Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

81–90 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#81

Post by DanielDent »

sandGorgon wrote: post #17
imperalix wrote: post #10

Earlier quoted context omitted.

I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.

can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).

Here's one approach: https://github.com/DanielDent/docker-nginx-ssl-proxy

I use a temporary self-signed keypair, which then gets replaced when the certificate is issued.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#83

Post by tombrossman »

Tepix wrote: post #53

Quote from the article: "StartSSL already refused to revoke certificates affected by the HeartBleed vulnerability and accused the user from negligence." That's wrong. They did charge a $25 fee for the revocation, however. I think it's reasonable since there is probably some manual process involved and the certificate was already free. They have to earn money somehow.

Exactly, they've automated the issuance of free certs and revoking takes extra work. $25 sounds high (sub-$10/year certs with unlimited free revocation & re-issuance are easy to find) so it is a money maker for them but so what?

People think nothing of using the freemium model which gives you a basic product for free, and charges you for extra features. It's exactly what StartSSL are doing here.

I don't particularly like or use StartSSL, but much of the criticism of them sounds totally invalid to me. Paid DV certs are dirt cheap people, shop around!

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#84

Post by DanielDent »

0x0 wrote: post #22
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

Lack of support for wildcard certificates is still an issue for Let's Encrypt. Rate limiting and SNI are two issues that means a wildcard certificate is still highly desirable.

Windows XP & older Android releases are the two most common reasons to care about SNI.

Let's Encrypt actually has compatibility issues with Windows XP, so wildcard certificates wouldn't help.

https://community.letsencrypt.org/t/which-browsers-and-opera...

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#85

Post by 0x0 »

Tepix wrote: post #68
0x0 wrote: post #64

Earlier quoted context omitted.

That doesn't help when you are targeting a market where Android 2.x is prevalent.

True. Is there no workaround for Android 2.x? What if you install a 3rd party browser?

You'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#86

Post by elgaton »

Kovah wrote: post #62
Tepix wrote: post #54

Is there any alternative to StartSSL for free S/MIME certificates that are trusted by the popular mail clients?

Would like to know that too. For websites there's Let's Encrypt but I haven't found any suitable solution for S/MIME...

COMODO still appears to offer a free e-mail certificate: https://www.comodo.com/home/email-security/free-email-certif...

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#87

Post by testerooooooo »

derFunk wrote: post #50

Reading this I'm more worried about the personal data StartSSL has about me. I never felt good giving away so much personal data to CAs when acquiring certificates to identify myself. Do we know how StartSSL handles this? Do the Chinese now have a copy of my passport, electricity bill et cetera? (well, I've been to China already, so the state already got my passport, but not necessarily a "private" company).

If the Chinese don't have it, the Mossad does. The fear is real. Maybe StartSSL was only a Mossad front to collect valid/real identities from around the world to use on covert ops.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#88

Post by [deleted] »

happywolf wrote: post #37
steve371 wrote: post #15

Chinese company is not a red flag. but Qihoo is. The company has known bad reputation. a. they labeled their own browser as a Microsoft security update, which triggered MS investigation b. they cheated on the anti-virus lab testing and got banned. ....etc.

Would like to add Baidu isn't better, too. Example, try search proprietary software, say 'Autocad', first few results are always pirate sites, while google will show the Autodesk site and the wikipedia post. Recently Baidu also under the spotlight for monetizing illness-related forums[1]. The issue is some patients accused the Internet giant selling their private info to _unqualified_ private hospitals. These hospita…

[deleted]

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#89

Post by tombrossman »

specialist wrote: post #39
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

Just today, I'm setting up my first https by myself. Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs. But I got "Failed to connect to host for DVSNI challenge". Start googling, reading, messing around with this for a while. No joy. Bailed on Let's Encrypt, started over wit…

My recommendation is to look beyond the free alternatives and consider how inexpensive paid certificates have become. These can be issued for lengths up to three full years and cost well under $10USD/year. Multi-year discounts bring three year certificates price to under $20USD.

Think about how much time it is going to take you to learn how to deploy and maintain your 'free' certificates and remember time is money. What do you make an hour? Is that more than the cost of a paid certificate?

I have used these certificates - https://cheapsslsecurity.com/comodo/positivessl.html - on multiple sites and it is very fast and easy. Other vendors sell them too and are likely just as good. Gandi do them too (at a slightly higher cost) and are the fastest method for me, though this may be because I have all my domains there already: https://www.gandi.net/ssl/standard?currency=USD#single

Don't waste hours chasing down free certificates when paid ones are so cheap now. Use Let's Encrypt only if you need lots of certificates and the paid options become prohibitively high.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#90

Post by ascorbic »

ascorbic wrote: post #78
josteink wrote: post #67

Earlier quoted context omitted.

> while using client certificates is secure and everything, it's also seriously user-hostile. I have to remember which computer and browser I used a year ago to sign up? Yeah, I know I should back up client certificates, but seriously who does that? So you want a secure website, and you agree that SSL is needed for things to be secure. But you're not willing to put in one inch of effort yourself to secure your own SS…

So every other CA in the world is doing it half-assed? I'm not aware of any others that require client certs to access the site.

I should add that of course I back up private keys, but in 20 years of using the web, I've not encountered a single other site that uses client certificates for authentication. I know it's more common in enterprise situations. I'm supposed to have a workflow to backup my browser client certificates just for one site? It's not their fault that browsers mostly have poor UI for handling client certs, but it is their fault for requiring them. Let's not even get started on what happens when you get chain problems, or if the client cert expires, or any of the myriad other ways it can go wrong. Just use 2FA like every other secure site, and I'll store a secure password in LastPass.
Post reply on HN