<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000'><font face="arial, helvetica, sans-serif"><span style="font-size: 12pt;">Apparently Chrome was just rejecting StartCOM / StartSSL certs issued after Oct 2016, but starting with v57 just released, it's rejecting all StartSSL certs except Alexa top 1M sites. I started getting complaints this morning about our internal mail server. We've been using paid SSL for customer stuff, but StartSSL for various domains used just by our own people.</span></font><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;">I have paid for, and never minded the StartSSL revocation fee. My understanding is that the resources needed to issue a cert are fairly low, but the clients across the world constantly checking for revocations takes a lot more, hence putting the fee there.</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;">I see LetsEncrypt / certbot being suggested for free certs now. Has anyone tried them or have any thoughts? I suppose now I'm going to have to make a move. InCommon isn't an option for us.</div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></div><div><font face="arial, helvetica, sans-serif">https://letsencrypt.org/</font></div><div><font face="arial, helvetica, sans-serif">https://certbot.eff.org/</font></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;">Scott<br><div><span name="x"></span><br></div><br><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Jim Kinney" <jim.kinney@gmail.com><br><b>To: </b>"Atlanta Linux Enthusiasts - Yes! We run Linux!" <ale@ale.org><br><b>Sent: </b>Monday, January 30, 2017 5:05:46 PM<br><b>Subject: </b>Re: [ale] Oct News: StartCom, WoSign distrusted by Mozilla, Google, Apple<br><br><div dir="auto">Yes. All the work stuff that public sees is InCommon. All the work stuff for department only is self signed from our CA. <div dir="auto"><br></div><div dir="auto">For the stuff that really matters, it's self-signed, private CA and client certs as well.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Jan 30, 2017 5:00 PM, "Lightner, Jeffrey" <<a href="mailto:JLightner@dsservices.com" target="_blank">JLightner@dsservices.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US">
<div class="m_-6147582824522080978WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Self signed certificates may work for purely internal setups but for web services presented to the outside world they seldom do. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">If I were to go to <a href="http://emory.edu" target="_blank">emory.edu</a> and it asked me to accept a self signed certificate rather than one from a well known CA I’d probably abandon the connection on
the theory it was a spoof. One doesn’t buy certificates because of a desire to spend money – one buys certificates so others can reasonably trust (based on the CA) the certificate is valid.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Even if I knew and trusted someone at Emory who could provide me with the root certificate on the servers there I’d likely not bother to import it just due
to the annoyance factor. Having to install root certificates for well known CAs is all well and good. Having to install them for everyone that decides they want to self sign would be an administrative nightmare.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">On checking just now it appears Emory uses a specific CA called “InCommon” apparently built specifically for .edu sites.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:ale-bounces@ale.org" target="_blank">ale-bounces@ale.org</a> [mailto:<a href="mailto:ale-bounces@ale.org" target="_blank">ale-bounces@ale.org</a>]
<b>On Behalf Of </b>Jim Kinney<br>
<b>Sent:</b> Monday, January 30, 2017 4:30 PM<br>
<b>To:</b> Atlanta Linux Enthusiasts - Yes! We run Linux!<br>
<b>Subject:</b> Re: [ale] Oct News: StartCom, WoSign distrusted by Mozilla, Google, Apple<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">All of my certs are self signed from my own CA. If you don't trust them, you don't need to be there anyway.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</blockquote></div></div></div><br></div></div></body></html>