My startup client runs a website at xyz.com, they use HTTPS only. They now introduced a test environment to test upcoming versions (test.xyz.com). They want to run it under HTTPS as well but they can't afford the costs of a real SSL certificate.
Any advice where to get very cheap TEST-certificates?
Currently we have self-signed certificates in place but as they are not signed by a known root authority the browser always displays an alert where the testing person has to accept the self-signed certificate which is quite annoying...
BEST and FREE Solution (UPDATE)
This is what I have done (Web Application running on Tomcat, running on Ubuntu 14). The solution is free of charge and the resulting HTTPS access is fully trusted and secure (marked as green HTTPS in Google Chrome):
- Login to Ubuntu Server via ssh
- wget https://dl.eff.org/certbot-auto
- chmod a+x certbot-auto
- ./certbot-auto certonly (choose option 2, install manually, not via webroot)
- cd /etc/letsencrypt/live/YOURDOMAIN/
- openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out le-pkcs.p12 -name CERT_ALIAS_NAME (it asks for password, remember it!)
- keytool -importkeystore -destkeystore le-keystore.jks -srckeystore le-pkcs.p12 -srcstoretype PKCS12 -srcstorepass PASSWORD -alias CERT_ALIAS_NAME
As a result you get the le-keystore.jks file which you can use from tomcat as usual. The HTTPS is now fully trusted and secure.