Please remove StartCom Certification Authority root certificate

> A user comment here says the CVE was cited, and StartSSL waived the revocation fee.

Seems like a straightforward solution for them to implement.

Hats off to the Debian developer. I can not believe the report was handled so politely. This is one of the silliest bug reports I have seen. I can not think of what the possible thought process was that led to the formation and submission of this bug report.

  # dpkg-reconfigure -p low ca-certificates

TL/DR from the Mozilla bugzilla (https://bugzilla.mozilla.org/show_bug.cgi?id=994033) There doesn't appear to be a definitive argument as to should they or should they not waive their revocation fee.

On the side of StartCom an extremly resonable point as to why they should not waive their fee:

> Every other certificate provider requires payment for certificates. StartCom is the one provider offering free certificates, which goes a long way to spreading TLS and https more broadly, and the complaint here is that they're daring to charge a fee to maintain their revocation list? Removing them over that would do more harm than good to security.

And the also very reasonable counter point:

> The problem is that thanks to Heartbleed we now have potentially leaked private keys (leaked due to circumstances outside of the control of anyone) and thus insecure sites. Now with StartSSL charging for every single revoked certificate they are encouraging people to "eh, the chance my key got leaked is so low, I'll just stay with my old certificate" thinking and behaviour. This is actively compromising the security of SSL and consumers (no one I know checks the SSL vendor on certificates of sites they visit if there's the lock icon and it says it is trustworthy). Therefor customers and site users expose themselves to potential security risks while the browser ensures them they are communicating securely with the website.

At the very least its refreshing to see that people aren't just jumping on the rage bandwagon of, "OMG you mean I have to pay for something that you said I'd have to pay for. You are evil".

It's nice to see some even handed analysis of the situation!

What that tool says is irrelevant to the question of whether those certs have been compromised.

The risk is that before the vulnerability was patched, somebody used it to grab the private keys associated with the certs.

And worse, the Debian developers would be at fault.

This is a sticky situation, really. On one hand, StartCom's pricing structure is fairly upfront. On the other hand, extracting $25 from every customer because of a bug they have no control over is dick behavior of the highest order.

Ideally they'd put out a notice saying that they will offer a one-time rekey for free. Without getting into ethics, it's an entirely automated process and costs Startcom absolutely nothing.