Tag Info

Hot answers tagged

22

"My question is, what makes a $10 certificate better than a $100 certificate?" Most of the time the more expensive the certificate, the older the certification company is. Since the list of trusted companies ships with the browser, an advantage of using a more expensive certificate is that it will be trusted by old browsers. For example, maybe a ...


18

Apart from unserious offerings, you can distinguish between cheaper domain-validated SSL certificates and the more expensive extended-validation SSL certificates (EV). Both certificates are technically the same (the connection is encrypted), but domain-validated certificates are cheaper, because the seller only have to check the domain. The EV-certificates ...


15

In general it is bad to use a self signed cert. If you do that then you are running the risk people will leave your site when they get a warning about your cert being bad. More important, you are running a larger risk of having someone do an injection attack where they use their own self-signed cert in the place of yours and the visitor will not know any ...


15

A few things. In theory, the better and more expensive SSL providers are supposed to validate who you are in some way and vouch for your identity. This takes time and manual effort and thus costs more. Traditionally manual validation (as used by VeriSign, Thawte, Entrust) has been cumbersome, long winded and expensive for the SSL Provider and therefore ...


14

As RandomBen said, self-signed certificates are generally frowned upon for the reasons he explained. But there is one situation in which they are fine: if the set of people who need to submit sensitive data to your website is small and limited, they are all somewhat technically competent, and you are able to communicate with all of them. In that case you can ...


13

There are a few ways you can do this but if you have the URL Rewrite Module installed, it's fairly easy and a good way to do it. You can paste the below configuration into your site's web.config file. <rewrite> <rules> <rule name="https redirect"> <match url="(.*)" ignoreCase="false" /> ...


11

Certificates are priced and issued depending on your need. Lower end certificates are good for simply providing an encrypted connection for your visitors, useful when you collect personally identifiable information that is not financially related. The verification process to get one of these is usually very simple: The certificate company looks up the ...


9

NOTE: While this answer was accurate at the time it was written and accepted, it is no longer correct. There are other answers here that address SNI which allows multiple SSL certificates per IP address. Yes, you need a dedicated IP address for your SSL certificate. The following article explains exactly why: ...


8

Comodo have a root certificate whose public key is included in your web browser. The private key that matches the public key is used to sign SSL certificates that Comodo issue, and it can't be faked because no one else has the private key that matches the public key in the web browser.


8

Web browsers do not care about canonical URLs. It is for search engine use only (specifically Google). Additionally, canonical URLs do not affect the loading or rendering of a web page. So no assets will be loaded over HTTP which is what would cause an insecure error message. So, no, they will not display any error message.


7

In terms of security there isn't any difference. What you really buy is the certification's company verification that persuades your customers you are trustworthy. That is why Verisign sells the same services for x10 the amount of others. Also in higher-priced certificates there is an extra level of verification (where you need to send company verification ...


7

The rule of them is if you are sending or receiving sensitive information you should be using encryption. What is considered sensitive is subjective but anything considered private or personal can be considered sensitive (e.g. passwords, credit card information, social security numbers in the US). Email addresses are not generally considered private or ...


7

I agree with @John, as long as your site is COPA compliant-- if applicable. Email addresses, according to COPA, would be considered sensitive information as it could be used to contact a child online. Similar rules may apply to HIPAA or other international regulations (I really do not know). Food for thought though. ...


6

I think cartel is the word you are looking for


6

I usually go with secure.domain.com because it gives me more flexibility as far as administration. For instance, I can put that subdomain on another server, behind some better IDS/IPS gear and possibly attach it to a private network that I don't want the web servers touching. Its a good place to park multi purpose things, such as: ...


6

One word: StartCom http://cert.startcom.org/


6

From the GoDaddy website: Enjoy the backing of established industry standards. There is NO TECHNICAL DIFFERENCE between our certificates and any other major Certification Authority. Source: http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=9039 Pricing is a funny thing sometimes. While I have no idea why GoDaddy prices their products the ...


6

No. SSL certificates are implicitly tied to the domain name that they are served from. If your certificate hasn't been issued for your customer's domain then you can't use it. There is still at least one option. If your customers are prepared to give you an SSL certificate which is valid for their domain then your server config can be set up to use that for ...


6

You need a website certificate when you need to protect your user's data against eavesdropping in transit. To protect against this, people typically use HTTPS instead of HTTP. For HTTPS the server presents a certificate to the client, the client decides whether to trust that the server is who it claims to be by checking that the certificate has been signed ...


6

There is a relatively new technology called Server Name Indication (SNI) that allows SSL certificates to be associated with a virtual host rather than with the server's IP address. Here is a digicert article that explains it very well. Your host may not have SNI support installed yet. It requires newer versions of both Apache and OpenSSL. Web hosting ...


5

SSL certificates are used for setting up an encrypted connection between client and server. The identity verification part is in theory done by the certificate issuer before issuing the certificate. But the SSL market is a bit of a scam, really. Many SSL certificates are issued with an absolute minimum of verification of identity. You can easily find SSL ...


5

I suspect you will find that it is too expensive to do so in terms of auditing requirements. Also, there is no single definition of what it means to be trusted. Each application is free to define their own trust, and to use their own root certificates. Practically speaking, you may only care about getting your CA certificate in the Windows root certificate ...


5

You can't. If the certificate is self-signed (i.e. you generated it), then you can try to re-create it with existing key pair and other attributes, but even then if some application has saved hashes of the old certificate, it will complain that you have changed certificates. If the certificate is not yours, then forget it.


5

No, no extra configuration is required in the website source code. The HTTPS is handled by the webserver and should be largely transparent to your website codebase. You should though make sure no internal links are hardcoded starting with "http" as they will then (possibly) take the user out of the encrypted transaction. Even if it doesn't those links will ...


5

First off, 128-bit AES is very good. The prevailing opinion is that it is secure for the future close enough to care about. Setting that aside, the reason you're getting 128-bit encryption is because that was what was negotiated. The certificate has little to do with it; the SSL cert is an RSA keypair, and there's no way that's only 128 bits. It's more ...


5

You might find The First Few Milliseconds of an HTTPS Connection by Jeff Moser useful reading. It provides a detailed explanation of what happens on the wire when a browser sets up an HTTPS connection with a server. This interesting video illustrates public key cryptography by mixing paint colours! You should also look at the OpenSSL command line tool. ...


5

You need to make sure that all resources from your page (images, scripts, css) are also loaded via https otherwise your page is not secure.


4

If price is your main concern then it probably doesn't matter. However, I think some brands are trusted more than others e.g. Verisign is more well known than Comodo, so your users may be more comfortable if you go with Verisign.


4

The only downside with an EV certificate is the "paperwork" associated with proving you are who you say you are before the certificate will be issued. It doesn't make any difference to the server- or client-side processing aside from the certificate containing extra information, including the flags that browsers use to determine the certificate type. So if ...



Only top voted, non community-wiki answers of a minimum length are eligible