4 ms·

it's a superb service, until you want a revocation, then they try to extort $25/revocation out of you (even if you've been a long term paying customer) this ma

by blibble 12y ago

it's a superb service, until you want a revocation, then they try to extort $25/revocation out of you (even if you've been a long term paying customer) this may be OK if you have only issued one cert, but if you've issued a few hundred (which is the main point of StartSSL: pay once and issue many), then you are SOL unless you can afford to plonk down thousands of dollars. more here: https://www.techdirt.com/articles/20140409/11442426859/shameful-security-startcom-charges-people-to-revoke-ssl-certs-vulnerable-to-heartbleed.shtml https://www.techdirt.com/articles/20140409/11442426859/shame... the CEO (Eddy Nigg) is similarly patronising over email too.

dochtman 12y ago
To be fair, it seems like they have a point that revocation is actually expensive for them.
- aianus 12y ago
  Where does it say that? I would assume it's just as easy as issuing them in the first place.
  - Someone1234 12y ago
    You would assume wrong. Revocation is a massive PITA.
    - Karunamon 12y ago
      Why? It appears a CRL is nothing more than a file containing blobs of DER-encoded cert files.
    - womble 12y ago
      Running a revocation service is an annoyingly fiddly job, but all of that needs to be setup and running before you become a CA. Pretty much all of the faffing around is in the need to regularly regenerate (including signing with the CA key) CRLs and OCSP responder certificates. Like the rest of a CA's operation, revoking an individual certificate should be a miniscule incremental cost, modulo the larger CRL size due to the added fingerprint. I was rather surprised that so many people are sucking down CRLs, but clearly they do (http://blog.cloudflare.com/the-hard-costs-of-heartbleed http://blog.cloudflare.com/the-hard-costs-of-heartbleed).
the_mitsuhiko 12y ago
Since the revocation protocol is broken anyways I don't really think this is a real problem.
- womble 12y ago
  All we have to do is get all certs flagged with must-staple and have all webservers handle stapling, and we're set! (Sarcasm? Moi?)

by blibble 12y ago

dochtman 12y ago

To be fair, it seems like they have a point that revocation is actually expensive for them.

aianus 12y ago
Where does it say that? I would assume it's just as easy as issuing them in the first place.
- Someone1234 12y ago
  You would assume wrong. Revocation is a massive PITA.
  - Karunamon 12y ago
    Why? It appears a CRL is nothing more than a file containing blobs of DER-encoded cert files.
  - womble 12y ago
    Running a revocation service is an annoyingly fiddly job, but all of that needs to be setup and running before you become a CA. Pretty much all of the faffing around is in the need to regularly regenerate (including signing with the CA key) CRLs and OCSP responder certificates. Like the rest of a CA's operation, revoking an individual certificate should be a miniscule incremental cost, modulo the larger CRL size due to the added fingerprint. I was rather surprised that so many people are sucking down CRLs, but clearly they do (http://blog.cloudflare.com/the-hard-costs-of-heartbleed http://blog.cloudflare.com/the-hard-costs-of-heartbleed).

the_mitsuhiko 12y ago

Since the revocation protocol is broken anyways I don't really think this is a real problem.

womble 12y ago
All we have to do is get all certs flagged with must-staple and have all webservers handle stapling, and we're set! (Sarcasm? Moi?)