Don't submit to the SSL cert racket. You can get one for no charge

http://www.startssl.com/

by vibrant • 15 years ago

180 81 15 years ago

yangez• 15 years ago

I'd feel a lot better about using this if its website looked a bit more professional.

This seems to have been downvoted but its not an invalid point. The web is old enough now that a certain level of design is expected of things people need to trust. A shop down a side alley with a hand written sign inspires less confidence than something plastic on the high street - however wrong that initial impression may be.

People with background knowledge may know startssl is legit/good but to a newcomer I can easily see why their first impression is off.

billpatrianakos2• 15 years ago

Absolutely! I had never heard of Start before and I honestly thought for a moment that maybe this was spam that had somehow got on to the front page as a fluke. I'm serious. I'm not used to seeing a company website make it on the front page of HN or HN at all without there actually being some kind of article on the page you get to.

SSL certain are important and I don't think their design is helping them look like a legit business. I trust they are after all the comments here but on first glance I was skeptical and thought it was too good to be true. I know we all pride ourselves on being smart, critical thinker that can look past a site's design and see the true value behind it but I think in some cases it's perfectly normal and acceptable to react this way to a design. Superficiality be damned. I'd rather run from a poorly designed, non-legit looking site and be safe rather than risking it and being sorry later because I gave in to the PC, "don't be superficial" side of me.

grimatongueworm• 15 years ago

Oh, c'mon. You KNOW they licensed that knife image from Victorinox. ;-)

agildehaus• 15 years ago

Is there any certificate authority with a clean UI? Every single one I have come across has been fairly horrid by today's standards.

billpatrianakos2• 15 years ago

We're talking about the actual design of the site. I'm not one to get all wound up over definitions so please excuse if I use the wrong terminology here, I'll try to be as clear as possible.

A beautiful site can have an awful UI. The StartSSL site doesn't have that polished hipster-corporate look that we're so used to seeing these days. I think you might be talking about the experience. It's one thing to have a pain in the ass experience with forms or actions that require multiple page views/reloads to complete and quite another to have an ugly site in general. "Ugly" can be a very subjective thing though. StartSSL's site isn't exactly ugly but more dated looking. Speaking striclty from a design point of view, without being overly critical, the site is aligned nicely, has a nice grid, the typography isn't fancy but it's not so ugly that you'd complain about it on first glance, the colors are okay and don't hinder readability, there's enough white space, etc. Even so, when it comes to design there are always those intangible qualities that you can't quite describe or put into objective terms (which I'm sure is very frustrating for programmers as we're all about exact, measurable, science-y stuff).

So considering that the site isn't ugly from an objective standpoint, how could it still be ugly? To answer that you have to take into account experience. Web design, much like fashion, has fads and trends. Right now we're used to seeing what I like to call "hipster-corporate" design. This style is all about being casual while still looking corporate enough for people to take the comoany's site seriously. It's really tough to straddle the line between trying too hard to look hipster-corporate and looking dated and old fashioned. We've all seen the website for the local doctor's office that looks like it's trying too hard to be that big corporate style but failing miserably and looking like the crappy free Wordpress template that it is. Hipster-corporate is really interesting because there are a lot of variations and the amount of hipster style or corporate style that mixed in all depends on the company's personality and size. Too much or too little of one or the other totally breaks the feel.

So the point is, after all that, I think we're talking more about the "feeling" that the site gives you rather than the objective reality of things when we talk about the site looking pretty or ugly, good or bad, well designed or poorly designed.

brianjolney• 15 years ago

My understanding is free ones are not trusted/accepted by the browsers, hence to have something that isnt tossing errors at your users requires a small payment to a CA.

I've used positivessl from namecheap whenever I need certs, its something crazy cheap like $5

dan85• 15 years ago

StartSSL works fine with all recent browsers. (I think IE 7+)

elliottcarlson• 15 years ago

My understanding is free ones are not trusted/accepted by the browsers

You might mean self-signed certificates?

charliesome• 15 years ago

Well anyone could start their own CA and hand out free certificates. The problem is that nobody trusts Joe Bloggs' new CA.

stevelosh• 15 years ago

I've used StartSSL in the past. I will never do so again.

Yes, the certs are free, and yes, they work in all common browsers. But the process of obtaining them is a horror of Lovecraftian proportions. I'll happily pay a few dollars to Namecheap to be able to avoid the nightmare that is StartSSL's UI.

saberworks• 15 years ago

This hasn't been my experience. Their web site is ugly and lame but once you're logged in it's about a 3-step process to apply for the cert. Both times I was emailed within 10 minutes that my cert was ready, and it works fine.

mmastrac• 15 years ago

I'll just chime in saying that my experience was smooth like this. I'd use them in the future myself.

aiurtourist• 15 years ago

I second this experience, and "Lovecraftian" is indeed an excellent way to describe it. It's not just that the process was difficult, it's that my confidence dwindled through every strange and baffling step.

Since you mentioned paying "a few dollars" to Namecheap, can you comment on the feasibility of their $8.95 "PositiveSSL" certificate? ( http://www.namecheap.com/ssl-certificates/comodo.aspx )

ohgodthecat• 15 years ago

Can you extrapolate on what you mean by feasibility, I use positive SSL on a few domains it works fine with no issues and isn't that hard to setup (basically you just need to be able to receive email on your domain).

foobarbazetc2• 15 years ago

The best (in terms of browser compatibility) cheap cert that Namecheap sell is the RapidSSL cert at http://www.namecheap.com/ssl-certificates/geotrust-ssl-certi...

xxqs4• 15 years ago

I have a Comodo certificate purchased through cheapssl.com. There is one problem: some older android 2.3 phones don't recognize it as valid and refuse to download any non-html data files.

moonlighter3• 15 years ago

Not my experience at all. It's easy and straightforward (really takes less than 10 mins). I have a bunch of startSSL certs in use. Before I started using startSSL certs I used Thawte certs.

Dealing with Thawte was HORRIBLE, these guys are extremely pushy (their sales reps repeatedly called me at home to 'convince' me I really should renew my certificates with them and wouldn't take no for an answer). Contrast that with startSSL where I had some questions and Eddy Nigg personally replied within minutes.

In summary, I highly recommend giving startSSL a shot.

hmottestad• 15 years ago

I also found startSSL to be fine. It's not the most user friendly of websites, but by no means horrible.

I can see why you may want something simpler if you need 10+ certificates, but if you just want to set up SSL for something then startSSL is fine.

dikbrouwer• 15 years ago

I find their service excellent. The website doesn't have the latest hip look, but the service is solid, and they are very responsive and helpful in case you run into an issue. For a free service, that's impressive.

blibble• 15 years ago

their support is excellent too, I've had Eddy Nigg (the founder) respond to emails within 10 minutes on several occasions.

taa• 15 years ago

We tried them but had to change to a different vendor because the Blackberries didn't recognize their certificates and they had no plans to rectify that. We don't have much BB traffic, but didn't want to exclude BB users just because we wanted to be cheap.

brdrak• 15 years ago

I disagree also. Their process is fine with me and very quick. I haven't had to contact them in a while, but when I did, got fast, intelligent response. StartCom/StartSSL is a breath of fresh air.

mike-cardwell3• 15 years ago

The only complication is the fact that they use client side SSL certificates for authentication. I don't know of any other site which does this. Although I like that they're dog fooding, it probably would have been better if they'd stuck with a traditional username/password/cookie scheme for logging in, from a business/usability perspective.

DEinspanjer2• 15 years ago

It confused me a lot because I used to have an old username/password account with them and when I tried to sign in and got a very generic SSL error from Firefox.

That said, once I registered with a new account, the client certificate worked great.

lloeki• 15 years ago

> I don't know of any other site which does this.

CACert does.

Kudos• 15 years ago

I went through the horrendous enrolment process only to find they don't issue certs for subdomains.

moonlighter3• 15 years ago

Sure they do. I'm using a bunch of them right now. The only restriction startSSL has is that they don't accept popular names like 'amazon' or 'google' for subdomain names (I found out after I tried to get a cert for 'amazon.xxx.com' which we'd run in an AWS EC2 instance for testing). So we switched to 'sandbox.xxx.com' and got the cert within minutes.

xolox3• 15 years ago

They do, it's just that you cannot register a wildcard certificate for free. When I registered my certificate I could pick one subdomain in addition to the main domain.

huhtenberg3• 15 years ago

Keep in mind that Gandi includes 1 free SSL cert with every domain name. Per year.

jc4p• 15 years ago

I'm actually shocked at how many places accept the trust chain of my free SSL certificate from Gandi. Some browsers refuse my company's very expensive wildcard certificate from GoDaddy saying it's not trusted but trust mine from Gandi!

huhtenberg3• 15 years ago

Their certs are issued by Comodo, which is a well established CA. And they are hardly free, their price is simply rolled into the domain registration fee.

lmz• 15 years ago

Did you configure the server to send the intermediate certificates for your GoDaddy wildcard certificate? I've experienced similar problems in the past, but sending the intermediate certificate fixed it.

andyking• 15 years ago

I'm with Gandi and didn't actually realise I already had this facility under my nose. Thanks for the information!

FuzzyDunlop• 15 years ago

I only recently bought a domain with Gandi after seeing it mentioned here.

This feature has just convinced me to stick with them for future purchases.

Macha• 15 years ago

Only with the first year, if I'm reading their site right?

> With each domain name transferred to Gandi, we include a Standard SSL certificate for free the first year.

https://www.gandi.net/domain/ssl#nav

jklp• 15 years ago

Yep, I thought it was perpetually though after my first year they started charging me for it.

huhtenberg3• 15 years ago

Uhm. It is ambiguously worded, that's for sure -

  Included for free the first year with the purchase,
  transfer, or renewal of your domain name.

My understanding was that if I had a domain with them and renewed for another year, that would fall under the "renewal" clause of the above.

js4all2• 15 years ago

Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn this when I tried to callout to a web service (with a startcom cert) from Salesforce.

Also their certs are only free as long as you don't need to revoke it.

Karunamon2• 15 years ago

Came here to say something like this. While the site is a bit of a pain, and the certs are free, make damn sure you have your site configured the way you want it before you generate the certificate.

It's $25 to revoke a cert, i.e. free up the name so you can use it again elsewhere. I used part of my domain name for an XMPP cert that I later wanted to use for a web subdomain with the same name.. nope. Stupid.

pagekalisedown• 15 years ago

Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.

cinch3• 15 years ago

i once built a clojure web app and used a startssl free certificate. it worked fine after i imported it into the java keystore. i was using OpenJDK under linux. were you using Oracle's java?

js4all2• 15 years ago

Yes, it was Oracle's. The problem was on the Salesforce side (as a client). They couldn't verify the chain up to the CA because it is not included in the CA bundle. Adding something on the server side doesn't help here.

jusob• 15 years ago

I'm using it. It is very great to get wildcard certificates, and multi-domain certificates. Yes, their web interface is not great, but it does work.

micheljansen• 15 years ago

I actually did pay them a bit, but only so that I could obtain "verified" status and generate unlimited wildcard certificates for all of my domains. It's a good deal :)

hohoho20122• 15 years ago

upvoting advertising spam? get a free cert with openssl and a shell!

xolox3• 15 years ago

While technically possible that doesn't get you very far, you'd end up with a self-signed certificate. That works fine except for the scary warnings (which look a bit unprofessional). And of course if the client programs of your service do not have an interface for accepting self-signed certificates, you're back to square one.

hohoho20122• 15 years ago

yes i know, this people scaring started with ff2,ie7? - there is nothing wrong with self signed certs, except useless companys wanna make a quick buck selling fud

fduran• 15 years ago

I tried some time ago and didn't get the certificate or any email back, not worth the hassle to save $20 imho.

meow• 15 years ago

Is it possible to sign object code (.exe , .dll etc) with any SSL certificate that we buy ? or does this have to be mentioned clearly in the list of features of SSL certificate..

yardie• 15 years ago

It's possible that an ssl certificate may have that capability added, but in my experience they've always been sold as separate products. If you need a code signing certificate the cheapest I've found was through Tucows. It's hidden in their developer resource subdomain. We paid $199 for a 3 year code signing cert.

pbreit2• 15 years ago

I did not get a good feeling about StartSSL when I tried getting a free cert. First, as many have pointed out, the web site experience is miserable.

Second, I just got a "Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error." at https://auth.startssl.com

For a product that is supposed to be confidence inspiring, StartSSL is the opposite.

mike-cardwell3• 15 years ago

You're supposed to have installed the client SSL certificate in your browser before visiting that URL. It caught me out too initially. They use client side SSL certificates for authentication. I don't know any other site which does this.

xolox3• 15 years ago

It's the first time I came across client side certificates as well. As others have pointed out you have to jump through a bunch of hoops to get a certificate from StartSSL, but if your free time is cheaper than a certificate from another party it can still be worth it (especially because the cost repeats with other parties). I've been a happy customer for more than a year now.

pbreit2• 15 years ago

So is it not possible to catch that and display a helpful page?

But that basically confirms my contention that the user experience is miserable.

cinch3• 15 years ago

when you sign up they install a certificate in your browser. without that, there's no way to login to your startssl account! so make sure to make a backup of it. i lost my account because i didn't realize this...

mike-cardwell3• 15 years ago

The SSL certificate for https://grepular.com/ is from StartSSL. I renewed it 5 days ago. The CN is for "secure.grepular.com" (for historical reasons), with a subjectAltName of "grepular.com"

I'd like to create a wild card certificate, but that costs money. My understanding is that it is a one off fee (60USD) for them to validate your identity and that it doesn't cost money to renew after that point. I could be wrong though. It's not completely clear.

JoshTriplett• 15 years ago

The identity validation expires every year, and you have to pay the $59.90 again to renew it. However, once you've validated your identity, you can generate as many "class 2" certificates (including wildcard certificates) as you like, and those certificates last 2 years.

DEinspanjer2• 15 years ago

I started to do Class 2 identification with StartSSL, but I chickened out after they asked me to provide my marriage certificate and wife's personal info.

They have a very detailed policy document describing all sorts of security procedures they purport to adhere to, but I have no way to validate whether they are actually following those policies and no recourse for me or my wife even if it was determined that they are not following them.

That is just too risky for the value I would get out of the process.

(posted to twitter also https://twitter.com/#!/deinspanjer/status/158596876772450304 )

EDIT: I was contacted by Eddy Nigg with some follow up information. I should have said that the reason they asked for my wife's info is because they wanted phone bills and those are in my wife's name which isn't the same last name as mine. That said, I'll still stand by my statement that the risk and complexity vs. reward was just not suitable for me.

EDIT 2: Okay, they offer an alternative for validation: they can mail you a registered letter with a validation code on it. That is much more acceptable to me, so I'll continue on with the process to see how that goes.

Don't submit to the SSL cert racket. You can get one for no charge

Related Stories