FYI: StartSSL does not appear to be a trusted root CA

[DBordello]

Just a heads up.  I was trying to use a StartSSL certificate, and was receiving SSLPeerUnverifiedException errors.  As far as I could tell, my server was providing the complete certificate path.  My best guess is that the StartSSL root certificate is not installed in the Java truststore.

In the end, I ponyed up $10 for a different certificate.  However, I thought I might save everybody some trouble in the future.

To be honest, I don't really see the need for a validated certificate for callbacks.  There isn't anything terribly interesting in the data.  The encryption might be good, but I don't think we are terribly concerned about MITM attacks.

[JeremiahFitbit · Accepted solution]

Hi DBordello,

Thanks for letting us know. You're the first to report this. I've asked my ops team to investigate into StartSSL's CA.

---

@DBordello wrote:

To be honest, I don't really see the need for a validated certificate for callbacks.  There isn't anything terribly interesting in the data.  The encryption might be good, but I don't think we are terribly concerned about MITM attacks.

---

You might not be concerned, but other API users are very concerned about this. Fitbit does not want to send data somewhere it shouldn't be sent.

[DBordello]

Great, thank you for the prompt reply.  No big deal, just thought I'd report it.

---

@JeremiahFitbit wrote:

Hi DBordello,

Thanks for letting us know. You're the first to report this. I've asked my ops team to investigate into StartSSL's CA.

---

@DBordello wrote:

To be honest, I don't really see the need for a validated certificate for callbacks.  There isn't anything terribly interesting in the data.  The encryption might be good, but I don't think we are terribly concerned about MITM attacks.

---

You might not be concerned, but other API users are very concerned about this. Fitbit does not want to send data somewhere it shouldn't be sent.

---