"The "StartCom Certificate Policy & Practice Statements" document §220.127.116.11 is explicit that the Class 1 (free) certificates are for non-commercial uses only. The previous version of the CPS did not include this restriction."
You can, however, pay $60 for a personal validation (and potentially an extra $60 for company validation) to use the certs commercially. Actually, this validation lets you generate any number of SSL certificates for sites you own, for two years. This also includes wildcard certs, which you pay through the nose for from everyone else.
These guys are so much cheaper than the rest of the SSL vendors it's not funny. I've got my wildcard StartSSL certificate up on codano.com, and I've generated a few more for internal use. The validation literally took about two hours from start to finish, and most of that was just waiting for an email response/validation phone call and me scanning my passport and business documentation.
Can't recommend them enough.
Good info. Thanks!
Note that they will confirm that you are the owner of domains you try to request certs for.