5 ms·

Are they the outfit that screwed everyone over on heartbleed by charging a fortune to revoke certificates they had given out for free?

• zimbatm 12y ago
  It's not like they invented the pricing during heartbleed, it was always out there. StartSSL can make the certificate for free because their infrastructure is all automated. You don't know if certificate revocation requires human intervention or not. Plus certificate revocation is useless in case of MITM. Browsers need to be able to contact the certificate authority and will just ignore it on timeout. So the only difference is that the MITM has to blackhole the CA on top of the usual routine. All you can do is hope nobody stole your SSL certificate.
  • aroch 12y ago
    Is it automated? I recall being called by a real person when I setup an account 3 (4?) years ago, for a free, DV cert.
    • zimbatm 12y ago
      My understanding is that it's all automated for level 1 trust where you can only generate basic single-domain SSL certs. I don't remember getting a call.