Hacker News Reader

Comment by wereHamster | Hacker News Reader

> But if you do not need wildcards, the StartSSL free certificate has been an option for a long time

And if you need a wildcard cert, startssl will give you any number of those for just 50$.

Actually it is $60 now - and the signup process for wildcards requires heavy duty validation - IDs, passports, corporation documents and other things are sometimes requested.

I wouldn't call that heavy duty. Sending them a scan of your passport or ID (which you already have somewhere on file...) is hardly too much to ask for. It didn't take me more than 10 minutes. And they'll even call you back to validate the information on a sunday! (which I think is impressive)

gee how benevolent of them

while I in general also disagree with the whole CA thing one has to admit that running a CA is not for free. That setting up the auditing, buying a HSM, running the interfaces and so on. And last but not least running the CRL/OCSP infrastructure. From my point of view the main part you pay a good CA for is that they run the OCSP service. Though with OCSP stapling that burden is a bit relaxed.

startssl covers the cost of their labor, not the cost of a 'license' to use the certificate. Their cost is validating your identity, which is a one time thing. They call you, ask a few questions and that's it. 10 minutes of their and your time. After that you are entitled to create as many certificates as you want. There's one caveat: the validation is only for one year, you have to renew it when your certificates are about to expire. Even if you have just one domain, it's cheaper than the alternatives. If you have multiple domains, startssl is much cheaper.

Reply on news.ycombinator.com