From our colleagues at GlobalSign: blog.cloudflare.com/the-hard-costs… — it imposes a real cost.

news.netcraft.com/archives/2014/… Who is reusing keys?

@ralphholz This is a mistake at the server, remove that MS certificate from your keychain.

@ralphholz Kevin McArthur Then the MS cert entered the keychain otherwise and it should be removed. It's not used for MS code signing.

@ralphholz Adam Langley You must be access somehow somewhere that MS cert that MAC imports incorrectly, I'd consider it a bug. Could be also mail.

@roryprimrose Please review startssl.com/?app=25#10 and following items.

Migration guide to SHA2 from Kai Engert at X kuix.de/blog/index.php…

@exilsoester Caren Birkenbeul Because of mixed content, not because of StartSSL. See startssl.com/?app=25#32

@roryprimrose Please contact the CertMaster, thanks.

@framasky Yes, see also startssl.com/?app=25#14

Has anyone used this free SSL service? Seems too good to be true... startssl.com

@fdevillamil @markcrooknz They do for a few years already :-)

Clarification - if you have a Class 1 (free) cert hashed with SHA1, no reason to panic. Your next cert will be SHA2 hashed and not affected.

Chrome will keep trusting your SHA1 hashed Class 1 cert until it expires, your next will be SHA2 hashed by the current default.

Create request.inf for SHA2 CSR on Windows [NewRequest] HashAlgorithm = SHA256 ... Issue: certreq -new request.inf request.req

Even if it's sometimes a bit hard, it's worth the effort. Read sslshopper.com/startcom-certi…

@pgbovine marcos It really depends on the use case, site and other goals. Many times Class 1 (free) is perfectly fine and valid for one year

@pgbovine marcos Class 2 level would be for two years.

@Savagedlight Check with the CertMaster, there can be many different reasons.