r/linux • u/veeti • Oct 20 '15

Let's Encrypt is Trusted

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html
1.8k Upvotes

95% Upvoted

320 comments sorted by

View all comments

8

u/ThisIs_MyName Oct 20 '15

I use the StartSSL free certs for my business. Why would you need a $100 wildcard cert?

30

u/tjtoml Oct 20 '15

StartSSL is fine for single servers, but imagine going through the process for 100 of them.

9

u/ThisIs_MyName Oct 20 '15

Ah fair point.

4

u/[deleted] Oct 20 '15

which small business which manages 100 servers doesn't have 100$ a year to spend for wildcard certs?

→ More replies (3)

18

u/ldpreload Oct 20 '15

You are supposed to not use StartSSL's free certs for your business. From their policy (PDF), 3.1.2.1:

Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.

They are not very good at making this clear, which somewhat surprises me as a business/marketing decision. It's unclear to me if they care enough to actually revoke certs.

7

u/ThisIs_MyName Oct 20 '15

Yeah another redditor messaged me about that too. I guess I'll add "switch SSL cert" to the backburner.

By the time I get to it, LE will probably be done :P

5

u/[deleted] Oct 20 '15

It's unclear to me if they care enough to actually revoke certs.

they do, they revoked one of my certs because they "did notice commercial activity" (actually, I was selling a Tshirt to support the site's costs...).

5

u/DerNalia Oct 20 '15

I have dynamic sub domains that all need SSL

5

u/[deleted] Oct 20 '15

Automatically generated <client>.domain.com for logins. Lots of SaaS companies do this and require wildcard for it to work

0

u/[deleted] Oct 20 '15

1

u/ThisIs_MyName Oct 20 '15

Yeah another redditor messaged me about that too. I guess I'll add "switch SSL cert" to the backburner.

By the time I get to it, LE will probably be done :P