Hacker News Reader

Comment by js4all | Hacker News Reader

Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn this when I tried to callout to a web service (with a startcom cert) from Salesforce.

Also their certs are only free as long as you don't need to revoke it.

View on HN

Came here to say something like this. While the site is a bit of a pain, and the certs are free, make damn sure you have your site configured the way you want it before you generate the certificate.

It's $25 to revoke a cert, i.e. free up the name so you can use it again elsewhere. I used part of my domain name for an XMPP cert that I later wanted to use for a web subdomain with the same name.. nope. Stupid.

Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.

you'd want to revoke it if someone steals your private key.

Given the way Startcom operates, that could become expensive quickly. Since your private key is your gateway into your account (Why they went with this method instead of requiring a sensible password is beyond me, it's one of the reasons their site is a huge pain...), theoretically every certificate you own is compromised, and therefore you'd be out $25 for each one.

..ouch!

i once built a clojure web app and used a startssl free certificate. it worked fine after i imported it into the java keystore. i was using OpenJDK under linux. were you using Oracle's java?

Yes, it was Oracle's. The problem was on the Salesforce side (as a client). They couldn't verify the chain up to the CA because it is not included in the CA bundle. Adding something on the server side doesn't help here.

Reply on news.ycombinator.com