News for hackers. Stuff that matters.

A comment on Why I stopped using StartSSL (Hint: it involves a Chinese company). Parent comment

Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by 0x0 on Tuesday February 16, 2016 @03:17AM (#11108530)
Windows XP and Android 2.x comes to mind. Non-HTTP protocols (IMAP, SMTP, XMPP, SIP etc) may also struggle with SNI.

But the biggest problem here is wildcarded subdomains, since LE doesn't let you get more than 5 certificates per domain.

[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by jhkaghjkga on Tuesday February 16, 2016 @03:34AM (#11108574)
That's wrong. You can get more than 5 certs/domain: either you have to wait a week (it's 5 certs/domain/week), or you include multiple hostnames in a single certificate (up to 100 IIRC). The latter would allow 500 subdomains/week.
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by 0x0 on Tuesday February 16, 2016 @04:08AM (#11108674)
That's quite limiting if you are handling customer signups, and it still breaks SNI-less clients except for the first batch.
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by Tepix on Tuesday February 16, 2016 @03:48AM (#11108615)
Windows XP and Android 2.x both have big security problems. You should encourage your users to upgrade.

Also I think with Firefox on Windows XP it should work.

[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by 0x0 on Tuesday February 16, 2016 @04:07AM (#11108672)
That doesn't help when you are targeting a market where Android 2.x is prevalent.
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by Tepix on Tuesday February 16, 2016 @04:16AM (#11108701)
True. Is there no workaround for Android 2.x? What if you install a 3rd party browser?
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by 0x0 on Tuesday February 16, 2016 @04:41AM (#11108802)
You'd probably have to bring your own SSL stack, which is not something you'd want to do for several reasons (staying on top of code patches, maintaining a CA root store, integrating any custom CA roots the user has added, handling any custom HTTP proxy settings, etc).
[ Parent | on HN ]