Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the market for a new SSL certificate and am wondering if I should get an SGC enabled certificate or not? In the past I have just used cheap SSL certificates but since this is for a new company website I want to make sure I have the best but I am unsure whether it is worth paying the extra.

The documentation states that it just enables older browsers to use 128 bit encryption when they would normally only be able to use 40 or 56 bit encryption. Would you pay the extra for older browsers which are likely to be extremely rare?

share|improve this question
up vote 2 down vote accepted

If you are restricting weak, anonymous, and export grade encryption on your web servers anyway in order to comply with the many security standards and policies out there, you're achieving the same effect that an SGC cert would have provided you. There's no need to spend the extra money on them any more.

share|improve this answer
Thank you for the advice. – Cromulent Jun 1 '12 at 12:16
And disabling the now obsolete insecure renegotiation stops step-up from working at all. – Yuhong Bao Nov 8 '14 at 8:32

Even IE6 supports 128 bit encryption. Do you plan to support browsers older than IE6 throughout the site? If not, and I can't imagine you would, then I wouldn't bother.

share|improve this answer
Yeah I guess you are right. Thank you for the advice. – Cromulent Jun 1 '12 at 12:15
Actually that is not true on Win2000 which was first to have SChannel as part of Windows. You had to install a high encryption pack, which luckily is built into SP2 and later. – Yuhong Bao Nov 8 '14 at 8:30

Any browser that's sufficiently old to require SGC certificate to use strong encryption should be considered ancient: it will certainly contain plenty of other security bugs and be open to most vulnerabilities discovered over the past 10 years or so. At that stage, strong or weak encryption would be almost irrelevant.

It's never easy to cut off part of your user base, but if you have users who still use such browsers, just tell them to upgrade.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.