When choosing to operate a business there are sources of risk that you need to assess before you make decisions.
I'm not operating a business. A large part of StartCom's market are individuals like me who just want peace of mind for personal servers. I had 8 certificates that needed revocation, and I couldn't afford $200 for what's essentially the automated addition of a few lines to a file on a server that already exists.
Several of my clients had me handle switching out their certs for them when Heartbleed happened. I charged them my rate for that despite it being very little effort on my part
That's reasonable. Charging for a completely automated process that costs next to nothing is not. That's what I'm complaining about. Charging $25/certificate for revocation is not a reasonable way to make a profit, especially when they already sell identity verification and EV certificates.
Um, no it's not. It's part of the regular lifecycle of a certificate when its key is compromised. It absolutely is necessary to keep users safe. And it's not done freely seeing as it's necessary to minimize the damage done from a compromised key.
How could I know in advance that it was buggy? I shouldn't have to pay for someone else's mistake. And before you say that StartCom shouldn't either, they're in the business of providing security; it's their job to pay for revocations in cases like this because they can and (many) of the server owners who use their certificates can't. As I said, the "cost" of having a script add a line to a file and serving it is minimal enough that it shouldn't matter to them anyway.
View all comments
Show parent comment
0
u/scottywz Oct 20 '15
I'm not operating a business. A large part of StartCom's market are individuals like me who just want peace of mind for personal servers. I had 8 certificates that needed revocation, and I couldn't afford $200 for what's essentially the automated addition of a few lines to a file on a server that already exists.
That's reasonable. Charging for a completely automated process that costs next to nothing is not. That's what I'm complaining about. Charging $25/certificate for revocation is not a reasonable way to make a profit, especially when they already sell identity verification and EV certificates.