I've used StartCom tool to generate CSR and private keys for my websites,but now i am concerned after reading about StartCom trustworthiness problems.Are my private keys and certificates secure or i should start to worry?


StartCom is a legitimate certificate authority that is trusted by most all browsers and operating systems to issue certificates, so it is unlikely that any trustworthiness problems you are reading about are severe enough to put any data at risk (or else they would lose their trusted status).

Whether StartCom actually had access to your private key depends on how your private key was generated. If you generated them locally and uploaded a certificate signing request (CSR) as is usually recommended, then you should have nothing to worry about as a CSR only contains your public key, not your private. If you went for the less optimal approach of allowing StartCom to generate your key, then theoretically speaking they could have access to it if they had malicious intent. If you are worried, just get a new certificate using a self-generated CSR.

As an alternative to StartCom, you may wish to look at Let's Encrypt for free certificates.

  • 2
    You may find this relevant to the question: Mozilla is going to distrust (new) StartCom certs at some point in future, and potentially completely revoke trust if they are caught working around it by backdating. – Xan Sep 30 '16 at 11:54
  • Note that StartCom is completely defunct at this time, according to this announcement. – forest Jan 3 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.