StartSSL PKI retweeted
Replying to @startssl
@Savagedlight Check with the CertMaster, there can be many different reasons.
@pgbovine @nsfmc It really depends on the use case, site and other goals. Many times Class 1 (free) is perfectly fine and valid for one year
Even if it's sometimes a bit hard, it's worth the effort. Read sslshopper.com/startcom-cert…
Create request.inf for SHA2 CSR on Windows
[NewRequest]
HashAlgorithm = SHA256
...
Issue: certreq -new request.inf request.req
Chrome will keep trusting your SHA1 hashed Class 1 cert until it expires, your next will be SHA2 hashed by the current default.
Clarification - if you have a Class 1 (free) cert hashed with SHA1, no reason to panic. Your next cert will be SHA2 hashed and not affected.
StartSSL PKI retweeted
Has anyone used this free SSL service? Seems too good to be true...
startssl.com/
@exilsoester @cbirkenbeul Because of mixed content, not because of StartSSL. See startssl.com/?app=25#32
Migration guide to SHA2 from @kaiengert
kuix.de/blog/index.php?entry…
@roryprimrose Please review startssl.com/?app=25#10 and following items.
@ralphholz @agl__ You must be access somehow somewhere that MS cert that MAC imports incorrectly, I'd consider it a bug. Could be also mail.
@ralphholz @KevinSMcArthur Then the MS cert entered the keychain otherwise and it should be removed. It's not used for MS code signing.
@ralphholz This is a mistake at the server, remove that MS certificate from your keychain.
From our colleagues at GlobalSign: blog.cloudflare.com/the-hard… — it imposes a real cost.



