6

I wanted to add SSL to my domain and as EV SSL is very expensive I'm going to go with DV SSL. because I just what to enable encrypted logins.

Different companies offer different prices even free and some are a bit expensive. I was going to go with a cheap one as I didn't (and still don't understand much ) difference between them. I read somewhere that each SSL (based on the issuer) have some limitations on browser compatibility , for example one many support IE8+ and another one may support IE7+.

I want to know is this true? And if it is, how can I know what versions of browsers an SSL supports so that I can choose best one that suits me both price and support wise?

  • 1
    Buy the cheapest DV cert you can find, usually under $5USD, as they are all virtually identical. Browser support depends on whether the browser supports DV type certs at all, and not on the cert itself. And if you can wait a couple months, you can try the "Let's Encrypt" initiative for a free one: letsencrypt.org – Tom Brossman May 17 '15 at 20:21
2

You can take a look into Qualys SSL labs. Another good Certificate Authority or reseller can provide you with browser compatibility information.

An example of this is https://www.positivessl.com/browser_compatibility.php

Know that the configuration of your SSL settings also can affect the browser or device compatibility.

Other things to consider are:

  1. The price.
  2. Registering a certificate signed with SHA-2 instead of SHA-1 (since Microsoft will stop supporting SHA-1 signed certificates soon).
  3. Wildcard or single domain certificate.
  • Thanks a lot for your answer. Is there anything else that you think might be useful when choosing a ssl? – Ashkan Mobayen Khiabani May 17 '15 at 23:07
  • Yes, i changed the answer with some suggestions. – Bob Ortiz May 18 '15 at 19:02
3

Most of the time it's not the SSL that browsers don't support - it's your server settings and cipher suite. All new browsers support pretty much everything though, its just the old stuff you have to worry about. Examples are as follows:

  • SNI - This is to allow multiple certs on multiple domains to be applied to 1 IP. Known as a multi-tennant server. XP users with old IE will not be able to connect.
  • ECDH - This is a protocol that is getting quite popular. Cloudflare for example uses it by default (and exclusively) for Flexible SSL on all free plans. The only browser on XP that will work with this is Firefox. All others won't connect.
  • Forward Secrecy - This makes more localized handshakes based on more unique keys. Various old versions of browsers on XP will not connect.
  • POODLE fixes - This shouldn't affect much, but taking away support for SSL2/3 and only allowing TLS can affect some very old browsers, old CURL, or other utility layers.
  • Your Chosen Ciphers - This is totally dependent on what you choose to support as far as ciphers go. You can trim down your list and make it very secure, at the risk of locking out old browsers.

As mentioned, Qualys is the go-to when it comes to SSL audits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.