StartCom / StartSSL

» see startssl.com as it lived, on the wayback machine

~ the last words ~

There is a small padlock in the corner of the address bar and I have been looking at it since roughly 1999. I have clicked it to see what is behind it maybe four times, all four of them because something had already gone wrong. Almost nobody clicks. The padlock is a claim that a company you have never heard of has vouched for the site you are on, and the entire arrangement functions because you take it on faith. StartCom was one of those companies, and for a long stretch it was the only one that vouched for you without sending an invoice.

Eddy Nigg founded it in Eilat in 1999. The certificate business grew out of a Linux distribution the company was selling, which is an unlikely origin for a piece of load-bearing web infrastructure and was not unusual for the period. The product that mattered was StartSSL Free: a Class 1 certificate, good for three years, issued at no cost to anyone who could prove they controlled a domain. In 2005 that offer had no competition. Everybody else was charging a few hundred dollars a year for a file the machine generates in a second.

The catch sat on the other side of the transaction. Issuing was free, revoking was not, and StartCom charged 24.90 dollars to pull a certificate back. In April 2014 Heartbleed forced sites everywhere to treat their private keys as compromised, and StartCom held the line on the fee. People who had been given something for free discovered what the free thing had actually been priced against, and the argument that followed did the company more damage than anything technical had.

None of this ever touched me directly and that is the honest position to write it from. I have never chosen a certificate authority in my life, and neither has anybody reading this unless it was their job. That is the odd shape of the category. Its customers were websites and its users were browsers, and the several billion people downstream of the whole arrangement never got a say and never wanted one.

~ the record ~

~ what free actually cost ~

A Class 1 certificate proved one thing only, which was that whoever asked for it could read mail at the domain in question. It said nothing about who they were. That was enough for encryption and not enough for a bank, and the tiering was honest about it.

What StartSSL Free did was put HTTPS inside reach of a personal site or a small forum with no revenue behind it. Everything on the web that was too small to justify a few hundred dollars a year got its encryption from this one Israeli company for about a decade, which means the failure that came later was concentrated in exactly the places least able to notice or respond.

~ the backdated certificates ~

The browser vendors banned new SHA-1 signatures from 1 January 2016 because the algorithm was breakable and everyone had known it for years. WoSign, a Chinese authority, kept issuing them anyway and stamped them with earlier dates so the systems checking would let them through. StartCom did the same. Backdating is not a bug you file, it is a deliberate act by the one party in the arrangement whose entire product is being believed.

It was not the only finding. In 2015 WoSign's validation let an applicant add arbitrary extra domains to a certificate, and somebody who controlled a subdomain of github.io walked out with a certificate covering the base domain. Mozilla's staff assembled the incidents into a public document and the count ran past a dozen. Nobody had to prove intent for the conclusion to follow.

~ who gets to decide ~

The thing that killed StartCom is that WoSign bought it in the autumn of 2015 through a chain of holding companies and told nobody, while both entities sat in browser trust stores as separate names. Qihoo 360 was at the top of the chain. A trust store is a list of who is allowed to vouch, and the one rule you cannot break is being quiet about who owns you.

Then the sequence, which is worth reading as a sequence. Mozilla announced on 24 October 2016 that certificates issued after the 21st would not be trusted from Firefox 51. Google followed on 1 November for Chrome 56, and by Chrome 61 in September 2017 the distrust covered everything regardless of issue date. Apple blocked anything dated on or after 1 December 2016, and Microsoft cut Windows 10 off in the September. Four companies acting in sequence, no court and no regulator anywhere in it, and a business that had existed for seventeen years was finished inside eleven months.

~ what came after ~

Board chairman Xiaosheng Tan told The Register on 17 November 2017 that StartCom would close on 1 January 2018 and stop issuing. Revocation lists stayed up for two more years so that anything still in the wild could be checked, and the root key pairs expired in 2020, which is the real ending. By the time of the announcement w3techs put StartCom at roughly 0.1 percent of all websites. It had been the free option and it no longer was.

What replaced it was announced while all of this was still unfolding. Let's Encrypt went into public beta in December 2015, backed by browser makers and infrastructure companies rather than by a fee, and gave away ninety-day certificates that a script renews for you. It made the paid tier of the category optional for most of the web. StartCom had been first to that idea by sixteen years and monetized it in the one place that made people angriest, and when the trust went there was nothing to appeal to, because trust here is not a thing you own. It is a row in a file that ships with somebody else's browser.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »