentially every organization ever. So yeah, $0/year, but definitely not "no bullshit."

http://startssl.com/ http://startssl.com/ . $0/year. No bullshit.

by jvehent 12y ago

http://startssl.com/ http://startssl.com/ . $0/year. No bullshit.

pdw 12y ago

Well, as long as you don't want to revoke your certificate...

mkonecny 12y ago
Yep, costs some money to revoke, and in light of heartbleed, they probably made some money. But I like the fact I can re-issue unlimited certificates forever, and pay for revocation only when the rare heartbleed-like vulnerability happens.

iancarroll 12y ago

$60 if you want to use it commercially...

xcrunner529 12y ago
Yep. cannot be used commercially. People forget that.
techsupporter 12y ago
$120 if you want to use a business name. $60 for individual validation (that's a pain in the hind end) and $60 for business name (which involves handing over tax records and private information about business operators).
- mmastrac 12y ago
  I didn't have to hand over private information beyond my address -- I sent them my incorporation records and a way to verify the company existed in the public register. I completed the entire business validation in a single night.

ceejayoz 12y ago

Having gone through both systems, $2 isn't much to pay for a much better experience.

wlesieutre 12y ago

The revocation fee that everyone had to pay after heartbleed could be described as bullshit.

dmm 12y ago
They charge for things that impose costs on them: hosting revocation info and higher levels of identity verification.
- Karunamon 12y ago
  The CRL file(s) could be hosted on any CDN worth their salt for less than the price of 4 people regenerating certs. SNI is also an option for newer clients. It's pure profit/rent seeking. That same $25 applies regardless of the reason. OpenSSL compromised? Fuck you, pay me. Miskeyed the CN? Fuck you, pay me. Want a different type of cert for the same domain? (XMPP instead of web?) Fuck you, pay me. You get the idea. It doesn't cost $25 for a few byte fingerprint to be automatically appended to the end of a file. In some of these cases they don't even need to revoke the other cert, just delete the erroneously created one from their system because it was never used anyways! Never mind the fact that their UI would have been an embarrassment a decade ago, and they absolutely require certificate-based login to get into the UI, which is a huge PITA.
  - iancarroll 12y ago
    > The CRL file(s) could be hosted on any CDN worth their salt for less than the price of 4 people regenerating certs. SNI is also an option for newer clients. Have you seen the article with Cloudflare and Globalsign's CRL?

Artemis2 12y ago

It's pretty bad though. Remember Heartbleed when people couldn't revoke their compromised certificates? Also, if you read the Namecheap promotion page, they explain that they are donating $0.5 to Fight for the Future for every purchased certificate.

icebraining 12y ago
Also, if you read the Namecheap promotion page, they explain that they are donating $0.5 to Fight for the Future for every purchased certificate. Yes, but you can donate almost 4x that with the money you save. It's hardly a reason to choose Namecheap. I always found those "$x from your purchase will be donated" annoying. How about you let me keep my $0.5 and I'll donate it to whoever I want? I might not even want to support the organization they chose!
mikeash 12y ago
You mean, when people didn't want to pay $25 to revoke compromised certificates. It's not like this was a secret or people couldn't afford it. They just felt that they should get something for free that the other party thought should have a price.
tzs 12y ago
> Also, if you read the Namecheap promotion page, they explain that they are donating $0.5 to Fight for the Future for every purchased certificate I don't trust Fight for the Future. Too many times I've gone to the page for one of their causes, and found a prominent form asking for my email, sensationalistic claims about the issue that included outright factual errors, and no link to the actual text of whatever bill they were up in arms about. Why not donate to the EFF instead? The EFF is occasionally wrong, too, but I never get the impression when the EFF is wrong that they are deliberately being wrong in order to stir up more interest. Also, EFF donations are tax deductible.

ivraatiems 12y ago

I tried to use StartSSL to secure a small non-profit website which happened to (totally separately) process donations through PayPal, and I was unable to get them to comprehend that PayPal provides its own security and their certificate would not be involved in any monetary transactions. They insisted they couldn't authorize a certificate for an organization that dealt with money in any way, which, as far as I know, disqualifies essentially every organization ever. So yeah, $0/year, but definitely not "no bullshit."