For Facebook signed_request, should we pay for using SSL?

Question

For Facebook's signed_request function we must have an SSL certificate on applications and page tabs starting on 1st Oct. When I researched, we cannot get one for free.

I am wondering how Facebook decided that the number of business Facebook users will have to pay for an SSL certificate. Isn't there any other option for taking SSL free provided by Facebook? Or will they give the option on Facebook for buying one directly?

I can see there aren't many people who realise how big this issue is. I tried to call Facebook and asked some questions on the developer's blog, yet I haven't got any answer.

Answer 1

If you want a certificate which is going to be trusted by most user's browsers (eg. chrome/firefox) then yes, you will have to pay for that.

As for SSL with payments, yes, this is crucial. If you cannot set up SSL you should not take payments, rather try to use a 3rd party to do payment processing.

You are welcome to generate your own certificates. You can generate 'self-signed' (snake-oil) certificates which is fine for use within a company network but users will have to take on trust that it really is the correct site they are connecting to. They should not be making payments to anywhere that uses a self-signed cert (but at least your traffic is encrypted, which is much better than no SSL at all). The browser will usually issue a loud warning if it can't trust the certificate's provider.