Hacker News Reader

Comment by guan | Hacker News Reader

The $24.90 fee also applies to paying Class 2 customers. Only EV certificates get free revocation from StartCom.

My own personal blog (not very critical) has a Class 2 certificate, and I decided to switch to a Comodo PositiveSSL ($5/year for 5 years) and not revoke the StartSSL one.

View on HN

I'm really confused. If you think your original certificate may have been compromised, the only reason to get a new certificate would be to protect your users from a MITM attack. Since you have not revoked your old certificate, you have done nothing to reduce this risk.

This is all kind of pointless for my silly personal blog, so you could view it as a symbolic way of registering my displeasure with StartCom ;-)

To answer your question, suppose I think my key has been compromised. Then I don’t want to continue using that key because non-MITM’ed communication between my server and the client is compromised. So I generate a new key, and I’d like a a new certificate for that new key—the old one won’t work (Apple Secure Transport bug notwithstanding). My users are still vulnerable to a MITM attack, yes.

--edit: assuming that the user’s connection uses a non-PFS cipher suite.

To put it more succinctly: my private key has potentially been compromised, not my certificate. By generating a new private key (which implies a new certificate), I can protect against non-MITM eavesdropping for non-PFS ciphers.

I don't see where it said $5/year. Right now it costs $50 per year.

EDIT:

Are resellers like them more trustworthy? I understand that big CA often sells out to smaller CA and smaller CA sell out to even smaller CA. But how trustworthy are ssls.com and namecheap?

EDIT

Okay. I see. namecheap has been running since 2001 which means it has been doing business pretty well :) So why are they cheaper? Because namecheap are the one managing all the accounts and Comondo is only doing validation?

It's a lot cheaper when you buy it through resellers (like NameCheap).

I went through ssls.com, which for some reason is cheaper than Namecheap even though they’re owned by Namecheap.

http://cheapsslsecurity.com/ is one such reseller. I use them for cheap PossitiveSSL certs for my sites.

Exactly what I did.

I mean, damn people who use a free thing that then get screwed, through no fault of their own, not wanting to be charged $25 for a part of the service that they would never need to use otherwise.

You're either free, or you're not -- StartSSL is a mish-mash of "free" and opportunistic costs.

I think some people are exaggerating how aware Class 1 customers were of the revocation policy. It’s in the FAQ, but the site also advertises “100% Free”. I think the expectation is that free services have automated infrastructure, and that they’re a way to advertise your paid services—and I did, in fact, start out as a Class 1 and later paid for Class 2.

Reply on news.ycombinator.com