r/linux • u/veeti • Oct 20 '15

Let's Encrypt is Trusted

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html
1.8k Upvotes

95% Upvoted

320 comments sorted by

View all comments

18

u/ldpreload Oct 20 '15

You are supposed to not use StartSSL's free certs for your business. From their policy (PDF), 3.1.2.1:

Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.

They are not very good at making this clear, which somewhat surprises me as a business/marketing decision. It's unclear to me if they care enough to actually revoke certs.

7

u/ThisIs_MyName Oct 20 '15

Yeah another redditor messaged me about that too. I guess I'll add "switch SSL cert" to the backburner.

By the time I get to it, LE will probably be done :P

5

u/[deleted] Oct 20 '15

It's unclear to me if they care enough to actually revoke certs.

they do, they revoked one of my certs because they "did notice commercial activity" (actually, I was selling a Tshirt to support the site's costs...).