13

I just got the following email:

Dear StartCom customers,

This electronic mail message was created by StartCom's Administration Personnel:

StartCom, a leading global Certificate Authority (CA) and provider of trusted identity and authentication services, announces a new service – StartEncrypt today, an automatic SSL certificate issuance and installation software for your web server.

StartEncrypt is based the StartAPI system to let you get SSL certificate and install the SSL certificate in your web server for free and automatically, no any coding, just one click to install it in your server.

Compare with Let’s Encrypt, StartEncrypt support Windows and Linux server for most popular web server software, and have many incomparable advantages as:

(1) Not just get the SSL certificate automatically, but install it automatically;

(2) Not just Encrypted, but also identity validated to display EV Green Bar and OV organization name in the certificate;

(3) Not just 90 days period certificate, but up to 39 months, more than 1180 days;

(4) Not just low assurance DV SSL certificate, but also high assurance OV SSL certificate and green bar EV SSL certificate;

(5) Not just for one domain, but up to 120 domains with wildcard support;

(6) All OV SSL certificate and EV SSL certificate are free, just make sure your StartSSL account is verified as Class 3 or Class 4 identity.

StartEncrypt together with StartSSL to let your website start to https without any pain, to let your website keep green bar that give more confident to your online customer and bring to online revenue to you. Let’s start to encrypt now.

Please do not reply to this email. This is an unmonitored email address, and replies to this email cannot be responded to or read. If you have any question or comments, just click Here to send your question to us, thanks.

Best Regards StartCom™ Certification Authority

There are several sketchy-sounding phrases, like and have many incomparable advantages as:

I did glance at the startssl.com website, and it didn't exactly inspire confidence, other than it had the green bar in the URL for StartCom Ltd.:

startssl

Is this a trustworthy CA that just happens to have poor English copywriters, or is there some kind of history that one should be worried about?

Improve this question
5
  • 4
    I don't quite understand... The email starts with Dear StartCom customers, so shouldn't you know better if they are trustworthy?
    – techraf
    Jun 20, 2016 at 13:47
  • When looking at generating certificates, it is also important to ask how easy it is to revoke them. If for some reason a certificate is compromised, it needs be revoked now (not in 3 months, and not for an exorbitant fee). Crucially, this is not mentioned in the advantages of StartEncrypt... so be sure to check.
    – Matthieu M.
    Jun 20, 2016 at 15:48
  • 5
    Even if not for the outdated website design, I might be careful of StartSSL security based on this, this and other issues.
    – Suman
    Jun 20, 2016 at 16:03
  • @SumanSrinivasan, they ended up offering free revocation for Class 1 cert users for Heartbleed... that second "this" was only briefly true.
    – gowenfawr
    Jun 20, 2016 at 19:59
  • 3
    Firefox and Chrome no longer trust certificates issued by StartSSL: webmasters.stackexchange.com/questions/103405/…
    – Stephen Ostermiller
    Apr 17, 2017 at 19:37

2 Answers 2

Reset to default
8

StartCom was very well legitimate while they still operated, but are nowadays not trusted anymore by browsers. As of early 2018, they are completely defunct and have stopped issuing certificates.

At the time when the question was asked, StartSSL/StartCOM was a Certificate Authority as any other. My original answer explaining this in detail is shown below.

However, @Jacob C noticed me, that StartCom is not trusted by browsers anymore, nowadays.

The simple reason was that they (which is: StartCom and WoSign, which were the same company) violated several requirements of CAs and misissued invalid/rogue certificates, so mayor browser vendors distrusted these certificates in 2016.

As of the end of 2017 they seem to operate again under a different domain. They still tried to get included in Firefox, etc. again.

Another update: Later StartCom announced to give up. A Cure53 audit was required to get back into the root store, but Cure53 said, the audited PHP "was full of holes, poorly commented, had few or no tests, and showed every evidence of being hacked together in an enormous rush". It "was frankly a security disaster."

They'll stop business at 2018-01-01.

Outdated answer:

Yes, StartSSL belongs to a StartCom - a legitimate certificate authority

Here some points how one can notice it is a legitimate site:

  • They use an EV certificate.
  • As they are a CA they of course signed the EV certificate by theirself and as the HTTPS connection succeeded you also know your browser trusts that CA.
  • They have a Wikipedia article
  • There is also some evidence on Twitter about this CA (with its bad English-skills) and the message... And you can also find a lot of guides for free certificates which describe how to get and install StartSSL certs.
  • You may also search a snippet of the mail.

FYI: AFAIK this mail was only send to customers who registered at StartSSL, so you certainly used their service at least once - or at least registered there. I doubt that they would send spam mails to random addresses.

BTW: Their web interface has been much uglier recently. They already had been improving it.

Improve this answer
2
15

[This answer was true in June 2016. It is not in $NOW; see Wikipedia.]

Yes, StartCom is a legitimate Certificate Authority.

On the plus side, they were at one time the only provider which would hand out free SSL certificates which were recognized by the major browsers. (There's competition now in Let's Encrypt).

On the minus side, their web site design and implementation is clunky, non-intuitive, and lacks pretty.

(The danconnor link @ZN13 provided appears to be someone wanted more pretty and didn't expect rigidity out of the CA process...........

............you should expect rigidity out of the CA process.)

Improve this answer
11
  • 10
    I've used StartSSL.com in the past and can confirm they are a legitimate Certificate Authority. Their user interface has a (very) dated look and feel, but it works easy enough and they deliver what they promise.
    – Jacco
    Jun 20, 2016 at 13:54
  • @Jacco They actually updated the site design recently. It now feels like any other modern site.
    – Bob
    Jun 20, 2016 at 15:40
  • If anything that link by ZN13 makes StartSSL look particularly trustworthy and responsible. Any CA that would've given the blog author an EV certificate with the information provided, should be banned (sadly that'd be most I'm afraid).
    – Voo
    Jun 20, 2016 at 16:02
  • They changed their process since that blog post was made. My last renewal didn't ask for a phone bill or send me anything by mail. Instead they asked for a photo of myself holding, or at least in the picture with, one of my identification documents.
    – Art McBain
    Jun 20, 2016 at 18:15
  • 3
    I used StartSSL for several years & had no problem. Then Let's Encrypt appeared & shaked the market. Last week I got an email about a letsencrypt-alike methodology from StarCom. They made extended verification certs free (IIRC) & published a cli tool to auto-install & configure the cert on your server - I didn't test it. Anyway, I support everything that @gowenfawr wrote, but would add an extra consideration: Until recently, you needed to pay StartSSL a fee to revoke a certificate - don't know if still applies. Besides that you couldn't renew a free cert if did not expire yet! That's terrible!
    – jweyrich
    Jun 20, 2016 at 18:26

Not the answer you're looking for? Browse other questions tagged .