Anne van Kesteren

TLS: issues with StartSSL

On the upside, they basic offer certificates that are free for non-commercial usage and help out quickly. If you have a more complicated domain setup (e.g. whatwg.org requires both *.whatwg.org and *.spec.whatwg.org, html5.org requires *.html5.org), you have to get validated for USD 60. That validation then allows you to issue as many non-commercial certificates as you want for domains you own for about a year. If you pay, the certificates last for two years, otherwise one.

Now the downside:

• Revoking a certificate costs USD 25, even though it should be easy to automate.
• Does not allow setting the Common Name on a certificate. E.g. if you have both example.com and sub.example.com it will likely pick the latter, even though that might not at all be the most common name.
• Suggested intermediate certificate uses SHA-1 rather than SHA-256. A SHA-256 intermediate certificate is available.
• The user interface is really quite bad and not forgiving. You have to carefully follow the steps and not make mistakes.
• They spelled my name with an uppercase “v”. Very sad. This ends up on every certificate. Not sure how to resolve this.