3 ms·

https://www.startssl.com/ https://www.startssl.com/ provides free domain-validated certificates.

mey 11y ago
The issue is you have to pay for revocation.
Karunamon 11y ago
Please don't use startssl. Revocation costs money, and the company's behavior surrounding heartbleed was at the very least very unethical.
- teraflop 11y ago
  Fair enough, but bear in mind that StartSSL's revocation fee is lower than what most certificate providers charge as a starting price. Personally, I'm fine with taking the risk and eating the $25 cost if something unexpected happens.
  - clinta 11y ago
    No company should be incentivising companies to not revoke compromised certificates. Even if the cost is modest. It's more about not patronizing a company with such a bad business model than it is about the dollar cost.
    - currysausage 11y ago
      StartSSL's business model: making things free that don't cost them measurable money, and charging for transactions that cost them money. An exception from that rule in the wake of Heartbleed would arguably have been appropriate, but the business model as such is in no way bad. If the whole SSL industry worked in a way that put price and cost in proportion, there would be no need for Let's Encrypt.
      - Karunamon 11y ago
        How does an automated revocation cost them money?
        currysausage 11y ago
        https://blog.cloudflare.com/the-hard-costs-of-heartbleed/ https://blog.cloudflare.com/the-hard-costs-of-heartbleed/
    - mikeash 11y ago
      What about every other certificate issuer, whose up-front fees incentivize companies to not encrypt data in the first place?
      - clinta 11y ago
        Not encrypting is better than not revoking a compromised certificate. A compromised certificate gives the user the impression that the connection is secure when it's security is compromised. A plaintext connection makes no false claims.
        mikeash 11y ago
        In which case if you don't want to pay for revocation, you could just revert back to an unencrypted connection.
- yuhong 11y ago
  I am thinking that they should adopt short lived certificates.
- hobarrera 11y ago
  > Revocation costs money[...] I think it's quite understandable that they charge for things that cost them money, but keep the rest free. You can't really expect for them to give out for free something that has a cost for them.
robertfw 11y ago
Be aware that the free cert does not support certificate transparancy. This will lead some browsers - notably chrome but I imagine there are/will be others - to give a user warning about SSL integrity. There are supposedly some workarounds [1] but no official support. [1] http://korusdipl.egloos.com/6152770 http://korusdipl.egloos.com/6152770
- iancarroll 11y ago
  Chrome only downgrades EV to non-EV without SCTs. You can always send them yourself via the TLS extension method.
yellowapple 11y ago
On top of the revocation issues, StartSSL is only free for personal use; if you intend to obtain a cert for a small business or some other non-personal purpose, they won't give you the cert. I also recall StartSSL being incredibly difficult for those who only have a P.O. box for a mailing address (as was the case for me; my apartment didn't have a mailbox, so I had to receive all mail at a P.O. box, which StartSSL didn't like).

mey 11y ago

The issue is you have to pay for revocation.

Please don't use startssl. Revocation costs money, and the company's behavior surrounding heartbleed was at the very least very unethical.

teraflop 11y ago
Fair enough, but bear in mind that StartSSL's revocation fee is lower than what most certificate providers charge as a starting price. Personally, I'm fine with taking the risk and eating the $25 cost if something unexpected happens.
- clinta 11y ago
  No company should be incentivising companies to not revoke compromised certificates. Even if the cost is modest. It's more about not patronizing a company with such a bad business model than it is about the dollar cost.
  - currysausage 11y ago
    StartSSL's business model: making things free that don't cost them measurable money, and charging for transactions that cost them money. An exception from that rule in the wake of Heartbleed would arguably have been appropriate, but the business model as such is in no way bad. If the whole SSL industry worked in a way that put price and cost in proportion, there would be no need for Let's Encrypt.
    - Karunamon 11y ago
      How does an automated revocation cost them money?
      - currysausage 11y ago
        https://blog.cloudflare.com/the-hard-costs-of-heartbleed/ https://blog.cloudflare.com/the-hard-costs-of-heartbleed/
  - mikeash 11y ago
    What about every other certificate issuer, whose up-front fees incentivize companies to not encrypt data in the first place?
    - clinta 11y ago
      Not encrypting is better than not revoking a compromised certificate. A compromised certificate gives the user the impression that the connection is secure when it's security is compromised. A plaintext connection makes no false claims.
      - mikeash 11y ago
        In which case if you don't want to pay for revocation, you could just revert back to an unencrypted connection.
yuhong 11y ago
I am thinking that they should adopt short lived certificates.
hobarrera 11y ago
> Revocation costs money[...] I think it's quite understandable that they charge for things that cost them money, but keep the rest free. You can't really expect for them to give out for free something that has a cost for them.

robertfw 11y ago

Be aware that the free cert does not support certificate transparancy. This will lead some browsers - notably chrome but I imagine there are/will be others - to give a user warning about SSL integrity. There are supposedly some workarounds [1] but no official support. [1] http://korusdipl.egloos.com/6152770 http://korusdipl.egloos.com/6152770

iancarroll 11y ago
Chrome only downgrades EV to non-EV without SCTs. You can always send them yourself via the TLS extension method.

yellowapple 11y ago

On top of the revocation issues, StartSSL is only free for personal use; if you intend to obtain a cert for a small business or some other non-personal purpose, they won't give you the cert. I also recall StartSSL being incredibly difficult for those who only have a P.O. box for a mailing address (as was the case for me; my apartment didn't have a mailbox, so I had to receive all mail at a P.O. box, which StartSSL didn't like).