Hacker News Reader

Comment by TorKlingberg | Hacker News Reader

Yes, we are very fortunate to have Let's Encrypt now.

One problem - at least for the project I'm working on - is that Lets Encrypt isn't a replacement for all of StartCom.

We use a StartCom "MS Authenticode" certificate to sign our releases, so Windows users don't get a warning message from the various anti-malware scanners (and similar).

At first glance it sounds like Mozilla not accepting new StartCom cert's at some point won't affect that. It may snowball, but that's an unknown. o_O

NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit.

ButI'm pretty sure Windows is not using NSS as its truststore for those checks. So its up to Microsoft to deal with the de-trusting (which may or may not be modular, I have no idea).

Same here, I've just recently obtained a "Class 2 Code Signing" certificate from StarCom for digital sign my Windows software - as a individual software developer from China, I don't even have alternative options - I tried purchasing from Comodo, but unfortunately there process for checking individuals from out out of the US is extremely difficult.

So I wish this would not affect the certificates StarCom issued for code signing.

I use (reasonably cheap, using MSDN discount) DigiCert one, and I'm an individual living outside US. Very little hassle involved.

Thanks for the info, will DigiCert once the startcom code singing cert. is no longer relevant on Windows :;

Reply on news.ycombinator.com