93
votes
Accepted
Why should I pay for an SSL certificate?
Why should I pay for an SSL certificate?
For most uses, there's no good reason to pay for them.
See the very bottom for a summary of the exceptions.
Let's take a step back and explain what ...
- 814
42
votes
Accepted
Do I have to pay a web hosting company for an SSL certificate?
SSL certificates need to be installed in the server config, so for "typical web hosting" your hosting provider can easily restrict your ability to add your own certs (and even generating ...
- 8,296
26
votes
Accepted
StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome
I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of ...
- 2,291
23
votes
Do I need a certificate to redirect via CNAME?
Neverever's answer is correct. You do need an SSL certificate. I wanted to add that it is because there is no such thing as a CNAME redirect.
A CNAME is not a redirect. A CNAME instructs the ...
- 99.4k
16
votes
Accepted
SSL certificate wildcard / single name - will it work for subdirectories?
You don't need a "wildcard" certificate to secure subdirectories. All SSL certs will secure subdirectories. SSL certs secure hosts (domains). A "wildcard cert" will ordinarily secure subdomains eg. &...
- 43.1k
14
votes
Does SSL require a client side certificate of any kind at all?
The typical case of certificates issued by a trusted party (Let's Encrypt etc)
Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
- 671
12
votes
How to avoid SSL warnings about certificate not for the current site when redirecting alternate domains?
Cloudflare is a free solution for redirecting your alternate domains with HTTPS support. Here are detailed instructions for setting it up:
Visit Cloudflare
Create an account and verify your email ...
- 99.4k
12
votes
Accepted
Do I need a certificate to redirect via CNAME?
Yes, you'll still need an SSL certificate for abc.example.com
Due to the nature of CNAME redirection, when you type abc.example.com in the browser, the URL stays abc.example.com, and this is where ...
- 281
12
votes
Do I have to pay a web hosting company for an SSL certificate?
Some hosting companies require that you pay them for their SSL certificates. It is not always possible to install a certificate from a third party.
That being said, such a host is rare. Most ...
- 99.4k
11
votes
Accepted
In what path I can find the .crt file for Let's Encrypt SSL?
After successfully running Lets Encrypt for example.com, the latest certificate files can be found in the following location:
/etc/letsencrypt/live/example.com/privkey.pem
/etc/letsencrypt/live/...
- 99.4k
10
votes
Accepted
What can I do to pay less for SSL?
You no longer need an IP address for each site. There are two possibilities.
You could get one subject alternative name (SAN) certificate that covers all your domains. SAN certificates have ...
- 99.4k
9
votes
Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key
Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention:
openssl speed rsa2048 ...
- 2,291
9
votes
Accepted
Does SSL require a client side certificate of any kind at all?
Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
- 2,311
8
votes
StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome
StartSSL confirmed that this is because of the partially revoked StartCom root certificate. They are working on getting their root certificate fully trusted by browsers again. It sounds like end of ...
- 99.4k
8
votes
Why should I pay for an SSL certificate?
Let's Encrypt is superior in many ways, including the ones that you have mentioned, such as:
It's free. Hard to get past that.
It has automatic renewal (I'm sure it's not JUST exclusive with Let's ...
- 166
7
votes
Untrusted Cloudflare SSL Certificate
Your invalid certificate authority error is due to the fact that CloudFlare issued it, not because of how you were routing traffic. This is because you used a type of certificate meant only to secure ...
- 2,291
7
votes
Do I have to pay a web hosting company for an SSL certificate?
Depending on your use case, one quick way of making a site SSL enabled would be to put it behind Cloudflare and use one of their free certificates. If you can get your web host to install a ...
- 171
6
votes
SSL certificate wildcard / single name - will it work for subdirectories?
Wildcard SSL certificates are used to secure sub-domains.
For example,
mail.example.com
shop.example.com
anysub.example.com
You can install any single domain SSL certificate on your website, it can ...
- 171
6
votes
In what path I can find the .crt file for Let's Encrypt SSL?
Quick Answer
ubuntu:
/etc/letsencrypt/live/domain.com/cert.pem (Certificate)
/etc/letsencrypt/live/domain.com/privkey.pem (Private Key)
Details
You are looking for file like cert.crt, actually ...
6
votes
Accepted
HTTP webpage is showing "Not Secure" in Chrome
This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to ...
- 1,254
5
votes
Accepted
Untrusted Cloudflare SSL Certificate
I found the answer here: https://support.cloudflare.com/hc/en-us/articles/200170566-Why-isn-t-SSL-working-for-my-site-
Your domain/sub-domain is not active on Cloudflare’s network
Cloudflare’s ...
- 348
5
votes
Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key
I decided to run openssl speed with three key sizes: 1024, 2048 and 4096 bits. Here are the results on my home PC, which is decent but far from exceptional as far as number-crunching power goes:
...
- 351
5
votes
Accepted
SSL Labs Key exchange < 100%, why? How do I make it?
In the following file:
/etc/apache2/mods-enabled/ssl.conf
It was necessary to append these lines to ensure the highest grade of key exchange:
SSLOpenSSLConfCmd ECDHParameters Automatic
...
- 443
5
votes
Accepted
SSL Labs Cipher Strength < 100%, why? How do I make it?
The picture basically depicts two things:
All ciphers listed in SSLCipherSuite in your Apache2 configuration, which are defined as RSA+*, in my case I had RSA+AESGCM256:RSA+AES256:RSA+AES defined, ...
- 443
5
votes
Why should I pay for an SSL certificate?
LetsEncrypt certificates are great. I use them myself instead of buying certificates. There are a few drawbacks:
LetsEncrypt certificates only last 3 months. Most purchased certificates are good ...
- 99.4k
4
votes
How do I remove HTTPS results from Google after the domain has been redirected and the SSL certificate taken down?
You can redirect the HTTPS version - you just need to have an SSL certificate for that domain.
Since the HTTPS version is what has apparently been indexed by Google, you'd be better off just setting ...
- 5,874
4
votes
Accepted
When does Squarespace renew TLS/x.509 certificates?
Update: My experience was weird and defied all expectations.
I was checking the certificate that was being served right up until about 10 seconds before the expiration date, using a variety of ...
- 609
4
votes
Accepted
Intermittent problem establishing a secure HTTPS connection to my site
Your DNS has two IP addresses specified for your site. Only one of the two has a server with properly configured security certificates.
When you have two A records for the same host name, it is ...
- 99.4k
4
votes
How does Cloudflare do HTTPS for my site when I haven't provided them with an ssl certificate?
As NuTTyX as said your name is in the SAN section.
You can see it quickly that way:
$ openssl s_client -connect copyurls.ml:443 -servername copyurls.ml -showcerts </dev/null |& grep -A100 '...
- 8,505
4
votes
Accepted
Is there a rule that prevents CAs from issuing certificates for private networks (intranets)?
There is a rule adopted in 2012 by the CA/Browser Forum that prohibits certificate authorities from issuing SSL certs for internal names. All certificates for internal names issued beforehand were ...
- 99.4k
Only top scored, non community-wiki answers of a minimum length are eligible