Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't submit to the SSL cert racket. You can get one for no charge

startssl.com

Post reply on HN
Print view View original

71–80 of 88 posts

Re: Don't submit to the SSL cert racket. You can get one for no charge

#71

Post by cinch »

pbreit wrote: post #52

I did not get a good feeling about StartSSL when I tried getting a free cert. First, as many have pointed out, the web site experience is miserable. Second, I just got a "Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error." at https://auth.startssl.com For a product that is supposed to be confidence inspiring, StartSSL is the opposite.

when you sign up they install a certificate in your browser. without that, there's no way to login to your startssl account! so make sure to make a backup of it. i lost my account because i didn't realize this...

Re: Don't submit to the SSL cert racket. You can get one for no charge

#72

Post by cinch »

js4all wrote: post #14

Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn this when I tried to callout to a web service (with a startcom cert) from Salesforce. Also their certs are only free as long as you don't need to revoke it.

i once built a clojure web app and used a startssl free certificate. it worked fine after i imported it into the java keystore. i was using OpenJDK under linux. were you using Oracle's java?

Re: Don't submit to the SSL cert racket. You can get one for no charge

#73

Post by DEinspanjer »

I started to do Class 2 identification with StartSSL, but I chickened out after they asked me to provide my marriage certificate and wife's personal info.

They have a very detailed policy document describing all sorts of security procedures they purport to adhere to, but I have no way to validate whether they are actually following those policies and no recourse for me or my wife even if it was determined that they are not following them.

That is just too risky for the value I would get out of the process.

(posted to twitter also https://twitter.com/#!/deinspanjer/status/158596876772450304 )

EDIT: I was contacted by Eddy Nigg with some follow up information. I should have said that the reason they asked for my wife's info is because they wanted phone bills and those are in my wife's name which isn't the same last name as mine. That said, I'll still stand by my statement that the risk and complexity vs. reward was just not suitable for me.

EDIT 2: Okay, they offer an alternative for validation: they can mail you a registered letter with a validation code on it. That is much more acceptable to me, so I'll continue on with the process to see how that goes.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#74

Post by Karunamon »

cinch wrote: post #70
pagekalisedown wrote: post #46

Earlier quoted context omitted.

Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.

you'd want to revoke it if someone steals your private key.

Given the way Startcom operates, that could become expensive quickly. Since your private key is your gateway into your account (Why they went with this method instead of requiring a sensible password is beyond me, it's one of the reasons their site is a huge pain...), theoretically every certificate you own is compromised, and therefore you'd be out $25 for each one.

..ouch!

Re: Don't submit to the SSL cert racket. You can get one for no charge

#75

Post by hohoho2012 »

xolox wrote: post #64
hohoho2012 wrote: post #37

upvoting advertising spam? get a free cert with openssl and a shell!

While technically possible that doesn't get you very far, you'd end up with a self-signed certificate. That works fine except for the scary warnings (which look a bit unprofessional). And of course if the client programs of your service do not have an interface for accepting self-signed certificates, you're back to square one.

yes i know, this people scaring started with ff2,ie7? - there is nothing wrong with self signed certs, except useless companys wanna make a quick buck selling fud

Re: Don't submit to the SSL cert racket. You can get one for no charge

#76

Post by DEinspanjer »

mike-cardwell wrote: post #56
stevelosh wrote: post #5

I've used StartSSL in the past. I will never do so again. Yes, the certs are free, and yes, they work in all common browsers. But the process of obtaining them is a horror of Lovecraftian proportions. I'll happily pay a few dollars to Namecheap to be able to avoid the nightmare that is StartSSL's UI.

The only complication is the fact that they use client side SSL certificates for authentication. I don't know of any other site which does this. Although I like that they're dog fooding, it probably would have been better if they'd stuck with a traditional username/password/cookie scheme for logging in, from a business/usability perspective.

It confused me a lot because I used to have an old username/password account with them and when I tried to sign in and got a very generic SSL error from Firefox.

That said, once I registered with a new account, the client certificate worked great.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#77

Post by ceejayoz »

hohoho2012 wrote: post #75
xolox wrote: post #64

Earlier quoted context omitted.

While technically possible that doesn't get you very far, you'd end up with a self-signed certificate. That works fine except for the scary warnings (which look a bit unprofessional). And of course if the client programs of your service do not have an interface for accepting self-signed certificates, you're back to square one.

yes i know, this people scaring started with ff2,ie7? - there is nothing wrong with self signed certs, except useless companys wanna make a quick buck selling fud

There absolutely should've been some sort of "encrypted but not verified" handling for self-signed certificates. The current state of browsers is that unencrypted HTTP is presented as safer than self-sign encrypted HTTPS. That's lunacy.

Unfortunately, there isn't, and as a result self-signed certificates are useless to anyone running a HTTPS site that expects any visitors.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#78

Post by moonlighter »

blibble wrote: post #31
dikbrouwer wrote: post #20

Earlier quoted context omitted.

I find their service excellent. The website doesn't have the latest hip look, but the service is solid, and they are very responsive and helpful in case you run into an issue. For a free service, that's impressive.

their support is excellent too, I've had Eddy Nigg (the founder) respond to emails within 10 minutes on several occasions.

My experience too. Excellent service and very fast turn-around.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#79

Post by chaz »

hohoho2012 wrote: post #75
xolox wrote: post #64

Earlier quoted context omitted.

While technically possible that doesn't get you very far, you'd end up with a self-signed certificate. That works fine except for the scary warnings (which look a bit unprofessional). And of course if the client programs of your service do not have an interface for accepting self-signed certificates, you're back to square one.

yes i know, this people scaring started with ff2,ie7? - there is nothing wrong with self signed certs, except useless companys wanna make a quick buck selling fud

If you're dealing with end customers (like an eCommerce site), you're going to have lots of questions from nervous customers. Or worse, you'll never hear from them.

Re: Don't submit to the SSL cert racket. You can get one for no charge

#80

Post by pbreit »

mike-cardwell wrote: post #55
pbreit wrote: post #52

I did not get a good feeling about StartSSL when I tried getting a free cert. First, as many have pointed out, the web site experience is miserable. Second, I just got a "Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error." at https://auth.startssl.com For a product that is supposed to be confidence inspiring, StartSSL is the opposite.

You're supposed to have installed the client SSL certificate in your browser before visiting that URL. It caught me out too initially. They use client side SSL certificates for authentication. I don't know any other site which does this.

So is it not possible to catch that and display a helpful page?

But that basically confirms my contention that the user experience is miserable.

Post reply on HN