StartSSL is so painfully obtuse and difficult to use that I eventually just gave up and paid someone to do it for me.

I'm quite pleased with StartSSL.

Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL.

You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want.

Only drawback is that the certificates are only valid for one year.

> FYI, StartSSL's free personal SSL certificate only valid for new users for the first year

They only allow one-year certs to be generated, but you can renew them and get as many of them as you want. I've got class one certs from them for two different domains, and I've replaced both those certs twice as they've expired.

Then again, maybe they've changed their policies in the past six months.

> requires a valid U.S. physical non-commercial address for registration

Does it? I'm based in Ireland, and I haven't had to provide the with a valid US physical address, unless this is something new that they've brought in during the last half a year or so.

> and is subject to $79 for revocation fee.

Yup, that's the most annoying thing about dealing with them.

> Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process.

I can't say I've had that issue myself. They're not as fast as I'd like, but I've never had any major problems with them.

It doesn't matter much for TLS certificates (the slowness might though) except if they choose to issue another certificate under your name with their private key to MITM your connections, it'd look more legitimate if your real certificate is issued by the same CA, but admittedly, the real issue here is on the client side: browsers trusting way too many CAs that directly include many governments.