please help improve this article by adding citations to reliable sources . unsourced material may be challenged and removed . april 2010 learn how and when to remove this template message startcom ltd. type private company industry internet security public key infrastructure founded 1999 ; 17 years ago 1999 headquarters eilat israel key people founder & former ceo eddy nigg website www.startssl.com startcom is a certificate authority based in eilat israel that has three main activities startcom linux enterprise linux distribution startssl certificate authority and mediahost web hosting . startcom has set up new branch offices in china and uk . 1 contents 1 startssl 1.1 trustworthiness 1.2 limitations of startssl unlimited free certificates 1.3 response to heartbleed 2 criticism 3 see also 4 references 5 external links startssl edit startcom offers the free class 1 x. 509 ssl certificate startssl free which works for webservers ssl tls as well as for e mail encryption s mime . it also offers class 2 and 3 certificates as well as extended validation certificates where a comprehensive validation with costs is mandatory . in june 2011 the company suffered a network breach which resulted in startcom suspending issuance of digital certificates and related services for several weeks . 2 the attacker was unable to use this to issue certificates and startcom was the only breached provider of six where the attacker was blocked from doing so . 3 trustworthiness edit the startssl certificate is included by default in mozilla firefox 2.x and higher in apple mac os x since version 10.5 leopard all microsoft operating systems since 24 september 2009 4 5 and opera since 27 july 2010 . 6 since google chrome apple safari and internet explorer use the certificate store of the operating system all major browsers include support for startssl certificates . limitations of startssl unlimited free certificates edit while certificates are free and unlimited for certain uses there are limitations imposed unless an upgrade is purchased three year certificate validity certificate revocation requires a fee response to heartbleed edit on 13 april 2014 startcom announced 7 a faq page 8 related to heartbleed a critical bug in openssl estimated to have left 17 % of the internet s secure web servers vulnerable to data theft . startcom s policy is to charge 25 for each revoked certificate and it refused to waive this fee in lieu of certificates compromised due to heartbleed though some paying customers were granted a single free revocation . 9 10 11 12 this caused many to doubt startcom s status as a certificate authority . 13 when provided with proof of a compromised certificate startcom refused to revoke the certificate for free providing trust even after startcom had learned that the certificate had been compromised . 14 criticism edit customers have reported 15 with startssl infrastructure a certificate must be revoked before a new certificate can be generated and as startssl does not state how long it takes to revoke and reissue a certificate a site can be inaccessible securely for an undetermined amount of time with one customer reporting about 5 hours of downtime . 12 in august 2016 it was reported that startcom was sold to wosign a chinese ca. 16 17 18 the original disclosure was taken down for legal reasons . 19 however repostings of the original articles are still available . 17 the relationship is unclear but it seems as if the startcom technical infrastructure was being used by wosign when they were caught issuing about a hundred 20 improperly validated ssl certificates including a certificate for github.com . 21 22 see also edit cryptography public key certificate public key infrastructure let s encrypt references edit about startcom . the register . apr 26 2016 . retrieved june 7 2016 . web authentication authority suffers security breach . the register . june 26 2011 . retrieved january 14 2012 . how startcom foiled comodohacker 4 lessons . informationweek . september 8 2011 . retrieved december 20 2012 . microsoft adds support for startcom certificates press release . startcom.org . september 24 2009 . retrieved 2011 01 14 . microsoft updates trusted root certs to include startcom . sophos.com naked security blog . september 27 2009 . new roots new ev and a new public suffix file . opera.com rootstore blog . twitter startssl we released a small faq page ... . startcom . 13 april 2014 . heartbleed f.a.q. . startcom . 13 april 2014 . i use startcom and i revoked and re keyed yesterday . in the revocation reason ... hacker news . geoff . 9 april 2014 . twitter codeawe tonylampada startssl ... . j. breitsprecher . 11 april 2014 . re openssl cve 2014 0160 aka heartbleed . jan. 9 april 2014 . a b re openssl cve 2014 0160 aka heartbleed . arnowelzel . 10 april 2014 . most startssl certs will stay compromised . 9 april 2014 . startssl please revoke me . 12 april 2014 . archived from the original on april 12 2014 . cs1 maint unfit url link re openssl cve 2014 0160 aka heartbleed . arnowelzel . 9 april 2014 . ca wosign issues mozillawiki . wiki.mozilla.org . retrieved 2016 09 08 . a b thoughts and observations wosign s secret purchase of startcom ; wosign threatened legal actions over the disclosure . www.percya.com . retrieved 2016 09 08 . thoughts and observations startcom operated solely by wosign in china an analysis of the new startcom website . www.percya.com . retrieved 2016 09 08 . https letsphish.org https groups.google.com forum topic mozilla.dev.security.policy k9pbmylci8i ca wosign issues mozillawiki . wiki.mozilla.org . retrieved 2016 09 08 . https www.schrauger.com the story of how wosign gave me an ssl certificate for github com external links edit startcom website startcom blog retrieved from https en.wikipedia.org w index.php title startcom & oldid 743113713 categories certificate authoritiescompanies established in 1999hidden categories cs1 maint unfit urlarticles needing additional references from april 2010all articles needing additional referencespages using infobox company with unsupported parameters navigation menu personal tools not logged intalkcontributionscreate accountlog in namespaces article talk variants views read edit view history more search navigation main pagecontentsfeatured contentcurrent eventsrandom articledonate to wikipediawikipedia store interaction helpabout wikipediacommunity portalrecent changescontact page tools what links hererelated changesupload filespecial pagespermanent linkpage informationwikidata itemcite this page print export create a bookdownload as pdfprintable version languages deutsch norsk bokm l edit links this page was last modified on 7 october 2016 at 22 28 . text is available under the creative commons attribution sharealike license ; additional terms may apply . by using this site you agree to the terms of use and privacy policy . wikipedia is a registered trademark of the wikimedia foundation inc. a non profit organization . privacy policy about wikipedia disclaimers contact wikipedia developers cookie statement mobile view