4 ms·
These stories make me cringe. The security of SSL is as good as the verification practices of the laziest CA. We need fewer of them, not more, and any CA that
by dfranke 17y ago
These stories make me cringe. The security of SSL is as good as the verification practices of the laziest CA. We need fewer of them, not more, and any CA that can give certificates away for free is guaranteed to have atrocious practices.
It appears that this company authenticates you by verifying that you can receive email at the domain that you want the certificate for. In addition to completely defeating the purpose of SSL by sending secrets in the clear over SMTP, ability to receive email at a certain address is no proof of ownership of that domain. Unfortunately, though, StartCom didn't invent this stupidity. I already discovered a few months ago that I can get Thawte to issue me an SSL certificate for hushmail.com.
- wmf 17y agoLook at it the other way: The CAs who are charging hundreds of dollars have atrocious practices, so StartCom is actually an improvement.
- deleted 17y ago[deleted]
- there 17y agoWe need fewer of them, not more, and any CA that can give certificates away for free is guaranteed to have atrocious practices. i have used startcom for a free ssl certificate for my personal site for many years and their verification process is more involved than godaddy's, which i also use for a wildcard ssl certificate and have to pay $199/year for. startcom requires client-side ssl certificates to login to their site, and then does verification with email and, if i remember correctly, a dns record or file placed somewhere on the current domain's site. just because they're free doesn't mean they won't take the time to do verification, and conversely, just because another company extorts lots of money from its customers every year doesn't mean they do any better validation.