StartCom

StartCom is a company based in Eilat, Israel that has three main activities: StartCom Linux Enterprise (Linux distribution), StartSSL (Certificate Authority) and MediaHost (Web hosting).

StartSSL

StartCom offers the free (for personal use) Class 1 X.509 SSL certificate "StartSSL Free", which works for webservers (SSL/TLS) as well as for E-mail encryption (S/MIME). It also offers Class 2 and 3 certificates as well as Extended Validation Certificates, where a comprehensive validation (with costs) is mandatory.

In June 2011, the company suffered a network breach which resulted in StartCom suspending issuance of digital certificates and related services for several weeks.^[1] The attacker was unable to use this to issue certificates (and StartCom was the only breached provider, of six, where the attacker was blocked from doing so).^[2]

The "StartCom Certificate Policy & Practice Statements" document §3.1.2.1 is explicit that the Class 1 (free) certificates are for non-commercial uses only.^[3] The previous version of the CPS did not include this restriction.^[4]

Trustworthiness

The StartSSL certificate is included by default in Mozilla Firefox 2.x and higher, in Apple Mac OS X since version 10.5 (Leopard), all Microsoft operating systems since 24 September 2009,^[5][6] and Opera since 27 July 2010.^[7] Since Google Chrome, Apple Safari and Internet Explorer use the certificate store of the operating system, all major browsers include support for StartSSL certificates.

Limitations of StartSSL Unlimited Free Certificates

While certificates are free and unlimited for certain uses, there are limitations imposed unless an upgrade is purchased:

• One-year certificate validity (a new certificate can be issued for free after the old certificate expires).
• One domain plus one host name per certificate (e.g. www.example.com and example.com, or www.service.example.com and service.example.com).
• No commercial use^[3]
• Certificate revocation requires a fee

Response to Heartbleed

On 13 April 2014, StartCom announced^[8] a FAQ page^[9] related to Heartbleed, a critical bug in OpenSSL estimated to have left 17% of the Internet's secure web servers vulnerable to data theft.

StartCom's policy is to charge $25 for each revoked certificate, and it refused to waive this fee in lieu of certificates compromised due to Heartbleed, though some paying customers were granted a single free revocation.^{[10][11][12][13]} This caused many to doubt StartCom's status as a certificate authority.^[14] When provided with proof of a compromised certificate, StartCom refused to revoke the certificate for free, providing trust even after StartCom had learned that the certificate had been compromised.^[15]

Criticism

Customers have reported^[16] with StartSSL infrastructure, a certificate must be revoked before a new certificate can be generated, and as StartSSL does not state how long it takes to revoke and reissue a certificate, a site can be inaccessible securely for an undetermined amount of time, with one customer reporting about 5 hours of downtime.^[13]

See also

• Cryptography
• Public key certificate
• Public Key Infrastructure

References

External links

• StartCom website
• StartCom blog