Since they are owned by a parent company (look at the sig of the email), are they really shutting it down or are they going to reassign the employees to another team with a different name?
Termination of the certificates business of StartCom
21–30 of 30 posts
Re: Termination of the certificates business of StartCom
#22The loss of this particular business isn't nearly the shame that the loss of the business model is. Activities that required human effort and involvement had a cost, like identity verification, while activities that had near zero costs were free.
That was terrific, as you could verify your identity, get a code signing cert, one for the website, and one for s/mime or digital document signing all for $60. I like Let's Encrypt and have used it since, but it's nowhere near as full featured of an offering.
Re: Termination of the certificates business of StartCom
#23It went all to shambles when Eddy Nigg lost control.
Lost? He sold it. Half the issues here came from him selling the company in secret.
But even before then StartSSL was a hinky CA. Three times I contacted support, I got direct responses from Eddy. Each time he managed to make me feel like I'd personally insulted him. Abrasive.
All that said, he was providing well trusted free certificates at a time nobody else was.
Re: Termination of the certificates business of StartCom
#24It went all to shambles when Eddy Nigg lost control.
Yes, but it was shady before. Remember that they let you pay for revocation. Even worse, also after heartbleed!
Re: Termination of the certificates business of StartCom
#25https://www.startcomca.com/index/News/newDetail?date=2017111... Press release from their website.
And yet they're still advertising EV certificates on the side banner... https://imgur.com/a/x7wwm
Their EV certs are coming from a 'partner' (that i'm not entirely certain is a partner) - camerfirma, not startcom, iirc.
Re: Termination of the certificates business of StartCom
#26I used them for a few years without issue. They were always quick to respond to my e-mails.
Let's Encrypt and AWS cover my cert needs now.
Re: Termination of the certificates business of StartCom
#27StartCom will always have a special place in my heart – they're the only company that I had to outright bribe to do business with. On the other hand… I really won't miss 'em.
> StartCom will always have a special place in my heart – they're the only company that I had to outright bribe to do business with. Can you elaborate on that?
Their ToS stated that only a single person could ever be allowed to touch StartCom accounts, and if that person ever went on vacation, or quit, we'd have to re-register, re-authenticate, and have support move over all certificates one by one, because StartCom was unable to handle the idea that a company might have an IT staff with a size >1.
So we said "fuck that" and shared the account. When we were caught, they would have had the right to terminate our account and revoke all our certs. Instead, they offered to look the other side as long as we paid the authentication fee again.
Re: Termination of the certificates business of StartCom
#28Details on why it happened here:
https://groups.google.com/forum/#!msg/mozilla.dev.security.p...
Good read on what not to do.
Re: Termination of the certificates business of StartCom
#29The loss of this particular business isn't nearly the shame that the loss of the business model is. Activities that required human effort and involvement had a cost, like identity verification, while activities that had near zero costs were free. That was terrific, as you could verify your identity, get a code signing cert, one for the website, and one for s/mime or digital document signing all for $60. I like Let's…
> I like Let's Encrypt and have used it since, but it's nowhere near as full featured of an offering.
Yet.
I think they'll begin offering a non-free service inthe next two years or so. The free DV certs will remain but eventually they'll need actual income (as opposed to donations and/or corporate sponsorhips). EV certs may be one way that heppens, I don't know.
For the longest time, we heard they wouldn't be offering wildcart certificates. Then, I just happened to be looking at their (recently updated) CPS one day (I was working on building out an intenral PKI at the time) and saw mention of issuance of wildcard certificates. They announced those shortly after.
Anyways, like I said, st some point they'll need actual income. I'm not sure what they'll offer in order to do that, though. Maybe EV certs, maybe longer issuance periods after more in-depth organizational verification, maybe some subscription-based "manage all your certs easily" tool, who knows. But I expect them to follow the same "automated == free", "manual intervention/work == not free" business model.
Re: Termination of the certificates business of StartCom
#30The loss of this particular business isn't nearly the shame that the loss of the business model is. Activities that required human effort and involvement had a cost, like identity verification, while activities that had near zero costs were free. That was terrific, as you could verify your identity, get a code signing cert, one for the website, and one for s/mime or digital document signing all for $60. I like Let's…
> I like Let's Encrypt and have used it since, but it's nowhere near as full featured of an offering. Yet. I think they'll begin offering a non-free service inthe next two years or so. The free DV certs will remain but eventually they'll need actual income (as opposed to donations and/or corporate sponsorhips). EV certs may be one way that heppens, I don't know. For the longest time, we heard they wouldn't be offerin…
> Anyways, like I said, st some point they'll need actual income.
I'm pretty sure they get sponsored by lots of big vendors. i.e. google has letsencrypt support in gcoud. I'm pretty sure that big vendors need to pay to query their API more often.