Tag Info

Hot answers tagged

21

"My question is, what makes a $10 certificate better than a $100 certificate?" Most of the time the more expensive the certificate, the older the certification company is. Since the list of trusted companies ships with the browser, an advantage of using a more expensive certificate is that it will be trusted by old browsers. For example, maybe a ...


15

A few things. In theory, the better and more expensive SSL providers are supposed to validate who you are in some way and vouch for your identity. This takes time and manual effort and thus costs more. Traditionally manual validation (as used by VeriSign, Thawte, Entrust) has been cumbersome, long winded and expensive for the SSL Provider and therefore ...


15

In general it is bad to use a self signed cert. If you do that then you are running the risk people will leave your site when they get a warning about your cert being bad. More important, you are running a larger risk of having someone do an injection attack where they use their own self-signed cert in the place of yours and the visitor will not know any ...


15

Apart from unserious offerings, you can distinguish between cheaper domain-validated SSL certificates and the more expensive extended-validation SSL certificates (EV). Both certificates are technically the same (the connection is encrypted), but domain-validated certificates are cheaper, because the seller only have to check the domain. The EV-certificates ...


14

As RandomBen said, self-signed certificates are generally frowned upon for the reasons he explained. But there is one situation in which they are fine: if the set of people who need to submit sensitive data to your website is small and limited, they are all somewhat technically competent, and you are able to communicate with all of them. In that case you can ...


11

Certificates are priced and issued depending on your need. Lower end certificates are good for simply providing an encrypted connection for your visitors, useful when you collect personally identifiable information that is not financially related. The verification process to get one of these is usually very simple: The certificate company looks up the ...


11

There are a few ways you can do this but if you have the URL Rewrite Module installed, it's fairly easy and a good way to do it. You can paste the below configuration into your site's web.config file. <rewrite> <rules> <rule name="https redirect"> <match url="(.*)" ignoreCase="false" /> ...


7

In terms of security there isn't any difference. What you really buy is the certification's company verification that persuades your customers you are trustworthy. That is why Verisign sells the same services for x10 the amount of others. Also in higher-priced certificates there is an extra level of verification (where you need to send company verification ...


7

Yes, you need a dedicated IP address for your SSL certificate. The following article explains exactly why: SSL certificates on Sites with Host Headers The key paragraph is: It's a chicken and egg problem: The host name is encrypted in the SSL blob that the client sends. Because the host name is part of the binding IIS needs the host name to ...


7

The rule of them is if you are sending or receiving sensitive information you should be using encryption. What is considered sensitive is subjective but anything considered private or personal can be considered sensitive (e.g. passwords, credit card information, social security numbers in the US). Email addresses are not generally considered private or ...


7

I agree with @John, as long as your site is COPA compliant-- if applicable. Email addresses, according to COPA, would be considered sensitive information as it could be used to contact a child online. Similar rules may apply to HIPAA or other international regulations (I really do not know). Food for thought though. ...


6

I usually go with secure.domain.com because it gives me more flexibility as far as administration. For instance, I can put that subdomain on another server, behind some better IDS/IPS gear and possibly attach it to a private network that I don't want the web servers touching. Its a good place to park multi purpose things, such as: ...


6

You need a website certificate when you need to protect your user's data against eavesdropping in transit. To protect against this, people typically use HTTPS instead of HTTP. For HTTPS the server presents a certificate to the client, the client decides whether to trust that the server is who it claims to be by checking that the certificate has been signed ...


5

SSL certificates are used for setting up an encrypted connection between client and server. The identity verification part is in theory done by the certificate issuer before issuing the certificate. But the SSL market is a bit of a scam, really. Many SSL certificates are issued with an absolute minimum of verification of identity. You can easily find SSL ...


5

I suspect you will find that it is too expensive to do so in terms of auditing requirements. Also, there is no single definition of what it means to be trusted. Each application is free to define their own trust, and to use their own root certificates. Practically speaking, you may only care about getting your CA certificate in the Windows root certificate ...


5

You can't. If the certificate is self-signed (i.e. you generated it), then you can try to re-create it with existing key pair and other attributes, but even then if some application has saved hashes of the old certificate, it will complain that you have changed certificates. If the certificate is not yours, then forget it.


5

No, no extra configuration is required in the website source code. The HTTPS is handled by the webserver and should be largely transparent to your website codebase. You should though make sure no internal links are hardcoded starting with "http" as they will then (possibly) take the user out of the encrypted transaction. Even if it doesn't those links will ...


5

First off, 128-bit AES is very good. The prevailing opinion is that it is secure for the future close enough to care about. Setting that aside, the reason you're getting 128-bit encryption is because that was what was negotiated. The certificate has little to do with it; the SSL cert is an RSA keypair, and there's no way that's only 128 bits. It's more ...


5

You might find The First Few Milliseconds of an HTTPS Connection by Jeff Moser useful reading. It provides a detailed explanation of what happens on the wire when a browser sets up an HTTPS connection with a server. This interesting video illustrates public key cryptography by mixing paint colours! You should also look at the OpenSSL command line tool. ...


5

From the GoDaddy website: Enjoy the backing of established industry standards. There is NO TECHNICAL DIFFERENCE between our certificates and any other major Certification Authority. Source: http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=9039 Pricing is a funny thing sometimes. While I have no idea why GoDaddy prices their products the ...


5

No. SSL certificates are implicitly tied to the domain name that they are served from. If your certificate hasn't been issued for your customer's domain then you can't use it. There is still at least one option. If your customers are prepared to give you an SSL certificate which is valid for their domain then your server config can be set up to use that for ...


4

You are correct, using a wildcard cert is a great idea in this case. It'll keep your configuration for separate domains simple, and ensure that any subdomains you decide to add will work. There are a couple drawbacks: - Your top level domain is not secure. As in, the certificate is not good for example.com. - They are very expensive, normally around ...


4

The only downside with an EV certificate is the "paperwork" associated with proving you are who you say you are before the certificate will be issued. It doesn't make any difference to the server- or client-side processing aside from the certificate containing extra information, including the flags that browsers use to determine the certificate type. So if ...


4

Have a look at Wikipedia for a good comparison of SSL services. It looks like startcom has a free SSL cert service which is recognized by IE, FF and Safari. I suspect there are other similar services around. The main issue is to find providers which are supported by modern browsers. Having a browser warn the user that the certificate is not reliable is ...


4

The only reason why companies charge for SSL certificates is they put time and effort into creating the certificate and expect to be paid for their work (at a profit of course). But they don't have to charge if they don't want to just like any free provider of services can do. What matters with SSL certificates is whether the major browser makers recognize ...


4

Edit: Re-reading the question, I think I should have just listed the different types of possible expenses rather than calculating the costs of different types of sites, so I'll try to do that now: Domain registration (annual) web hosting (monthly) unique IP + SSL add-on (monthly/annual) payment gateway (monthly + setup fee) merchant account (monthly + ...


4

EV SSL is a bit of a scam. It's basically a band-aid solution to a more fundamental problem—a breakdown in the chain of trust due to the lack of regulation in the issuing of SSL certificates. EV SSL certificates are basically there to do what regular SSL certificates were doing 10 years ago: to verify that a website is who it claims to be. That's why a ...


4

The line to actually load mod_ssl needs to be added to your Apache config somewhere -- on Debian/Ubuntu, you would just do sudo a2enmod ssl, but I don't know the RedHat/Fedora/CentOS equivalent. You need a line like: LoadModule ssl_module /usr/lib/httpd/modules/mod_ssl.so



Only top voted, non community-wiki answers of a minimum length are eligible