7 ms·

Free SSL certificate for pretty much anyone: https://startssl.com/ https://startssl.com/ Why do people pay for SSL certificates

by finnn 12y ago

dubcanada 12y ago
startssl free is not allowed to be used on commercial projects according to their policy (3.1.2.1). You must use Class 2 or higher for commercial.
- 0x0 12y ago
  And even then, they might grant you a certificate for a domain one day, and the next time you renew or even pay for a revocation (think heartbleed), they may put it on the revocation list and then proceed to delay for a manual review for hours or even days, and then decide your random domain is registered by your client instead of yourself, and you cannot renew even if you can prove domain validation. They used to be cool, but recently they have become a major hassle to the point where it's faster and easier to just pay per certificate at more conventional CAs like those reselling instantssl. If your time has an hourly price, you'll probably even save money. Edit: I'm sure it's a noble goal that they do not want to certify domains they cannot prove are owned by the customer, but it doesn't really do much good in practice when the CA next door will happily issue a certificate as long as you can read administrative email for the domain.
- simonbrown 12y ago
  Neither is this.
dm2 12y ago
I do not recommend StartSSL. Their $25 fee for revocation during the Heartbleed situation left many of their users who could not pay their fee vulnerable to attack. During these extenuating circumstances you would expect them to offer the revocation for a discounted price or even free, but they did not. I did not have any certificates registered with them and am very glad I didn't. I imagine that there are a huge amount of StartSSL users who cannot pay the $25 per certificate and have no choice but to leave their server vulnerable. This was pure short-sighted greed on the part of StartSSL. I'd strongly recommend https://www.namecheap.com/security/ssl-certificates/comodo.aspx https://www.namecheap.com/security/ssl-certificates/comodo.a... It's a great price and their support has been excellent in my experience. If you have an open source project then the GlobalSign free certificate is hard to beat.
- fletchowns 12y ago
  That is a terrible reason not to recommend StartSSL. They were under no obligation to offer revocation for free. If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways.
  - scrollaway 12y ago
    > If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways. That is a terrible reason to recommend against SSL.
  - dm2 12y ago
    The parent comment recommended StartSSL, I was simply stating my opinion of the company and informing people that there is a catch when using their service. If you obtain a free certificate then $25 per certificate probably is an issue, especially since there is no guarantee that this won't happen again in the near future. Many people probably have several subdomains which needed certificates, $25 per subdomain can add up quickly if you have several. No, they were not obligated to offer revocation for free, but a significantly discounted price would have allowed a much larger percentage of people to revoke their certificates. It's not too much different than extortion, since many people who obtain free certificates are not aware of the possibility of the need to revoke a certificate, then they are basically screwed when they are forced to either pay up or have their server left insecure. Hypothetical Situation: If I start a free SSL cert service and put in my terms that there is a $1,000 revocation fee, would that be acceptable? Many people would signup without thinking they would never need to revoke a certificate, then another Heartbleed-like situation occurs and many of your users have servers that are at risk without revocation, would it be acceptable to say, "Oh well, pay up or else someone could hack your servers".
    - justincormack 12y ago
      Also its a terrible business model, unless you have a side job finding openssl vulnerabilities. Its just a windfall not predictable revenue.

Free SSL certificate for pretty much anyone: https://startssl.com/ https://startssl.com/ Why do people pay for SSL certificates

by finnn 12y ago

Free SSL certificate for pretty much anyone: https://startssl.com/ https://startssl.com/ Why do people pay for SSL certificates

dubcanada 12y ago

startssl free is not allowed to be used on commercial projects according to their policy (3.1.2.1). You must use Class 2 or higher for commercial.

0x0 12y ago
And even then, they might grant you a certificate for a domain one day, and the next time you renew or even pay for a revocation (think heartbleed), they may put it on the revocation list and then proceed to delay for a manual review for hours or even days, and then decide your random domain is registered by your client instead of yourself, and you cannot renew even if you can prove domain validation. They used to be cool, but recently they have become a major hassle to the point where it's faster and easier to just pay per certificate at more conventional CAs like those reselling instantssl. If your time has an hourly price, you'll probably even save money. Edit: I'm sure it's a noble goal that they do not want to certify domains they cannot prove are owned by the customer, but it doesn't really do much good in practice when the CA next door will happily issue a certificate as long as you can read administrative email for the domain.
simonbrown 12y ago
Neither is this.

dm2 12y ago

I do not recommend StartSSL. Their $25 fee for revocation during the Heartbleed situation left many of their users who could not pay their fee vulnerable to attack. During these extenuating circumstances you would expect them to offer the revocation for a discounted price or even free, but they did not. I did not have any certificates registered with them and am very glad I didn't. I imagine that there are a huge amount of StartSSL users who cannot pay the $25 per certificate and have no choice but to leave their server vulnerable. This was pure short-sighted greed on the part of StartSSL. I'd strongly recommend https://www.namecheap.com/security/ssl-certificates/comodo.aspx https://www.namecheap.com/security/ssl-certificates/comodo.a... It's a great price and their support has been excellent in my experience. If you have an open source project then the GlobalSign free certificate is hard to beat.

fletchowns 12y ago
That is a terrible reason not to recommend StartSSL. They were under no obligation to offer revocation for free. If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways.
- scrollaway 12y ago
  > If $25 is that much a problem you probably shouldn't be trying to run a secure server anyways. That is a terrible reason to recommend against SSL.
- dm2 12y ago
  The parent comment recommended StartSSL, I was simply stating my opinion of the company and informing people that there is a catch when using their service. If you obtain a free certificate then $25 per certificate probably is an issue, especially since there is no guarantee that this won't happen again in the near future. Many people probably have several subdomains which needed certificates, $25 per subdomain can add up quickly if you have several. No, they were not obligated to offer revocation for free, but a significantly discounted price would have allowed a much larger percentage of people to revoke their certificates. It's not too much different than extortion, since many people who obtain free certificates are not aware of the possibility of the need to revoke a certificate, then they are basically screwed when they are forced to either pay up or have their server left insecure. Hypothetical Situation: If I start a free SSL cert service and put in my terms that there is a $1,000 revocation fee, would that be acceptable? Many people would signup without thinking they would never need to revoke a certificate, then another Heartbleed-like situation occurs and many of your users have servers that are at risk without revocation, would it be acceptable to say, "Oh well, pay up or else someone could hack your servers".
  - justincormack 12y ago
    Also its a terrible business model, unless you have a side job finding openssl vulnerabilities. Its just a windfall not predictable revenue.