I want people to use real certs for START TLS email, client certs, etc.
Because StartSSL issues them for free, I actually did exactly that -- used a separate certificate for each of my secure services (IMAP, SMTP, HTTPS, etc.), on each of my domains. I believe I currently have roughly 25-30 certificates issued by them. My thinking was that, despite the extra configuration complexity, if a particular key were compromised, at least I wouldn't have to replace all my certificates!
Ugh.
So now, ironically, I'm faced with having to replace all my certificates, not to mention paying StartSSL $25 per certificate if I want to do the right thing again and have all the existing ones revoked, as well.
Instead, I'm tempted to "pay up" for a wildcard certificate for each of my domains from a provider whose revenue stream comes from minting certs, not revoking them. Configuring my services sure would be easier with 5 certificates rather than 25. Also, I've never leaked a key by any error of my own, and I'm beginning to think that's less likely than someone finding another hole in OpenSSL (or a CA) which requires wholesale certificate replacement again.
Comments
I want people to use real certs for START TLS email, client certs, etc.
Because StartSSL issues them for free, I actually did exactly that -- used a separate certificate for each of my secure services (IMAP, SMTP, HTTPS, etc.), on each of my domains. I believe I currently have roughly 25-30 certificates issued by them. My thinking was that, despite the extra configuration complexity, if a particular key were compromised, at least I wouldn't have to replace all my certificates!
Ugh.
So now, ironically, I'm faced with having to replace all my certificates, not to mention paying StartSSL $25 per certificate if I want to do the right thing again and have all the existing ones revoked, as well.
Instead, I'm tempted to "pay up" for a wildcard certificate for each of my domains from a provider whose revenue stream comes from minting certs, not revoking them. Configuring my services sure would be easier with 5 certificates rather than 25. Also, I've never leaked a key by any error of my own, and I'm beginning to think that's less likely than someone finding another hole in OpenSSL (or a CA) which requires wholesale certificate replacement again.
You can't use wildcard for EV domains.
Thankfully, I don't need those!