84

Why should I pay for an SSL certificate? For most uses, there's no good reason to pay for them. See the very bottom for a summary of the exceptions. Let's take a step back and explain what certificates do and roughly how. What are commonly called "certificates" consist of two linked pieces: The certificate proper, which contains a public key and some ...


34

The 'green box' in the Chrome address bar isn't anything to do with verification by Google - as Stephen alluded to in the comments on your question, it's an indication that your site has an Extended Verification (EV) security certificate. This is generally a 'premium' SSL product offered by many SSL certificate providers. To get one of these certificates, ...


33

Apart from unserious offerings, you can distinguish between cheaper domain-validated SSL certificates and the more expensive extended-validation SSL certificates (EV). Both certificates are technically the same (the connection is encrypted), but domain-validated certificates are cheaper, because the seller only have to check the domain. The EV-certificates ...


31

It should be noted that the following list has not been updated since November 2014. The following browsers do support SNI: Internet Explorer 7 or newer, on Windows Vista or newer. Mozilla Firefox 2.0 or later Opera 8.0 or newer (TLS 1.1 protocol needs to be enabled) Opera Mobile with at least version 10.1 bèta on Android Google Chrome (Vista or newer. XP ...


30

As Tim Malone said, this is a special type of SSL certificate that is usually sold at a premium by certificate authorities. The going rate is usually at least a couple of hundred dollars. What Tim did not mention, and part of the reason for the elevated price, is that there is a certain amount of paperwork involved that has to be submitted to and checked by ...


27

There are a few ways you can do this but if you have the URL Rewrite Module installed, it's fairly easy and a good way to do it. You can paste the below configuration into your site's web.config file (enclosed in the <system.webServer></system.webServer> section) <configuration> <system.webServer> <rewrite> <rules> ...


26

I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of course and will happily sell you new certs, continuing their extremely shady pattern of behaviour. At this point all I can recommend is damage control by ...


16

You don't need a "wildcard" certificate to secure subdirectories. All SSL certs will secure subdirectories. SSL certs secure hosts (domains). A "wildcard cert" will ordinarily secure subdomains eg. <anysubdomain>.example.com - but this should be made clear when you purchase the cert.


15

I think this question deserves a bit more background... There's different types of SSL/TLS certificates that can be issued by a Certificate Authority (CA), who basically acts like a notary, certifying that the domain you're accessing, is really the real site, and you're accessing it securely. When you access a site that uses HTTPS, the site's server will ...


12

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to detect man in the middle attacks. To authenticate itself against a client the server needs for this the certificate itself which is public and the private key ...


10

SSL certificates no longer require a dedicated IP address. There is a relatively new technology called Server Name Indication (SNI) that allows SSL certificates to be associated with a virtual host rather than with the server's IP address. Here is a digicert article that explains it very well. Your host may not have SNI support installed yet. It ...


10

You no longer need an IP address for each site. There are two possibilities. You could get one subject alternative name (SAN) certificate that covers all your domains. SAN certificates have 100% modern browser support. This single certificate can be hosted on a dedicated IP address with virtual hosts for all your sites. This is a decent option if ...


8

From the GoDaddy website: Enjoy the backing of established industry standards. There is NO TECHNICAL DIFFERENCE between our certificates and any other major Certification Authority. Source: http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=9039 Pricing is a funny thing sometimes. While I have no idea why GoDaddy prices their products the way ...


8

To be quite honest. there is absolutely NO difference when it comes to SSL certificates. The only contributing factor is the EV / non EV / Wildcard tags. EV == Extended Validation: This means the site is actively " pinged " by the Certificate Authority on the provided IP of the domain, then a server-side script compares the IP address of the ping response ...


8

Web browsers do not care about canonical URLs. It is for search engine use only (specifically Google). Additionally, canonical URLs do not affect the loading or rendering of a web page. So no assets will be loaded over HTTP which is what would cause an insecure error message. So, no, they will not display any error message.


8

These are no resources which get usually accessed by the browser but simply a fancy way to declare a name space, i.e. all SVG images share the same XML name space which is defined by the URL and same with xlink. This means you should treat any of these xmlns just as some kind of special string and leave them unchanged.


8

StartSSL confirmed that this is because of the partially revoked StartCom root certificate. They are working on getting their root certificate fully trusted by browsers again. It sounds like end of February would be the earliest time frame, so not in time to help my certs that expire in two weeks. :-( To: Stephen Ostermiller, This electronic mail ...


7

The rule of them is if you are sending or receiving sensitive information you should be using encryption. What is considered sensitive is subjective but anything considered private or personal can be considered sensitive (e.g. passwords, credit card information, social security numbers in the US). Email addresses are not generally considered private or ...


7

I agree with @John, as long as your site is COPA compliant-- if applicable. Email addresses, according to COPA, would be considered sensitive information as it could be used to contact a child online. Similar rules may apply to HIPAA or other international regulations (I really do not know). Food for thought though. http://business.ftc.gov/documents/bus45-...


7

You need a website certificate when you need to protect your user's data against eavesdropping in transit. To protect against this, people typically use HTTPS instead of HTTP. For HTTPS the server presents a certificate to the client, the client decides whether to trust that the server is who it claims to be by checking that the certificate has been signed ...


7

This website: https://pointless.net/ Is dnssec signed and uses a TLSA record (RFC6698) to secure the SSL certificate (Which is also signed by CA CERT, a sort of open source web of trust CA). I run my own nameservers and use Easydns as my registrar - however Easydns doesn't support putting a DS record in the .net zone so I use the ISC Domain Lookaside ...


7

...my browser would see a different signed cert than my session was established with, and cause the session to "freak out". From a webmaster's perspective, and without getting into details on "how SSL works" (which would be better discussed over at Information Security)... The session key would no longer match so either the server or client browser would ...


7

Let's Encrypt is superior in many ways, including the ones that you have mentioned, such as: It's free. Hard to get past that. It has automatic renewal (I'm sure it's not JUST exclusive with Let's Encrypt, however) It's pretty easy to set up. Google and many others support it as a trusted CA, which is a huge deal when it comes to SEO and security. However, ...


6

You might find The First Few Milliseconds of an HTTPS Connection by Jeff Moser useful reading. It provides a detailed explanation of what happens on the wire when a browser sets up an HTTPS connection with a server. This interesting video illustrates public key cryptography by mixing paint colours! You should also look at the OpenSSL command line tool. ...


6

No. SSL certificates are implicitly tied to the domain name that they are served from. If your certificate hasn't been issued for your customer's domain then you can't use it. There is still at least one option. If your customers are prepared to give you an SSL certificate which is valid for their domain then your server config can be set up to use that for ...


6

StartCom are in the Microsoft list of root certificate issuers. The process whereby the certificates get updated is described here. In brief - the certificates used by IE are recognised by the operating system, not on the browser version. If this IE6 is on XP, and the XP machine received Windows updates, then it could be that they weren't recognised in 2010, ...


6

The problem is because you have some of the images hard-coded to load through http protocol on your index page. You should change the links to be protocol-agnostic by using //, e.g.: <img src="http://example.com/image.png"> Change with: <img src="//example.com/image.png"> These links will make content load through https if site is also using ...


6

Your invalid certificate authority error is due to the fact that CloudFlare issued it, not because of how you were routing traffic. This is because you used a type of certificate meant only to secure communication between your origin server and CloudFlare's network. It is issued via what they call their "Origin Certificate Authority" explained here. When ...


6

Wildcard SSL certificates are used to secure sub-domains. For example, mail.example.com shop.example.com anysub.example.com You can install any single domain SSL certificate on your website, it can secure your root domain as well all directories / folders. For example, example.com/your-product-name example.com/discount-offer-page example.com/any-web-...


6

Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.


Only top voted, non community-wiki answers of a minimum length are eligible