Re:Let's Encrypt Has Issued a Billion Certificates
by tialaramex on Thursday February 27, 2020 @04:37PM
(#22438221)
StartCom actually did build a rival service after Let's Encrypt was started named StartAPI.
There were some fairly grave noob-type security bugs in that service (to be fair Let's Encrypt almost went live with a fairly grave but more subtle to understand bug, and did go live with tls-sni-01 which it turns out is unsafe if people use Apache HTTPD for bulk web hosting which er, they do). Because of the grave problems StarCom turned their API off after not very long, presumably with the intent to eventually repair it and re-launch.
A surprising number of people became convinced Let's Encrypt was some sort of attack on StartCom and that the other problems with StartCom/ WoSign (eventually leading to them being distrusted) were a conspiracy to popularize Let's Encrypt.
There were some fairly grave noob-type security bugs in that service (to be fair Let's Encrypt almost went live with a fairly grave but more subtle to understand bug, and did go live with tls-sni-01 which it turns out is unsafe if people use Apache HTTPD for bulk web hosting which er, they do). Because of the grave problems StarCom turned their API off after not very long, presumably with the intent to eventually repair it and re-launch.
A surprising number of people became convinced Let's Encrypt was some sort of attack on StartCom and that the other problems with StartCom/ WoSign (eventually leading to them being distrusted) were a conspiracy to popularize Let's Encrypt.