Why I stopped using StartSSL (Hint: it involves a Chinese company)

Post by mmaunder » Tue, Feb 16, 2016, 2:21 PM UTC

prdonahue wrote: post #98

mmaunder wrote: post #51

Earlier quoted context omitted.

Not that wrong. You're just saying you have to enable China. Do you make it clear in the UI that a private key is ending up on Baidu's servers operated by Baidu's people? I don't use CF so I don't know - I'm just curious what the user experience is like. I'm asking because your CEO addressed concerns in the CNBC article about Baidu having access to your intellectual property so they seem to have full access. I think…

I'm the person designing this UX and yes, we plan to make quite clear/explicit the option of putting your private key in China. By default, keys will remain outside the country. Re your comments on user education: if you'd like to learn more about our current UI, I encourage you to sign up for a free account at https://www.cloudflare.com/a/sign-up . And if you encounter any experiences you feel are not sufficiently c…

Post by philbarr » Tue, Feb 16, 2016, 2:36 PM UTC

hannob wrote: post #79

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pi…

Post by b3lvedere » Tue, Feb 16, 2016, 2:58 PM UTC

tombrossman wrote: post #89

specialist wrote: post #39

Earlier quoted context omitted.

Just today, I'm setting up my first https by myself. Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs. But I got "Failed to connect to host for DVSNI challenge". Start googling, reading, messing around with this for a while. No joy. Bailed on Let's Encrypt, started over wit…

My recommendation is to look beyond the free alternatives and consider how inexpensive paid certificates have become. These can be issued for lengths up to three full years and cost well under $10USD/year. Multi-year discounts bring three year certificates price to under $20USD. Think about how much time it is going to take you to learn how to deploy and maintain your 'free' certificates and remember time is money. W…

Post by zimpenfish » Tue, Feb 16, 2016, 3:01 PM UTC

b3lvedere wrote: post #155

tombrossman wrote: post #89

Earlier quoted context omitted.

My recommendation is to look beyond the free alternatives and consider how inexpensive paid certificates have become. These can be issued for lengths up to three full years and cost well under $10USD/year. Multi-year discounts bring three year certificates price to under $20USD. Think about how much time it is going to take you to learn how to deploy and maintain your 'free' certificates and remember time is money. W…

I just made a new certificate at StartSSL. Took me about ten minutes to create it and implement it on the server. I'll use Let's Encrypt when they have a easy setup available.

Post by garblegarble » Tue, Feb 16, 2016, 3:41 PM UTC

marcosdumay wrote: post #145

icebraining wrote: post #128

Earlier quoted context omitted.

What client did you use? acme-tiny has been flawless for me, though it's more manual than the main client. https://github.com/diafygi/acme-tiny

Well, if you are some kind of openssl master, acme-tiny is flawless. In practice, for most people, reserve a few hours for your first deployment. After you got a script that calls openssl right, it's fast to adapt for other domains, but the first time is hard.