4 ms·

There needs to be better support for self-signed certificates, or at least a CA that is free and doesn't have strings attached (looking at you StartSSL with pay

There needs to be better support for self-signed certificates, or at least a CA that is free and doesn't have strings attached (looking at you StartSSL with payment required to re-issue a cert). I would love to have certificates for all of my domains, but it simply isn't worth it to me for the 40 - 50 hits a month I get on those properties to pay for a cert, or go through the hassle of StartSSL and worry about having to pay if the next Heartbleed happens.

taralx 12y ago
That's in this spec: "The server certificate, if one is proffered by the alternative service, is not necessarily checked for validity, expiration, issuance by a trusted certificate authority or matched against the name in the URI." In other words, the certificate presented is merely used to secure the connection against a passive attacker.