33

I am a novice on HTTPS/SSL but GoDaddy charges $12.99 and Digicert, thawte, and Verisign charge $100-1000+ for SSL certificates.

I must be missing something on the quality of the encryption or something. Can someone explain some of the basic differences that lead to these dramatically different prices?

Update $12.99 is a sale price. Typically SSL certificates cost $89.99 on GoDaddy. Here's a link on Godaddy which makes the very comparison this question asks about: http://www.godaddy.com/Compare/gdcompare_ssl.aspx?isc=sslqgo002c

thanks,

tim

Improve this question
2
  • 1
    I just checked the GoDaddy site and they were listing certs for $69.99 CAD.
    – Sherwin Flight
    Apr 18, 2012 at 4:49
  • 2
    startssl even offer one for free!
    – Rana Prathap
    Jan 1, 2014 at 14:50

7 Answers 7

Reset to default
33

Apart from unserious offerings, you can distinguish between cheaper domain-validated SSL certificates and the more expensive extended-validation SSL certificates (EV).

Both certificates are technically the same (the connection is encrypted), but domain-validated certificates are cheaper, because the seller only have to check the domain. The EV-certificates also require information about the owner of the domain, and the seller should check, if this information is correct (more administrative effort).

Normally you can see the difference when you visit the site with a browser. Firefox for example will highlight the domain in blue for domain-validated SSL, and green for extended-validation SSL.

Two examples:

In most cases the domain-validated certificate is fine, the user will have no disadvantages and the EV-certificates are really (too) expensive.

Improve this answer
3
  • 1
    thanks, didn't know about the difference between domain vs. extended validation, thanks for that clarification!
    – tim peterson
    Apr 18, 2012 at 11:29
  • 1
    A person needs to check the physical address of the company for a certificate with extended validation.
    – ZippyV
    Apr 18, 2012 at 12:09
  • 1
    I think some CAs also offer some form of insurance, should something go wrong (but it's not clear what is covered exactly). (I've written as relatively long answer about the differences between these types of certs if that's of interest.) The main point is that the choice of CA and type of cert only matters as far as the client is concerned. Provided the cert is trusted by default, it depends only on how far the user is willing to check further details (visually, via the UI).
    – Bruno
    Apr 19, 2012 at 14:12
8

From the GoDaddy website:

Enjoy the backing of established industry standards. There is NO TECHNICAL DIFFERENCE between our certificates and any other major Certification Authority.

Source: http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=9039

Pricing is a funny thing sometimes. While I have no idea why GoDaddy prices their products the way they do some companies go for more customers at a cheaper rate, whereas others go for a higher price and attract less customers.

As a simple comparison, Company 1 can attract more customers by offering their products at a cheaper price. However Company 2 can offer their products at a higher cost, which could offset a lower number of customers.

Company 1: 100 customers paying $20/month = $24,000/year

Company 2: 200 customers paying $10/month = $24,000/year

So as you can see in this VERY SIMPLE comparison, both models ended up with the same annual revenue, however one company offered their product for twice as much as the other.

Improve this answer
2
  • 3
    Don't forget the "Brand" factor -- some products simply have extra in prices just because they are labeled with widely known and recognized company name.
    – LazyOne
    Apr 18, 2012 at 8:49
  • @LazyOne, It's the same with universities...
    – Pacerier
    Apr 12, 2016 at 14:10
8

To be quite honest. there is absolutely NO difference when it comes to SSL certificates. The only contributing factor is the EV / non EV / Wildcard tags.

EV == Extended Validation: This means the site is actively " pinged " by the Certificate Authority on the provided IP of the domain, then a server-side script compares the IP address of the ping response from the CA, and the IP address YOU are visiting. This does NOT guarentee that there isn't a man-in-the-middle attack, or net-wide DNS poisoning. This just ensures that the site you are viewing is the same one the CA sees.

Non-EV == no one is actively checking the domain's IP against a logged / provided IP for security purposes.

Wildcard == *.domain.com based Certificates are often used when people have a multitude of subdomains, or a set of subdomains that are ever-changing, but still need valid SSL encryption.

The truth behind SSL Certificates.

You can make your own. They are no less secure than any other certificate. The difference being a " self-signed " certificate is not " vouched for " by any third party.

The problem with SSL Certificates is they are extremely over-priced for what they are. There is absolutely NO garentee that the site you are visiting belongs to whomever is listed on the certificate as owner / location etc. This defeats the purpose of the third-party-trust-chain model SSL was developed to use.

ALL Certificate Authorities known as CA's that sell their certificates, wants the user to believe that their certificate is somehow better. When in fact, they never check the information provided for the certificate unless there is an issue that may cost them revenue. This practice also defeats the purpose of the SSL trust-chain model.

I know of only ONE CA that indeed validates it's certificates. This is CACert.org.

For them to issue a " complete " certificate (business name, name, addres, phone etc..) you must meet one of their assurer's FACE-TO-FACE!.

However. most browsers do not use CACert.org due to pressures added to them by mega corporations like Thawte, Comodo, and Verisign.

So.. to sum it all up.

The only differences between certificates is the behavior of the CA. Certificates can't really be trusted to verify anything other than the connection to the site is useing encryption.

At the end of the day, people think paying $100 - $1000 somehow equates to trustworthiness. This is NOT the case. It just means you deal with less sophisticated or less established crooks.

Improve this answer
9
  • 1
    CACert inclusion in at least Mozilla was cancelled by CACert itself: bugzilla.mozilla.org/show_bug.cgi?id=215243#c158
    – user2428118
    Nov 25, 2014 at 11:44
  • @user34262, Yea, money is a big factor in this entire (semi-corrupted) CA market. Related threads: 1) on webmasters.SE, 2) on security.SE , 3) on security.SE
    – Pacerier
    Apr 12, 2016 at 14:35
  • @user2428118, That post is from 10 years ago. What's the update?
    – Pacerier
    Apr 12, 2016 at 14:38
  • @user34262, Btw what are some of these CA "pressures" you're talking about?
    – Pacerier
    Apr 12, 2016 at 14:38
  • There are generally three levels of certificates: Domain validated, Organization validated, and Extended validated certificates. There is very little checking done with DV certificates (generally only automated email and domain control check), but the latter two types are required to comply to audits and issuance practices guidelines published by CA/B Forum. CAs that doesn't pass the requirements set in the guideline is not trusted by browsers to issue certificate of the respective type.
    – Lie Ryan
    Apr 12, 2016 at 15:59
3

Which is worth more, a reference from me or a reference from Bill gates? You have to remember that certs are more than a technical solution, they are someone vouching for you and companies can set whatever price they think their reputation is worth.

Improve this answer
4
  • 2
    reference from Bill gates is lame, though I'm happy for Khan Academy.
    – tim peterson
    Apr 18, 2012 at 16:59
  • @timpeterson, He's referring to the fallacy of en.wikipedia.org/wiki/Argument_from_authority
    – Pacerier
    Apr 12, 2016 at 14:17
  • 1
    @Pacerier no, i'm not. That has nothing to do with people literally vouching for organisations identity.
    – JamesRyan
    Apr 12, 2016 at 14:38
  • @JamesRyan, How is it not? What does "a reference from me or a reference from Bill gates" mean? Does "Bill gates" mean "authority" here?
    – Pacerier
    Apr 13, 2016 at 16:10
3

I had just found that GoDaddy doesn't allow "duplicates" certificate for your wildcards SSL. (as opposed to say, GlobalSign, DigiCert, which do allow them, and unlimited number of them)

That's a pity since this is often used when you manage a farm of server and each one has its own private key / csr.

Improve this answer
2
  • 1
    This seems pretty critical information. It would seem to correct for any price difference if you have to buy multiple certificates from GoDaddy and only one from Verisign, etc. Can you provide GoDaddy link references in your answer?
    – tim peterson
    Jan 1, 2014 at 16:28
  • 2
    No, GoDaddy won't let you buy multiple certs for the same wildcard either. They'll only let you have one, which you therefore have to use on all of your servers.
    – Mike Scott
    Jul 23, 2014 at 5:23
1

I was working for a third party company on a web project for a large tech corporation. We used a GoDaddy SSL certificate and found that this CA was rejected on internal company networks.

The corporation at that time (2 years ago) did not automatically accept GoDaddy as a trusted authority. It was only with much persuasion that our certificate was accepted.

If we'd have used a premium brand such as Thawte there would have been no problem. I'm not sure why the corporation had this policy but maybe the price point of the certificate made them seem less trusted.

This is the only real world difference between certificates from GoDaddy and other large CAs I have come across.

Improve this answer
1
  • 1
    Hmm, is Godaddy the only cert which they reject?
    – Pacerier
    Apr 12, 2016 at 14:20
0

Technically there is no difference. Most of the certification authorities offer similar products, standard validation or extended validation where owner's organisation / company and domain is checked and wildcards.

What makes the price different is:

  1. Branding
  2. Warranty
  3. Quality of service
  4. Quantity

For branding, best example would be Digicert - they issued certificates to brands like Twitter, Facebook, even StackExchange. To land this kind of clients it takes some persuasion and branding budget, there is no proof they have better technology than anybody else.

Warranty is something like insurance. It is usually an amount between 0 and millions of dollars, it basically tells you how high is CA insured when selling you the certificate, if something like fraudulent credit card transaction happens and it will be their mistake, they will cover the costs up to the warranty height. With standard SSL certificates its mostly up sell for the CA company so they can charge owner more, because the encryption technology and security is the same, with EV certificates warranty may have some use, but usually when you read terms and conditions, you will laugh and see the irony of it all.

Quality of service is something that is usually very subjective dependent on the paying client. Some CAs have systems for their big clients that can help you keep track of your purchased certificates, if own or manage more than hundred of certificates, you may actually rather pay little more and have better managing software, dashboard, wider credit card billing options, tools for certificate maintenance, reporting tools, some CA's even offer security tips for server implementation.

Quantity makes prices go down. As CA if you sell more, your prices are lower, as a client when you buy more, you may ask for better prices.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.