6 ms·

It's not like they invented the pricing during heartbleed, it was always out there. StartSSL can make the certificate for free because their infrastructure is

by zimbatm 12y ago

It's not like they invented the pricing during heartbleed, it was always out there. StartSSL can make the certificate for free because their infrastructure is all automated. You don't know if certificate revocation requires human intervention or not. Plus certificate revocation is useless in case of MITM. Browsers need to be able to contact the certificate authority and will just ignore it on timeout. So the only difference is that the MITM has to blackhole the CA on top of the usual routine. All you can do is hope nobody stole your SSL certificate.

aroch 12y ago
Is it automated? I recall being called by a real person when I setup an account 3 (4?) years ago, for a free, DV cert.
- zimbatm 12y ago
  My understanding is that it's all automated for level 1 trust where you can only generate basic single-domain SSL certs. I don't remember getting a call.