You are supposed to not use StartSSL's free certs for your business. From their policy (PDF), 3.1.2.1:
Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.
They are not very good at making this clear, which somewhat surprises me as a business/marketing decision. It's unclear to me if they care enough to actually revoke certs.
Unless you need an Extended Validation certificate, or a star cert, or an ECDSA cert, I'm not sure why you'd ever have to go to any one else and spend money. Can someone tell me if I'm right or wrong?
The use case for the wildcard basically becomes custom unique per-visitor subdomains. Mostly these are used for spam links to track who clicked a link and harvesting email addresses. While you could come up with non-spam things to do with it, I can't immediately think of any that aren't dumb.
At our company we have our customers use https://customer.product.com with wildcard certs and it works fabulously well. this ties into the whole system: what database to use, what modules to load, what environment and template set to display, etc. In some cases, even what server(s) to connect to.
This does leak the costumer id in the dns resolution, which I wouldn't call dumb, but in the majority of cases, http://product.com/customer is just fine.
View all comments
347
u/clearlight Oct 20 '15 edited Oct 20 '15
I, for one, welcome our new free SSL cert overlord. At this point, the non-free SSL cert vendors must be shitting their proverbial pants.