1

Our website is information only, what we do, what we've done and contact info. We do not do any ecommerce or provide any downloads for visitors. The person that ran our web hosting company passsed away and we were forced to find a new host really fast. We went with Network Solutions and I was told that based on our site, their Essential Package would be fine. Now that it is up and running I see that our site is not secure. I was not aware that the web hosting package did not include a security certificate. Network Solutions is recommending the $200/yr certificate. I was hoping to get by with the Express certificate $75/yr. Our main concerns are visitors to the website seeing "Not Secure" in front of the URL and the site not showing up in Google searches. I assume with the Express Certificate I'll get rid of "Not Secure" and the lock symbol will show. Is there any risk in using the Express certificate?

This is how they define the Express Certificate. "Domain Validation (DV) Certificates are issued after validating that you are the owner of your domain name. This is done by using the currently established and accepted vetting process of email validation using information from the WHOIS database. DV SSL Certificates are for individual users who do not need to meet organizational or business validation requirements."

4
  • Since you are not storing or transferring any sensitive information, there is no issue with using a cheaper one. But I would advise that you have appropriate defensive headers. Commented Dec 19, 2022 at 22:25
  • Why not a free certificate from letsencrypt?
    – Steve
    Commented Dec 19, 2022 at 23:05
  • @steve it seems Network Solutions doesn't allow, or makes it very difficult to figure out, how to install a certificate from someone else. Commented Dec 20, 2022 at 2:03
  • 1
    Find another hosting service. One where they take care of you rather than having stupid money making restrictions like that.
    – Steve
    Commented Dec 20, 2022 at 7:19

2 Answers 2

2

You are being shafted.

Most providers offer a free certificate, either using LetsEncrypt or an equivalent service (CPanel does something equivalent). If you do need to purchase a certificate, you should be able to get one for less the US$15 per year. Namecheap offers a PositiveSSL certificate for $5.99 per year for example - and that is every bit as good as any other DV certificate. (Its signed by Comodo, which is one of the largest players)

A DV certificate is the lowest form of certificate. Really the only thing you are looking for is wide browser acceptance. There is no meaningful difference to you or your users once this bar is met.

I put to you that if you are struggling with this with Network Solutions, shift to another provider. I know Network Solutions for 2 things - they have been around a very, very long time, and they are very expensive. They offer very little that other providers don't offer - especially if you need hand-holding.

5
  • "A DV certificate is the lowest form of certificate.". what does "lowest" form mean here? Lowest comparing to what and on what scale? There are no worse nor better than any other certificate. Once issued, all certificates work the same. And if you make distinctions based on how it is validated, I am sure it is not so easy to argue that EV is necessarily better than DV because at least with DV you have the luxury to put proper TLSA and CAA records to restrict things, as owner of a name. Commented Dec 21, 2022 at 19:36
  • @PatrickMevzek Indeed, lowest compared with Wildcard certs and EV certs. I agree that there is very little added value in an EV cert, but it still has added value as it means a third party has actually verified that the domain relates to the Organisation stated in the cert, rather then just tied to the domain (even though new browsers don't make EV apparent). I'm pretty sure a CAA record and TLSA records can apply to EV certs and there is nothing preventing a look-alike domain setting all of these up. I also always wonder if Google gives a tiny bit extra juice to EV certs.
    – davidgo
    Commented Dec 21, 2022 at 21:02
  • " Indeed, lowest compared with Wildcard certs and EV certs." Then I disagree. DV is not lower than wildcard or EV. It works the same. wildcard is also orthogonal. you can have wildcard DV, you can't have wildcard EV. And maybe you can wildcard OV, I don't know. Anyway the added "validations" of EV in practice does not provide any further guarantees, which is why noone bothers with them anymore. Commented Dec 23, 2022 at 0:23
  • "verified that the domain relates to the Organisation stated in the cert" That makes sense... EXCEPT for a certificate used on a website since you connect to a domain not to an organization. There is sometimes very little overlap with the domain name and the organization name. Commented Dec 23, 2022 at 0:24
  • Unfortunately the guy that ran our hosting service passed away and we needed to change hosts quickly. Since our domain was registered with Network Solutions I thought they would be the easiest to switch to. Their support leaves a lot to be desired. Commented Jan 1, 2023 at 15:40
1

There is little reason to get anything other than a domain verified (DV) certificate. Browsers don't make any distinction between certificate types readily apparent to users. Users would have to click on the lock and actually view the certificate to find out its type. Even then, the type isn't clearly spelled out. Certificates from different issues say different things. Plus, very few users know what types of certificates their are and what the differences are between them.

The types of security certificate are:

  • DV (domain verification) -- The issuer checks that the person getting the certificate has control over the domain.
  • OV (organization verification) -- The issuer checks the documents for the organization (such as the business) that is obtaining the certificate.
  • EV (extended verification) -- The issues runs additional checks on the organization to ensure it isn't fraudulent.

Browsers used to have a special display for EV certificates, but Chrome and Firefox stopped doing that in 2019.

Network Solution's "Express Certificate" is what they called a DV certificate. Their express DV certificate would be fine for all purposes and I wouldn't recommend spending money on their more expensive packages.

You should also look into getting a free certificate from LetsEncrypt or CloudFlare. The vast majority of sites now use free certificates.

The biggest downside with them is that they expire frequently (a couple months), so you have to have an automated process for renewing them. Many hosting packages come with an automated mechanism to do just that. Network Solutions may even have such a mechanism somewhere but somebody reported in 2020 that they charge a fee for obtaining the free certificates for you.

If you go with CloudFlare, you can use them as a content delivery network (CDN) and they will 100% handle the certificate for you. You would set your DNS to be handled by CloudFlare and set your Network Solutions hosting as the origin server in the CloudFlare settings. CloudFlare even has a very generous free tier that many small sites can use indefinitely.

2
  • "Users would have to click on the lock and actually view the certificate to find out its type." It is almost never spelled out clearly what type of validation was used. Sometime it can be loosely derived from the intermediate certificate used, and normally it is encoded in an extension, but absolutely not guaranteed to be there nor to be used in a standard way (each CA has a different one for EV AFAIR). So all of that is probably out of reach of users in fact. Commented Dec 21, 2022 at 19:37
  • @PatrickMevzek When I click on the lock local banks certs, it says Certificate Issued to: (Bank Name) in each case. If I look in the Certificate Policies they all have a Policy Certificate Type ( 2.23.140.1.1 ) -with a value "Extended Validation". It does mean that someone who your browser thinks is trustworthy has done something to verify the link between the Owner and the website.
    – davidgo
    Commented Dec 21, 2022 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.