85

Why should I pay for an SSL certificate? For most uses, there's no good reason to pay for them. See the very bottom for a summary of the exceptions. Let's take a step back and explain what certificates do and roughly how. What are commonly called "certificates" consist of two linked pieces: The certificate proper, which contains a public key and some ...


34

The 'green box' in the Chrome address bar isn't anything to do with verification by Google - as Stephen alluded to in the comments on your question, it's an indication that your site has an Extended Verification (EV) security certificate. This is generally a 'premium' SSL product offered by many SSL certificate providers. To get one of these certificates, ...


33

It should be noted that the following list has not been updated since November 2014. The following browsers do support SNI: Internet Explorer 7 or newer, on Windows Vista or newer. Mozilla Firefox 2.0 or later Opera 8.0 or newer (TLS 1.1 protocol needs to be enabled) Opera Mobile with at least version 10.1 b├Ęta on Android Google Chrome (Vista or newer. XP ...


30

As Tim Malone said, this is a special type of SSL certificate that is usually sold at a premium by certificate authorities. The going rate is usually at least a couple of hundred dollars. What Tim did not mention, and part of the reason for the elevated price, is that there is a certain amount of paperwork involved that has to be submitted to and checked by ...


26

I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of course and will happily sell you new certs, continuing their extremely shady pattern of behaviour. At this point all I can recommend is damage control by ...


16

You don't need a "wildcard" certificate to secure subdirectories. All SSL certs will secure subdirectories. SSL certs secure hosts (domains). A "wildcard cert" will ordinarily secure subdomains eg. <anysubdomain>.example.com - but this should be made clear when you purchase the cert.


15

I think this question deserves a bit more background... There's different types of SSL/TLS certificates that can be issued by a Certificate Authority (CA), who basically acts like a notary, certifying that the domain you're accessing, is really the real site, and you're accessing it securely. When you access a site that uses HTTPS, the site's server will ...


13

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to detect man in the middle attacks. To authenticate itself against a client the server needs for this the certificate itself which is public and the private key ...


10

SSL certificates no longer require a dedicated IP address. There is a relatively new technology called Server Name Indication (SNI) that allows SSL certificates to be associated with a virtual host rather than with the server's IP address. Here is a digicert article that explains it very well. Your host may not have SNI support installed yet. It ...


10

You no longer need an IP address for each site. There are two possibilities. You could get one subject alternative name (SAN) certificate that covers all your domains. SAN certificates have 100% modern browser support. This single certificate can be hosted on a dedicated IP address with virtual hosts for all your sites. This is a decent option if ...


9

Neverever's answer is correct. You do need an SSL certificate. I wanted to add that it is because there is no such thing as a CNAME redirect. A CNAME is not a redirect. A CNAME instructs the DNS to resolve to the same domain as where the CNAME points. The CNAME does not cause a redirect. It only causes the HTTP request for a domain to be made to ...


8

To be quite honest. there is absolutely NO difference when it comes to SSL certificates. The only contributing factor is the EV / non EV / Wildcard tags. EV == Extended Validation: This means the site is actively " pinged " by the Certificate Authority on the provided IP of the domain, then a server-side script compares the IP address of the ping response ...


8

Web browsers do not care about canonical URLs. It is for search engine use only (specifically Google). Additionally, canonical URLs do not affect the loading or rendering of a web page. So no assets will be loaded over HTTP which is what would cause an insecure error message. So, no, they will not display any error message.


8

These are no resources which get usually accessed by the browser but simply a fancy way to declare a name space, i.e. all SVG images share the same XML name space which is defined by the URL and same with xlink. This means you should treat any of these xmlns just as some kind of special string and leave them unchanged.


8

StartSSL confirmed that this is because of the partially revoked StartCom root certificate. They are working on getting their root certificate fully trusted by browsers again. It sounds like end of February would be the earliest time frame, so not in time to help my certs that expire in two weeks. :-( To: Stephen Ostermiller, This electronic mail ...


8

Yes, you'll still need an SSL certificate for abc.example.com Due to the nature of CNAME redirection, when you type abc.example.com in the browser, the URL stays abc.example.com, and this is where you need the SSL certificate. SEO Tips You might want to use 301 redirects instead of CNAME redirect, this will pass on the ranking power/juice from abc.example....


7

This website: https://pointless.net/ Is dnssec signed and uses a TLSA record (RFC6698) to secure the SSL certificate (Which is also signed by CA CERT, a sort of open source web of trust CA). I run my own nameservers and use Easydns as my registrar - however Easydns doesn't support putting a DS record in the .net zone so I use the ISC Domain Lookaside ...


7

...my browser would see a different signed cert than my session was established with, and cause the session to "freak out". From a webmaster's perspective, and without getting into details on "how SSL works" (which would be better discussed over at Information Security)... The session key would no longer match so either the server or client browser would ...


7

Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention: openssl speed rsa2048 rsa4096 For reference, here are some benchmark results from a modest VPS: sign verify sign/s verify/s rsa 2048 bits 0.000685s 0.000032s ...


7

Let's Encrypt is superior in many ways, including the ones that you have mentioned, such as: It's free. Hard to get past that. It has automatic renewal (I'm sure it's not JUST exclusive with Let's Encrypt, however) It's pretty easy to set up. Google and many others support it as a trusted CA, which is a huge deal when it comes to SEO and security. However, ...


6

The problem is because you have some of the images hard-coded to load through http protocol on your index page. You should change the links to be protocol-agnostic by using //, e.g.: <img src="http://example.com/image.png"> Change with: <img src="//example.com/image.png"> These links will make content load through https if site is also using ...


6

Your invalid certificate authority error is due to the fact that CloudFlare issued it, not because of how you were routing traffic. This is because you used a type of certificate meant only to secure communication between your origin server and CloudFlare's network. It is issued via what they call their "Origin Certificate Authority" explained here. When ...


6

Wildcard SSL certificates are used to secure sub-domains. For example, mail.example.com shop.example.com anysub.example.com You can install any single domain SSL certificate on your website, it can secure your root domain as well all directories / folders. For example, example.com/your-product-name example.com/discount-offer-page example.com/any-web-...


6

After successfully running Lets Encrypt for example.com, the latest certificate files can be found in the following location: /etc/letsencrypt/live/example.com/privkey.pem /etc/letsencrypt/live/example.com/chain.pem /etc/letsencrypt/live/example.com/fullchain.pem /etc/letsencrypt/live/example.com/cert.pem cert.pem: The private certificate for your domain ...


6

Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.


6

This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to adopt the use of SSL certificates. According to Google's Developer Blog: Eventually, Chrome will show a Not Secure warning for all pages served over ...


5

You need to make sure that all resources from your page (images, scripts, css) are also loaded via https otherwise your page is not secure.


5

No, it is certainly not compatible with all browsers, but you'll probably never encounter one that doesn't support it. GoDaddy have a web page listing their compatibility. Notable exceptions include: Internet Explorer before V5.01 Netscape before V4.7 Opera before V7.5 Safari for Mac OS X before 10.3.4 Palm OS before V6.1


5

I too have been unable to find independent studies showing an increased perception of trust associated with the green bar. Digicert published a white paper pompously titled "The Impact of Extended Validation (EV) Certificates on Customer Confidence" claiming that 59% more users "said they were most likely to enter their details" into a ...


5

It could be done with a single SSL certificate. Specifically, what you want to do is to provide 'Subject Alt Names' in the certificate. Take a look at Google's certificate for example, which has the following Subject Alt Names. In other words, they have one certificate for all of those domains. DNS Name: *.google.com DNS Name: *.android.com DNS ...


Only top voted, non community-wiki answers of a minimum length are eligible