Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't submit to the SSL cert racket. You can get one for no charge

startssl.com

Post reply on HN
Print view View original

61–70 of 88 posts

Re: Don't submit to the SSL cert racket. You can get one for no charge

#61

Post by xolox »

mike-cardwell wrote: post #55
pbreit wrote: post #52

I did not get a good feeling about StartSSL when I tried getting a free cert. First, as many have pointed out, the web site experience is miserable. Second, I just got a "Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error." at https://auth.startssl.com For a product that is supposed to be confidence inspiring, StartSSL is the opposite.

You're supposed to have installed the client SSL certificate in your browser before visiting that URL. It caught me out too initially. They use client side SSL certificates for authentication. I don't know any other site which does this.

It's the first time I came across client side certificates as well. As others have pointed out you have to jump through a bunch of hoops to get a certificate from StartSSL, but if your free time is cheaper than a certificate from another party it can still be worth it (especially because the cost repeats with other parties). I've been a happy customer for more than a year now.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#62

Post by niels »

mmastrac wrote: post #32
saberworks wrote: post #6

Earlier quoted context omitted.

This hasn't been my experience. Their web site is ugly and lame but once you're logged in it's about a 3-step process to apply for the cert. Both times I was emailed within 10 minutes that my cert was ready, and it works fine.

I'll just chime in saying that my experience was smooth like this. I'd use them in the future myself.

Also worked super for us. Getting the cert. was a smooth process.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#63

Post by xolox »

Kudos wrote: post #10

I went through the horrendous enrolment process only to find they don't issue certs for subdomains.

They do, it's just that you cannot register a wildcard certificate for free. When I registered my certificate I could pick one subdomain in addition to the main domain.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#64

Post by xolox »

hohoho2012 wrote: post #37

upvoting advertising spam? get a free cert with openssl and a shell!

While technically possible that doesn't get you very far, you'd end up with a self-signed certificate. That works fine except for the scary warnings (which look a bit unprofessional). And of course if the client programs of your service do not have an interface for accepting self-signed certificates, you're back to square one.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#65

Post by Macha »

huhtenberg wrote: post #11

Keep in mind that Gandi includes 1 free SSL cert with every domain name. Per year.

Only with the first year, if I'm reading their site right?

> With each domain name transferred to Gandi, we include a Standard SSL certificate for free the first year.

https://www.gandi.net/domain/ssl#nav

Re: Don't submit to the SSL cert racket. You can get one for no charge

#66

Post by pja »

chrisbolt wrote: post #45
foobarbazetc wrote: post #44

Earlier quoted context omitted.

Sigh. I spent way too much time picking these particular certs and they've gone and messed it up. :) The cross-root cert should work, but you need to make sure it's presented in the right order, I think. FWIW, my latest RapidSSL-through-Namecheap certs were issued by: issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority And that's the "good"/trusted CA. I'm not sure when they made the switch, but I only got…

If you don't need to support really old mobile devices, the best certs going are, IMHO, Digicert. They get chained all the way back to Entrust: Not only that, they check your installed cert after you buy it and email you if you installed it incorrectly: http://www.digicert.com/help/

So does StartSSL.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#67

Post by hmottestad »

moonlighter wrote: post #16
stevelosh wrote: post #5

I've used StartSSL in the past. I will never do so again. Yes, the certs are free, and yes, they work in all common browsers. But the process of obtaining them is a horror of Lovecraftian proportions. I'll happily pay a few dollars to Namecheap to be able to avoid the nightmare that is StartSSL's UI.

Not my experience at all. It's easy and straightforward (really takes less than 10 mins). I have a bunch of startSSL certs in use. Before I started using startSSL certs I used Thawte certs. Dealing with Thawte was HORRIBLE, these guys are extremely pushy (their sales reps repeatedly called me at home to 'convince' me I really should renew my certificates with them and wouldn't take no for an answer). Contrast that wi…

I also found startSSL to be fine. It's not the most user friendly of websites, but by no means horrible.

I can see why you may want something simpler if you need 10+ certificates, but if you just want to set up SSL for something then startSSL is fine.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#69

Post by xxqs »

xxqs wrote: post #57
aiurtourist wrote: post #13

Earlier quoted context omitted.

I second this experience, and "Lovecraftian" is indeed an excellent way to describe it. It's not just that the process was difficult, it's that my confidence dwindled through every strange and baffling step. Since you mentioned paying "a few dollars" to Namecheap, can you comment on the feasibility of their $8.95 "PositiveSSL" certificate? ( http://www.namecheap.com/ssl-certificates/comodo.aspx )

I have a Comodo certificate purchased through cheapssl.com. There is one problem: some older android 2.3 phones don't recognize it as valid and refuse to download any non-html data files.

fixed it by installing the intermediate chain on my server

Re: Don't submit to the SSL cert racket. You can get one for no charge

#70

Post by cinch »

pagekalisedown wrote: post #46
Karunamon wrote: post #25

Earlier quoted context omitted.

Came here to say something like this. While the site is a bit of a pain, and the certs are free, make damn sure you have your site configured the way you want it before you generate the certificate. It's $25 to revoke a cert, i.e. free up the name so you can use it again elsewhere. I used part of my domain name for an XMPP cert that I later wanted to use for a web subdomain with the same name.. nope. Stupid.

Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.

you'd want to revoke it if someone steals your private key.
Post reply on HN