Why I stopped using StartSSL (Hint: it involves a Chinese company)
pierrekim.github.io
Why I stopped using StartSSL (Hint: it involves a Chinese company)
1–10 of 187 posts
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#2Qihoo offers CDN and managed DNS services[1]. The choice is odd on StartSSL's part but may not be necessarily insidious.
What more, not using their services does not enhance or harm your security in many meaningful way as long as they remain a trusted CA who can sign any domain they want to. If nation-state espionage is really a concern for you, take a few minutes of your time and purge the list of trust anchors installed on your OS[2].
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#3There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#4There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#5There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#6There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
I just set up Let's Encrypt on a number of my sites.
I'll take an automated process I run via cronjob and that requires no manual intervention, over a process that requires I touch it once a year.
The decision (to me) is a no-brainer.
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#7The author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Company, who uses a Chinese ISP for 2 months and that there hasn't been any news around".
The article could certainly use a bit more connecting-the-dots to show how he gets from "they're hosted in China" to "I won't use them anymore".
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#8>Hint: it involves a Chinese company
Isn't saying that a bit wrong? at least point on the hint that it is having connections with a state-owned company.
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#9I personally have a serious problem dealing with the state of china's telecommunications. It's about as close to evil as you can get. I'm not saying other state actors are much better but, I'm just saying ...
Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)
#10There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.