11

How is it that some SSL certificates are free? What does that mean? Are they secure or not?

Improve this question

4 Answers 4

Reset to default
5

The only reason why companies charge for SSL certificates is they put time and effort into creating the certificate and expect to be paid for their work (at a profit of course). But they don't have to charge if they don't want to just like any free provider of services can do. What matters with SSL certificates is whether the major browser makers recognize the certificate issuers as trustworthy or not. If they do the browser will display the site as secure just like it would from any other recognized provider. If they don't then any user attempting to access a web page secured by the unrecognized certificate will see a warning letting them know that the certificate is not recognized and warn them not to proceed.

So the real question is, "which free provides are recognized by the major browser makers as being authoritative"?

Improve this answer
12
  • In other words, they are secure certificates, just not "verified" from an issuing certificate provider, since its a self-created certificate. Makes me wonder why the webserver itself cant verify the certificate. But then again, i guess they wouldnt make $$$ they way, would they?
    – Talvi Watia
    Commented Sep 6, 2010 at 22:02
  • It is your browser that determines the validity of the certificate that the server presents. A self signed certificate will create a secure connection, but it won't validate the server is owned by the person who it claims to be, that is what the certificate authorities are for, and they charge for the process of verifying and certifying the certificates the server is presenting.
    – danivovich
    Commented Sep 7, 2010 at 0:40
  • 2
    @Talvi: Good joke!... wait, that was a joke, right? The certificate is used to verify the identity of the server, amongst other things. Asking a certificate is like asking someone's ID: "What's your name? Joe Blow. Can you show me some ID? Sure." Then the guy takes a piece of paper, writes "Joe Blow" and gives it to you. There, here is my ID. So you look at it, and you say "Ah, all right. If it's on a piece of paper, it must be true... A server producing its own certificate is pretty much the same thing. "Are you the right server for my bank?" "Yes. These are not the droids you're looking for"
    – Sylver
    Commented Sep 8, 2010 at 6:11
  • 2
    @Sylver What alternative do you think there is? It's just a matter of where you're placing your trust: "What's your name? Joe Blow. Can you show me some ID? Sure." The guy introduces his friend, Very Sign, who takes a bit of paper, writes "Joe Blow" and gives it to you. There, here is my ID. So you look at it, and you say "Ah, all right. If it's on a piece of paper, it must be true... The identification properties of a certificate are really just a side benefit of the encryption technique. Go and check who signs the certificate for verisign.com
    – robertc
    Commented Sep 8, 2010 at 13:14
  • 1
    @robert: Exactly, except that Veri Sign is not Joe Blow's friend. Verisign is a regulated company whose main business is to attest the identity of people. A passport or an ID card is just a fancy piece of printing on fancy paper, but we accept it because we believe that it was issued by a reliable agency which checked the identity of the applicant, because there are serious penalties for counterfeit and because they are not easy to fake in the first place. To get a certificate from Verisign, they will first check that you are legit. ...
    – Sylver
    Commented Sep 12, 2010 at 5:59
4

Have a look at Wikipedia for a good comparison of SSL services. It looks like startcom has a free SSL cert service which is recognized by IE, FF and Safari.

I suspect there are other similar services around. The main issue is to find providers which are supported by modern browsers. Having a browser warn the user that the certificate is not reliable is worse than not having a certificate at all, from the POV of conversion & sales.

Improve this answer
2
0

Public Key Infrastructure depends on a Trusted Third Party that will verify and then can endorse your identitiy.

When you pay a major certificate authority like Verisign for a certificate, you are paying for their reputation as a reputable and trusted third party that can endorse the validity of your identity and your certificate. From a practical standpoint, that means that major browsers come pre-configured to trust certificates signed by those authorities.

I can create a certificate for you for free, but it will be relatively worthless, because nobody knows who I am and so my endorsement doesn't give them any confidence.

Improve this answer
0

Even major certificate authorities like verisign,globalsign,COMODO give a free trail period version of SSL certificate because they give us the chance for trusting and valuing their product.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.