Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

171–180 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#171

Post by arantius »

veeti wrote: post #35
aftbit wrote: post #4

Earlier quoted context omitted.

When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.

I'm afraid you'll have to go through renewal every 3 months, but I'll still make a shameless plug of my client [1]. It uses DNS validation exclusively so you can generate certificates wherever you want. In addition, domain authorizations last for 10 months, so you don't have to go through the DNS verification each time: just renewing is sufficient. Run the issue command, drop new certs into configuration management,…

Thanks! A hands-off (on?) manual client is what I always wanted. I've just finally used Let's Encrypt for the first time, with manuale.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#172

Post by marcosdumay »

icebraining wrote: post #152
marcosdumay wrote: post #145

Earlier quoted context omitted.

Well, if you are some kind of openssl master, acme-tiny is flawless. In practice, for most people, reserve a few hours for your first deployment. After you got a script that calls openssl right, it's fast to adapt for other domains, but the first time is hard.

Why do you have to be a master? Just copy-paste the commands given in the README of the repo, replacing the domain for your own.

Well, at least on my computer, they were mostly broken.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#173

Post by slrz »

ascorbic wrote: post #36
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

StartSSL has some of the worst support I've ever encountered. Normally bad support means clueless or non-responsive. However StartSSL support is often actively hostile, treating customers as idiots or worse. I should point out that this isn't always the case, and I have used them in the past without trouble, but the times when it is bad are bad enough to write them off. Their site also looks like it was made in 1998,…

> However StartSSL support is often actively hostile, treating customers as idiots or worse.

Maybe that's because 90 % of them actually are?

Oh, and they allow you to authenticate for their web interface using client certificates instead of form abominations? Sweet.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#174

Post by MBlume »

hannob wrote: post #79

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pi…

If you use StartSSL, and then down the line they go well and truly rogue, browser vendors will have to consider ceasing to trust StartSSL in future releases. If your site is popular, it will be one more reason for them not to do that, which would leave their users less safe. If they do decide to untrust StartSSL, this will break your site.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#175

Post by jhkaghjkga »

nickjj wrote: post #116
ascorbic wrote: post #36

Earlier quoted context omitted.

StartSSL has some of the worst support I've ever encountered. Normally bad support means clueless or non-responsive. However StartSSL support is often actively hostile, treating customers as idiots or worse. I should point out that this isn't always the case, and I have used them in the past without trouble, but the times when it is bad are bad enough to write them off. Their site also looks like it was made in 1998,…

I had a terrible experience with their support too. I'll never use them again. The guy kept throwing out extremely passive-aggressive lines while using smilies while I was nothing but polite. Things like: - "I understand your problem, maybe you should be more careful next time. ;)" - "Next time read the fine print! :)" This was all because I needed to get a certificate revoked. Due to their terrible and unclear inter…

> lose a private key that they generated for me

Found your problem: you should never have someone generate a private key for you.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#176

Post by [deleted] »

0x0 wrote: post #114
pluma wrote: post #97

Earlier quoted context omitted.

There are people who use StartSSL for paid certificates? I though the free certs were the only reason people put up with their craptacular website.

It used to be a pretty sweet deal, for $60 you could get unlimited multi-domain multi-wildcard certs. Most other CAs charged more than that for a single wildcard cert, and noone else seems to even offer multiple wildcard domains in a single cert. Which was quite sensible, actually. Charge for the actual costly process of manually verifying ID, and then allow for unlimited free domain-validations to be issued to the c…

[deleted]

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#178

Post by kennycox »

0x0 wrote: post #114
pluma wrote: post #97

Earlier quoted context omitted.

There are people who use StartSSL for paid certificates? I though the free certs were the only reason people put up with their craptacular website.

It used to be a pretty sweet deal, for $60 you could get unlimited multi-domain multi-wildcard certs. Most other CAs charged more than that for a single wildcard cert, and noone else seems to even offer multiple wildcard domains in a single cert. Which was quite sensible, actually. Charge for the actual costly process of manually verifying ID, and then allow for unlimited free domain-validations to be issued to the c…

After searching the web and comparing the different price rates, I just found a lowest wildcard SSL at $42/yr. at https://www.ssl2buy.com. I hope that you would not find cheaper than this wildcard SSL. As they did not charge any extra beyond the price and helped me to secure my number of sub domains. Even the backend technical support was good enough.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#179

Post by nickjj »

jhkaghjkga wrote: post #175
nickjj wrote: post #116

Earlier quoted context omitted.

I had a terrible experience with their support too. I'll never use them again. The guy kept throwing out extremely passive-aggressive lines while using smilies while I was nothing but polite. Things like: - "I understand your problem, maybe you should be more careful next time. ;)" - "Next time read the fine print! :)" This was all because I needed to get a certificate revoked. Due to their terrible and unclear inter…

> lose a private key that they generated for me Found your problem: you should never have someone generate a private key for you.

Yeah I know. Since then I haven't done that. Keep in mind these series of events happened years ago.

It's one of StartSSL's flaws too. They are an enabler of doing stupid things.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#180

Post by alvarosm »

realusername wrote: post #146
alvarosm wrote: post #119

Pathetic let'sencrypt promotion. Now I'm gonna give you a few reasons not to use let's encrypt: it forces you to keep a piece of software that can generate keys in your server. It forces you to reload your web server config every two months, unattended (they won't issue certs valid for more than 90 days). The alernative would be to do the process manually every two months(wtf?). Also, its certificates are not trusted…

Windows XP is not even supported by Microsoft itself anymore, you have much bigger problems than SSL Support on it.

The windows xp USER has these problems. YOU have the problem of him not being able to connect to your SSL website.
Post reply on HN