StartSSL suspends services after a security breach

Not good. StartSSL is the only issuer of free SSL certificates that are accepted by major browsers. Hope they come back online soon.

Thanks "there"! It's good to know. The trouble is neither the sans.org notice nor the StartSSL site give any real detail on how bad this latest SSL fiasco really is. For example:

> Subscribers and holders of valid certificates are not affected in any form. Visitors to web sites and other parties relying on valid certificates are not affected.

In other words, if there are bogus certs out there, they will still work. (sigh)

As I understand the register article, it seems that the website was cracked, but no false certs were issued.

Sounds like success story about a responsible operator with the information we have so far.

Theregister has more info:

http://www.theregister.co.uk/2011/06/21/startssl_security_br...

Hackers managed to somehow generate certificates for arbitrary domains. Looks like they spoke directly to Eddy Nigg (StartCom's CTO and COO) to get this info

Cui bono? (http://en.wikipedia.org/wiki/Cui_bono)

The $500+ SSL rent-seekers, of course.

They didn't need to create fake Start certs or steal data - damaging Start's reputation may have been enough to liven up interest in the competition's wares.

does anyone know of any other inexpensive ssl cert providers?