1

We have more then 100 customers and we need to set their websites up with SSL. Do we have to buy the SSL certificates from one of the companies (Godddy and etc) or we can use OpenSSL for free?

Improve this question
3
  • 2
    OpenSSL won't give you a certificate unless you want self-signed certificates...
    – Nathan C
    Commented Nov 10, 2014 at 2:58
  • 1
    This is also a case where you get what you pay for. It is a bad idea to think all certificates are created equal and that the end result would be the same. Go with a reputable high quality certificate issuer or you will end up looking like a fool and losing a customer. As well, certificates are not necessary for all sites. Do not shell out money and commit to SSL if the requirements are not there and the intentions to continue are not strong.
    – closetnoc
    Commented Nov 10, 2014 at 3:51
  • For a web of trust to exist, you will need to buy a certificate from a recognized Certification Authority like GeoTrust. Self-signed certificates don't cut it. There is no trustable authentication that the site is who it says it is and modern browsers now let the customer know that they're deep in it if they continue onto the secured sections of the website. e-commerce without authentication isn't secure even if you can turn on SSL with a self-signed cert.
    – Fiasco Labs
    Commented Nov 10, 2014 at 4:49

2 Answers 2

Reset to default
1

It's important to understand that SSL certificates come in two "flavors":

  • Self-signed - In which case, you generate them entirely on your own with no additional cost.
  • CA-signed - In which case, a recognized certificate authority (Symantec, GeoTrust, GoDaddy, etc) signs the cert.

Is this a public facing website? If so, then I'd strongly suggest purchasing a certificate issued by a certificate authority. Modern web browsers will present warnings/errors/alerts if the SSL certificate is self-signed which is not something you want web visitors to have to deal with.

Depending on your specific details (e.g. web server purposes, web addresses, etc), there may be other ways to save money (like purchasing a wildcard certificate that supports multiple addresses off of a common domain example1.foo.com, example2.foo.com, etc).

Improve this answer
1

It's a common mistake to think that when you create your own SSL certificate they are self-signed. You can also create your own CA, and sign your certificates with it (yeah, the CA certificate will be self signed too, but so are the "real" CA certificates - every certificate chain is started by the CA certificate, and CA is created from scratch). The main difference between acquired for some fee certificates and your own CA is that CA of the first ones is included in trusted certificate store of various software: OSes, browsers and stuff. Your CA certificate won't be included in these, meaning that customers will receive Unknown CA certificate warning (but you can instruct them to trust your CA). Second main difference is that companies like Thawte run a bunch of identification services, used to assure customers that "FooBar LLC" is indeed a "Foobar LLC", not a "BarFoo LLC" instead. This is almost all the differencies. Considering the technical side, using your own CA gives you the same technology as using acquired payment certificates - encryption mostly.

So, yes, you can use your own certificate chain.

Improve this answer
1
  • 1
    It's not very clear from this answer, but self-signing your own CA will also give users security warnings in most browsers.
    – Andrew Lott
    Commented Nov 10, 2014 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.