3 ms·

StartSSL/Startcom already does not charge for individual (wildcard) certificates, you can request unlimited numbers. You do pay a $60 fee for identity validati

by dtech 12y ago

StartSSL/Startcom already does not charge for individual (wildcard) certificates, you can request unlimited numbers. You do pay a $60 fee for identity validation, which is valid for 2 years. You can also have automated validation, but they don't allow wildcard certificates (which I sort-of understand, they do need to make money some way right) So you get unlimited free non-wildcard certificates or unlimited wildcard certificates for $30/year. Not a bad deal.

dspillett 12y ago
> So you get unlimited free non-wildcard certificates Do note the "no commercial use" clause on the free certificates. Not an issue for any of my uses but it may affect quite a few people. Though I'm not sure how they would enforce this. Of course if you can't afford $60 for two years for the next grade up, then your commercial venture is probably not a roaring success!
- Someone1234 12y ago
  > Though I'm not sure how they would enforce this. Revoke the certificate.
  - dspillett 12y ago
    But how do they detect that enforcement is even necessary? (other than regular whois lookups assuming that data is correct (probably too much hassle), checking the sites secured by the certificates (even more hassle), or someone "dobbing you in")
IgorPartola 12y ago
Apparently StartSSL does charge you quite a bit to revoke a free certificate. That bit a lot of people when Heartbleed happened. See https://www.startssl.com/?app=37 https://www.startssl.com/?app=37.
- Someone1234 12y ago
  That's partly because of how the revocation infrastructure operates. It definitely adds cost, including generating CRL, trimming the CRL as certificates expire (could be 10 years into the future), and running the revocation server itself.
  - MichaelGG 12y ago
    In another thread it was explained that they charge for revocation because their current software doesn't automate it. It sounded like a limitation in their stack and the fee is a workaround.
  - Karunamon 12y ago
    Let's not pretend it's anything more than profit. Adding a fingerprint to the end of a CRL file is a completely automated process which does not place significant strain on infrastructure. I'd imagine the file gets large after a while, but we've had ways to ease distribution of large files for quite some time.. Nevermind the fact that CRLs are of dubious value, anyways. See: http://people.csail.mit.edu/rivest/pubs/Riv98b.pdf http://people.csail.mit.edu/rivest/pubs/Riv98b.pdf

by dtech 12y ago

dspillett 12y ago

> So you get unlimited free non-wildcard certificates Do note the "no commercial use" clause on the free certificates. Not an issue for any of my uses but it may affect quite a few people. Though I'm not sure how they would enforce this. Of course if you can't afford $60 for two years for the next grade up, then your commercial venture is probably not a roaring success!

Someone1234 12y ago
> Though I'm not sure how they would enforce this. Revoke the certificate.
- dspillett 12y ago
  But how do they detect that enforcement is even necessary? (other than regular whois lookups assuming that data is correct (probably too much hassle), checking the sites secured by the certificates (even more hassle), or someone "dobbing you in")

IgorPartola 12y ago

Apparently StartSSL does charge you quite a bit to revoke a free certificate. That bit a lot of people when Heartbleed happened. See https://www.startssl.com/?app=37 https://www.startssl.com/?app=37.

Someone1234 12y ago
That's partly because of how the revocation infrastructure operates. It definitely adds cost, including generating CRL, trimming the CRL as certificates expire (could be 10 years into the future), and running the revocation server itself.
- MichaelGG 12y ago
  In another thread it was explained that they charge for revocation because their current software doesn't automate it. It sounded like a limitation in their stack and the fee is a workaround.
- Karunamon 12y ago
  Let's not pretend it's anything more than profit. Adding a fingerprint to the end of a CRL file is a completely automated process which does not place significant strain on infrastructure. I'd imagine the file gets large after a while, but we've had ways to ease distribution of large files for quite some time.. Nevermind the fact that CRLs are of dubious value, anyways. See: http://people.csail.mit.edu/rivest/pubs/Riv98b.pdf http://people.csail.mit.edu/rivest/pubs/Riv98b.pdf