40

I'm looking into getting a few SSL certificates for domains to cover the following:

  • autodiscover.example.com
  • remote.example.com
  • www.example.com

Wildcard certificates are too expensive, so I'm going to purchase a single certificate for each subdomain (I have enough IP addresses to go around).

My question is, what makes a $10 certificate better than a $100 certificate?

Take, for example, the GeoTrust product range. I know what an EV is (don't need it), and I know what a Secure Seal is (our users trust us already, so don't need that).

But why would I go for a QuickSSL for $69 when I can get a RapidSSL for $10? The only difference is "Brand Recognition" (Moderate to Medium) and insurance.

Can anyone spread any light on what they mean by "Brand Recognition"? Our public website is already well trusted by our users, and the other two subdomains are just for Outlook Anywhere (and thus won't be displayed in a browser).

Re-posted relevant question from https://serverfault.com/questions/82039/difference-between-ssl-products

|improve this question|||||
  • 1
    If you have bought an expensive SSL certificate you have helped Shuttleworth go into space. How can that possibly be a scam? – delete Jul 9 '10 at 1:47
  • 4
    Back in the good old days of the internet, it may have been expensive to provide theses services. They said you are paying for the service to verify your identity. The investigation for non-ecommerce certificates in my experience is trivial and spurious. Sorry, I just despise this whole SSL industry. I wish someone would create a non-profit that would provide the same services. – citadelgrad Jul 9 '10 at 15:35
  • 1
    There are several questions related to EV certificates here: webmasters.stackexchange.com/questions/2214/… webmasters.stackexchange.com/questions/3836/… webmasters.stackexchange.com/questions/3134/ssl-versus-ev-ssl – JasonBirch Oct 14 '10 at 20:15
  • Its basically like the coolest kids at the party saying "this dude is legit" when a browser asks them about you. You pay for those cool kids to accept and talk highly of you. If you want them to say "this dude is TOTALLY EPIC" instead, then you can spend more money. As long as its SHA-256 or something similar, the validation doesn't matter. There are maybe .01% of visitors who check the validation authority. All that matters to them is that they see a green lock whether its a $10 or $1000 lock. – dhaupin Oct 20 '14 at 19:00
  • @citadelgrad, They have made a non-profit. It's called CaCert.org. webmasters.stackexchange.com/questions/28595/… – Pacerier Apr 12 '16 at 14:27
27

"My question is, what makes a $10 certificate better than a $100 certificate?"

Typically the more expensive the certificate the older the certification company is. Since the list of trusted signers ships with the browser, certificates from newer companies may not be trusted by old browsers.

For example, maybe a $10 certificate isn't trusted by IE5.

But that's about it.

|improve this answer|||||
  • 8
    And the garbled mess that IE5 displays after displaying any modern standards compliant web site is also untrusted by the user of such a piece of #&*$ :) +1 – Tim Post♦ Jul 9 '10 at 16:44
  • Also, for certain types of certificate the issuing company puts more effort into verifying the details of the person/company requesting it (en.wikipedia.org/wiki/Extended_Validation_Certificate). If the browser shows that a certificate is EV and the user notices it they may have more confidence. IMHO they won't notice. – paulmorriss Jan 14 '14 at 12:39
  • You missed the point, if a certificate is more expensive then you are covered more, if your website gets hacked a 100$ certificate may pay you up to 1 million dollars where as 10$ certificate may not pay you anything. – SSpoke May 11 '14 at 3:24
  • @SSpoke, I will be surprised if there's no friction when you try to claim the "$1.5M USD" . These numbers are only for the big boys to claim, not the average user. Imagine they had a breach and had to payout 300k users, that totals to 450 billion. Rest assure that your users will not be able to get 1 million dollars each. Also see terms and conditions at positivessl.com/ssl-warranty.php – Pacerier Apr 12 '16 at 16:15
13

I think cartel is the word you are looking for

|improve this answer|||||
6

I asked the same thing of DigiCert the other day: why are a lot of certificates so much cheaper than yours (~$25 vs ~$100 per year)? Here is the answer they gave me (in my words):

The other companies only verify your domain name (that the person getting the certificate owns the domain name) whereas DigiCert (and others) verify the company behind the domain name.

This means they need to check the corporate registry in your country to verify that your company exists and that you are related to company some how. This often also requires a phone call and some other checks. Without this check, all that is required is a computer to verify the whois record with the information entered.

So, in my assessment, if you're going to be using the certificate on a site where the customer is paying for something or entering their personal information, then a more expensive certificate is better. If you're just using the site internally (within the company) then a cheaper certificate is probably all you need.

|improve this answer|||||
  • DigiCert has an extreme conflict on interest alert (also see security.stackexchange.com/questions/13453/…). The support staff is twisting the question by comparing other CA's DV certs to their EV certs. But other CAs also offer EV certs at a much reduced price from theirs. – Pacerier Apr 12 '16 at 14:30
4

"My question is, what makes a $10 certificate better than a $100 certificate?"

The answer is nothing. A cert is a cert is a cert (since you don't care about "Brand Recognition"), so without EV packages a cert is just a commodity. This explains the history quite nicely.

I do think, however, that brand recognition could be important to some users, but if you are certain you are a trusted source, then I wouldn't worry about it.

|improve this answer|||||
2

There's also the issue where some browsers pick out a lot of perfectly fine SSL certificates and marks them as potentially unsafe. This is due in part around what Darryl said (increased diligence on the part of the SSL vendor to confirm who you are). It's not that the security itself is really any different, it's just intended to provide a better layer of trust.

There's also things like management capability (I can issue and re-issue certs to my hearts content without delay, which has been very handy when domain names suddenly become different), and other perks which can improve your experience. But if the $10 version does what you need, and your customers don't care who the cert is from, then go for it.

As time goes on you may find that you're changing vendors simply because the landscape of your web presence is changing, so considering that now before you start is important.

|improve this answer|||||
2

As of mid-2015, I haven't found any independent studies, or even anecdotal evidence, that EV certificates would increase conversion rate or sales. I've expanded on that in my answer to EV SSL Certificates - does anyone care?.

What did seem to decrease shopping cart abandonment was trust seals and badges. Such trust seals do come with the purchase of an EV. Incidentally, today is the 4th of July and Comodo has a sale of EV certs for $100 instead of $500, which prompted this research. I'm still not entirely convinced one way or the other.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.