4 ms·

If they cannot afford $25 to revoke and change out their SSL certificate I doubt they are protecting very sensitive information.

drdaeman 12y ago
I'm using StartSSL just because I hadn't any excuses to answer the question "why not?" and they were the best looking (free, reasonably usable, trusted enough) option on the market. They offer unlimited free certificates, so, naturally, I've issued one per service (they even encourage that with "web server"/"xmpp server" certificate distinction). I.e., a separate one for mail server, a separate one for HTTP server, a separate one for XMPP server and so on. Naturally, I expected that it's more likely for one service to break (i.e., say, for nginx to have some buffer overflow that'd allow extracting the keys) than all of them, like it was the case with Heartbleed. That means, revocation would cost me not $25, but $600. Can't afford that. Luckily, the most sensitive information I protect are my own emails, 99% of which are spam and service notifications.
- vacri 12y ago
  Using NameCheap above instead would cost you $200/year, instead of $0/year + $600 for a black swan event. "Replace ALL your SSL certificate" events seem to happen less often than once every three years.
  - aroch 12y ago
    Wildcard certs cost $60/year, protect everything on one certificate with free reissues and revocation, and cheap rekeying (which was an option for heartbleed recovery). I would rather pay the "SSL racket" (as StartSSL would put it) to get real service and help than use a free cert from them. StartSSL is permanently removed from all my truststores following heartbleed
blibble 12y ago
this is a reasonable argument, except it's generally considered best practise not to share private keys across servers (most CAs explicitly forbid this in their deeply buried policy files), which also rules out wildcards. StartCom is appealing as they'll issue as many certificates as you want for a one-off fee. so I had protected my service against parts of it being compromised, but then I was screwed over completely by heartbleed. 50 certs? that'll be $1250
- iancarroll 12y ago
  Most CA's is not true. Globalsign offers free unlimited servers, so does Comodo and Gandi. The only CA that really limits on servers is Symantec.
  - wut42 12y ago
    I think drdaeman meant _certificates_ and not _servers_. One certificate can be used on multiple servers, but you can't create multiple certificates “for free“ on Comodo,Gandi or GlobalSSL. You're charged for every cert. I'm using StartSSL verified, it costed me 99$ (personal verification) plus 99$ (company certification), and I can create any certificate I want, at any time, valid for two years and wildcard included. Since my company provides custom subdomains for clients, and every client can have multiple subdomains on his own subdomain, we can't afford the price for every client. (I know we should charge them, but this issue is out of my hand). The 25$ revocation fee sucks, yeah.. but StartSSL has his advantages too. (edit: typo.)
    - iancarroll 12y ago
      Ah. Digicert offers what you want with their wild cards, FYI.

drdaeman 12y ago

I'm using StartSSL just because I hadn't any excuses to answer the question "why not?" and they were the best looking (free, reasonably usable, trusted enough) option on the market. They offer unlimited free certificates, so, naturally, I've issued one per service (they even encourage that with "web server"/"xmpp server" certificate distinction). I.e., a separate one for mail server, a separate one for HTTP server, a separate one for XMPP server and so on. Naturally, I expected that it's more likely for one service to break (i.e., say, for nginx to have some buffer overflow that'd allow extracting the keys) than all of them, like it was the case with Heartbleed. That means, revocation would cost me not $25, but $600. Can't afford that. Luckily, the most sensitive information I protect are my own emails, 99% of which are spam and service notifications.

vacri 12y ago
Using NameCheap above instead would cost you $200/year, instead of $0/year + $600 for a black swan event. "Replace ALL your SSL certificate" events seem to happen less often than once every three years.
- aroch 12y ago
  Wildcard certs cost $60/year, protect everything on one certificate with free reissues and revocation, and cheap rekeying (which was an option for heartbleed recovery). I would rather pay the "SSL racket" (as StartSSL would put it) to get real service and help than use a free cert from them. StartSSL is permanently removed from all my truststores following heartbleed

blibble 12y ago

this is a reasonable argument, except it's generally considered best practise not to share private keys across servers (most CAs explicitly forbid this in their deeply buried policy files), which also rules out wildcards. StartCom is appealing as they'll issue as many certificates as you want for a one-off fee. so I had protected my service against parts of it being compromised, but then I was screwed over completely by heartbleed. 50 certs? that'll be $1250

iancarroll 12y ago
Most CA's is not true. Globalsign offers free unlimited servers, so does Comodo and Gandi. The only CA that really limits on servers is Symantec.
- wut42 12y ago
  I think drdaeman meant _certificates_ and not _servers_. One certificate can be used on multiple servers, but you can't create multiple certificates “for free“ on Comodo,Gandi or GlobalSSL. You're charged for every cert. I'm using StartSSL verified, it costed me 99$ (personal verification) plus 99$ (company certification), and I can create any certificate I want, at any time, valid for two years and wildcard included. Since my company provides custom subdomains for clients, and every client can have multiple subdomains on his own subdomain, we can't afford the price for every client. (I know we should charge them, but this issue is out of my hand). The 25$ revocation fee sucks, yeah.. but StartSSL has his advantages too. (edit: typo.)
  - iancarroll 12y ago
    Ah. Digicert offers what you want with their wild cards, FYI.