don't encourage class 2 with StartSSL