1–10 of 14 posts
I am helping a non-profit that has a very low budget and I want to be helpful without causing long-term ramifications (of which I am currently ignorant of). Thanks for any help, this stuff is confusing and I am new to it!
I have used them in the past with no issues for personal sites. What are your concerns? In many aspects, a cert either "works" or it doesn't (in most cases, a SSL trusts the cert without warning). Generate a private and CSR that meet your security requirements (e.g. key length, cipher set, etc), submit it to StartSSL, and verify the resulting cert. If it meets your specs and is trusted by the SSL engines you use then…
Since I don't have experience with them I am looking for some level of assurance that they are a legitimate service. In my opinion it is difficult to gain that assurance just from their website.
At that price, I wouldn't risk free.
I have used them in the past with no issues for personal sites. What are your concerns? In many aspects, a cert either "works" or it doesn't (in most cases, a SSL trusts the cert without warning). Generate a private and CSR that meet your security requirements (e.g. key length, cipher set, etc), submit it to StartSSL, and verify the resulting cert. If it meets your specs and is trusted by the SSL engines you use then…
My concern revolves around credibility. They took a beating after Heartbleed regarding the cost of revocation for certificates/credentials affected. While that is mostly a business decision on their end– it raises concerns about what their business is about. Nothing is "free", it just might not cost currency. "If you don't pay for the service, you are the service." Since I don't have experience with them I am looking…
That said, why does it matter if they're "credible"? Their certs are accepted by pretty much every browser, OS and library, and they have a long track record as a CA.
Regardless, as a business I have had business dealings with, let me assure you they are a "legitimate service".
I highly recommend Comodo bought from NameCheap: https://www.namecheap.com/security/ssl-certificates/comodo.a...
Another heartbleed type incident could happen in the near future (lots of eyes on that codebase now) and their strict policy will leave you choosing between coughing up $35 per certificate or leaving your site vulnerable.
There has even been a large amount of discussion regarding removing them from the trusted list of certificate authorities because most of their users can't afford to revoke certificates and have no choice but to leave their sites vulnerable.
Earlier quoted context omitted.
My concern revolves around credibility. They took a beating after Heartbleed regarding the cost of revocation for certificates/credentials affected. While that is mostly a business decision on their end– it raises concerns about what their business is about. Nothing is "free", it just might not cost currency. "If you don't pay for the service, you are the service." Since I don't have experience with them I am looking…
I have paid wildcard certs with them. Their site is weirdly designed and heavy on the self-service, but I have no complaints about them. I have revoked certs with them and everything has been reasonable. That said, why does it matter if they're "credible"? Their certs are accepted by pretty much every browser, OS and library, and they have a long track record as a CA. Regardless, as a business I have had business dea…
Whatever happened with "StartSSL, please revoke me"?
I believe the exact quote during the Heartbleed incident was, "Dead serious." https://twitter.com/startssl/status/453631038883758080