StartSSL

This article is a stub. You can help the IndieWeb wiki by expanding it.

StartSSL was a service from StartCom that provided introductory SSL certificates for no cost. As of 2016-11-30, Mozilla, Google, and Apple have stopped trusting new certificates from WoSign and StartCom, and StartCom will cede operations at the end of 2017.[1] See #Criticism for more information.

Benefits

• Single-domain SSL certificates are free.
• You can create multiple certificates for individual subdomains, for example www.example.com and test.example.com
• You can pay $59 to go through the "personal identity validation" process, at which point you get to do the following for the next 360 days:
  • Create as many wildcard certificates as you want for free (*.example.com), each is valid for 2 years
  • Create multi-domain certificates (example.org, example.com)

Issues

• The user interface is very awkward.
• Authentication is done only via browser client certificate, so make sure you back this up or you'll lose access to your account.
• While single SSL certificates are free, it costs $24.99 to revoke a certificate if you need to.
• You can only have one SSL certificate active per subdomain. There is a 2-week period where you can renew a certificate before it expires. This means if you lose your private key for a cert, you won't be able to re-create the cert with the same subdomain unless you pay to revoke the old one first.

Criticism

• https://pierrekim.github.io/blog/2016-02-16-why-i-stopped-using-startssl-because-of-qihoo-360.html "The PKI platform of StartSSL, an Israeli leader of free SSL certificates, is now hosted by Qihoo 360, a Chinese Antivirus Company." Qihoo 360 has a very bad reputation and so StartSSL may not be treated as trusted and secure anymore.
• https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/preview Mozilla investigation into backdating of certificates; may no longer trust newly-issued certificates in the near future:
  • Allegations of "... WoSign has been intentionally back-dating certificates to avoid blocks on SHA-1 issuance in browsers, having qualified audits and/or being caught violating the CAB Forum Baseline Requirements."
  • "Taking into account all the issues listed above, Mozilla’s CA team has lost confidence in the ability of WoSign/StartCom to faithfully and competently discharge the functions of a CA. Therefore we propose that, starting on a date to be determined in the near future, Mozilla products will no longer trust newly-issued certificates issued by either of these two CA brands."
• https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/E13eT13wMBQ
  • "It seams that wosign has registered the domains letsencrypt.cn and letsencrypt.com.cn in 2014 after the public announce of Let's Encrypt"

FAQ

I lost my client certificate, or my client certificate expired

If you lost your client certificate, or if you forgot to create a new one before it expired, you can still recover you account. Create a new account with the same email address, and then email certmaster at startssl.com with the subject line "merge accounts", provide your email address, and ask that your accounts be merged.

See Also

• https
• Let's Encrypt