Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm looking into getting a few SSL certificates for domains to cover the following:

  • autodiscover.example.com
  • remote.example.com
  • www.example.com

Wildcard certificates are too expensive, so I'm going to purchase a single certificate for each subdomain (I have enough IP addresses to go around).

My question is, what makes a $10 certificate better than a $100 certificate?

Take for example the product range on this page. I know what an EV is (don't need it), and I know what a Secure Seal is (our users trust us already, so don't need that).

But why would I go for a QuickSSL for $69 when I can get a RapidSSL for $10? The only difference is "Brand Recognition" (Moderate to Medium) and insurance.

Can anyone spread any light on what they mean by "Brand Recognition"? Our public website is already well trusted by our users, and the other two subdomains are just for Outlook Anywhere (and thus won't be displayed in a browser).

Re-posted relevant question from http://serverfault.com/questions/82039/difference-between-ssl-products

share|improve this question
1  
If you have bought an expensive SSL certificate you have helped Shuttleworth go into space. How can that possibly be a scam? –  delete Jul 9 '10 at 1:47
1  
Back in the good old days of the internet, it may have been expensive to provide theses services. They said you are paying for the service to verify your identity. The investigation for non-ecommerce certificates in my experience is trivial and spurious. Sorry, I just despise this whole SSL industry. I wish someone would create a non-profit that would provide the same services. –  citadelgrad Jul 9 '10 at 15:35
1  
This is not a programming question –  Kamyar Oct 14 '10 at 19:11
1  

5 Answers 5

up vote 22 down vote accepted

"My question is, what makes a $10 certificate better than a $100 certificate?"

Most of the time the more expensive the certificate, the older the certification company is. Since the list of trusted companies ships with the browser, an advantage of using a more expensive certificate is that it will be trusted by old browsers.

For example, maybe a $10 certificate isn't trusted by IE5.

But that's about it.

share|improve this answer
6  
And the garbled mess that IE5 displays after displaying any modern standards compliant web site is also untrusted by the user of such a piece of #&*$ :) +1 –  Tim Post Jul 9 '10 at 16:44
    
Also, for certain types of certificate the issuing company puts more effort into verifying the details of the person/company requesting it (en.wikipedia.org/wiki/Extended_Validation_Certificate). If the browser shows that a certificate is EV and the user notices it they may have more confidence. IMHO they won't notice. –  paulmorriss Jan 14 at 12:39
    
You missed the point, if a certificate is more expensive then you are covered more, if your website gets hacked a 100$ certificate may pay you up to 1 million dollars where as 10$ certificate may not pay you anything. –  SSpoke May 11 at 3:24

I think cartel is the word you are looking for

share|improve this answer

"My question is, what makes a $10 certificate better than a $100 certificate?"

The answer is nothing. A cert is a cert is a cert (since you don't care about "Brand Recognition"), so without EV packages a cert is just a commodity. This explains the history quite nicely.

I do think, however, that brand recognition could be important to some users, but if you are certain you are a trusted source, then I wouldn't worry about it.

share|improve this answer

I asked the same thing of DigiCert the other day: why are a lot of certificates so much cheaper than yours (~$25 vs ~$100 per year)? Here is the answer they gave me (in my words):

The other companies only verify your domain name (that the person getting the certificate owns the domain name) whereas DigiCert (and others) verify the company behind the domain name.

This means they need to check the corporate registry in your country to verify that your company exists and that you are related to company some how. This often also requires a phone call and some other checks. Without this check, all that is required is a computer to verify the whois record with the information entered.

So, in my assessment, if you're going to be using the certificate on a site where the customer is paying for something or entering their personal information, then a more expensive certificate is better. If you're just using the site internally (within the company) then a cheaper certificate is probably all you need.

share|improve this answer

There's also the issue where some browsers pick out a lot of perfectly fine SSL certificates and marks them as potentially unsafe. This is due in part around what Darryl said (increased diligence on the part of the SSL vendor to confirm who you are). It's not that the security itself is really any different, it's just intended to provide a better layer of trust.

There's also things like management capability (I can issue and re-issue certs to my hearts content without delay, which has been very handy when domain names suddenly become different), and other perks which can improve your experience. But if the $10 version does what you need, and your customers don't care who the cert is from, then go for it.

As time goes on you may find that you're changing vendors simply because the landscape of your web presence is changing, so considering that now before you start is important.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.