{"comment":{"created_at":"2011-10-13T18:17:57Z","body":"a) If you're big enough then sooner or later you will get hacked in some way. This is something you have to accept (see kernel.org).\r\n\r\nb) StartSSL their key signing infrastructure has a good security design, so the attacker wasn't able to create fake certificates. Their website got hacked and they fixed it.\r\n\r\nc) StartSSL is the only issuer which offers free certificates as far as I know.\r\n\r\nd) SSL is broken but it isn't worthless. If you think it is worthless why do you use it at all?","updated_at":"2011-10-13T18:17:57Z","url":"https://api.github.com/repos/diaspora/diaspora/issues/comments/2398081","id":2398081,"user":{"avatar_url":"https://secure.gravatar.com/avatar/ff2f1e3c638391229f288e9449c387f3?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"ff2f1e3c638391229f288e9449c387f3","url":"https://api.github.com/users/gladiac","id":545480,"login":"gladiac"}},"action":"created","issue":{"number":2099,"created_at":"2011-10-04T03:09:33Z","pull_request":{"diff_url":null,"patch_url":null,"html_url":null},"body":"First of all, thanks for your work on the project.\r\n\r\nIt seems Diaspora definitely does not support self-signed SSL certificates, but the free provider recommended in the documentation (StartSSL) [has been recently compromised](http://www.eweek.com/index2.php?option=content&task=view&id=69344&pop=1&hide_ads=1&page=0&hide_js=1&catid=45) and as of June 2011, *\"The fifth certificate authority to be hacked this year, StartSSL has suspended issuing its free SSL certificates indefinitely.\"*\r\n\r\nAt a minimum, I'd recommend removing the reference to using StartSSL from the docs as soon as possible, and instead recommend [CAcert](http://www.cacert.org/) provided that Diaspora works with their certs. (not sure on this as I saw an issue that seemed to state that CAcerts were not working with Disapora)\r\n\r\nTo my knowledge, CAcert has not been compromised and at least is as trustworthy as SSL can be considered trustworthy these days.","comments":5,"title":"What's the deal with SSL and specifically StartSSL?","updated_at":"2011-10-13T18:17:57Z","url":"https://api.github.com/repos/diaspora/diaspora/issues/2099","id":1809961,"assignee":null,"milestone":null,"closed_at":null,"user":{"avatar_url":"https://secure.gravatar.com/avatar/c52501e384405cbf12dc477a5c95e6f3?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"c52501e384405cbf12dc477a5c95e6f3","url":"https://api.github.com/users/brianshumate","id":77563,"login":"brianshumate"},"html_url":"https://github.com/diaspora/diaspora/issues/2099","labels":[],"state":"open"},"legacy":{"issue_id":1809961,"comment_id":2398081}}