91
votes
Accepted
Why should I pay for an SSL certificate?
Why should I pay for an SSL certificate?
For most uses, there's no good reason to pay for them.
See the very bottom for a summary of the exceptions.
Let's take a step back and explain what ...
- 794
42
votes
Accepted
Do I have to pay a web hosting company for an SSL certificate?
SSL certificates need to be installed in the server config, so for "typical web hosting" your hosting provider can easily restrict your ability to add your own certs (and even generating ...
- 7,016
34
votes
Accepted
How do I get my site verified such that it shows a green box in Chrome's address bar?
The 'green box' in the Chrome address bar isn't anything to do with verification by Google - as Stephen alluded to in the comments on your question, it's an indication that your site has an Extended ...
- 1,241
30
votes
How do I get my site verified such that it shows a green box in Chrome's address bar?
As Tim Malone said, this is a special type of SSL certificate that is usually sold at a premium by certificate authorities. The going rate is usually at least a couple of hundred dollars.
What Tim ...
- 401
26
votes
Accepted
StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome
I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of ...
- 2,271
22
votes
Do I need a certificate to redirect via CNAME?
Neverever's answer is correct. You do need an SSL certificate. I wanted to add that it is because there is no such thing as a CNAME redirect.
A CNAME is not a redirect. A CNAME instructs the ...
- 97.2k
16
votes
Accepted
SSL certificate wildcard / single name - will it work for subdirectories?
You don't need a "wildcard" certificate to secure subdirectories. All SSL certs will secure subdirectories. SSL certs secure hosts (domains). A "wildcard cert" will ordinarily secure subdomains eg. &...
- 42.4k
15
votes
How do I get my site verified such that it shows a green box in Chrome's address bar?
I think this question deserves a bit more background...
There's different types of SSL/TLS certificates that can be issued by a Certificate Authority (CA), who basically acts like a notary, certifying ...
- 346
14
votes
Does SSL require a client side certificate of any kind at all?
The typical case of certificates issued by a trusted party (Let's Encrypt etc)
Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
- 651
12
votes
Accepted
Do I need a certificate to redirect via CNAME?
Yes, you'll still need an SSL certificate for abc.example.com
Due to the nature of CNAME redirection, when you type abc.example.com in the browser, the URL stays abc.example.com, and this is where ...
- 281
12
votes
Do I have to pay a web hosting company for an SSL certificate?
Some hosting companies require that you pay them for their SSL certificates. It is not always possible to install a certificate from a third party.
That being said, such a host is rare. Most ...
- 97.2k
11
votes
Accepted
In what path I can find the .crt file for Let's Encrypt SSL?
After successfully running Lets Encrypt for example.com, the latest certificate files can be found in the following location:
/etc/letsencrypt/live/example.com/privkey.pem
/etc/letsencrypt/live/...
- 97.2k
10
votes
Accepted
What can I do to pay less for SSL?
You no longer need an IP address for each site. There are two possibilities.
You could get one subject alternative name (SAN) certificate that covers all your domains. SAN certificates have ...
- 97.2k
9
votes
Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key
Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention:
openssl speed rsa2048 ...
- 2,271
9
votes
Accepted
Does SSL require a client side certificate of any kind at all?
Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
- 2,241
8
votes
Accepted
Schema links and HTTPS
These are no resources which get usually accessed by the browser but simply a fancy way to declare a name space, i.e. all SVG images share the same XML name space which is defined by the URL and same ...
- 651
8
votes
StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome
StartSSL confirmed that this is because of the partially revoked StartCom root certificate. They are working on getting their root certificate fully trusted by browsers again. It sounds like end of ...
- 97.2k
7
votes
Untrusted Cloudflare SSL Certificate
Your invalid certificate authority error is due to the fact that CloudFlare issued it, not because of how you were routing traffic. This is because you used a type of certificate meant only to secure ...
- 2,271
7
votes
Why should I pay for an SSL certificate?
Let's Encrypt is superior in many ways, including the ones that you have mentioned, such as:
It's free. Hard to get past that.
It has automatic renewal (I'm sure it's not JUST exclusive with Let's ...
- 156
7
votes
Do I have to pay a web hosting company for an SSL certificate?
Depending on your use case, one quick way of making a site SSL enabled would be to put it behind Cloudflare and use one of their free certificates. If you can get your web host to install a ...
- 171
6
votes
SSL certificate wildcard / single name - will it work for subdirectories?
Wildcard SSL certificates are used to secure sub-domains.
For example,
mail.example.com
shop.example.com
anysub.example.com
You can install any single domain SSL certificate on your website, it can ...
- 171
6
votes
In what path I can find the .crt file for Let's Encrypt SSL?
Quick Answer
ubuntu:
/etc/letsencrypt/live/domain.com/cert.pem (Certificate)
/etc/letsencrypt/live/domain.com/privkey.pem (Private Key)
Details
You are looking for file like cert.crt, actually ...
6
votes
Accepted
HTTP webpage is showing "Not Secure" in Chrome
This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to ...
- 1,254
5
votes
Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key
I decided to run openssl speed with three key sizes: 1024, 2048 and 4096 bits. Here are the results on my home PC, which is decent but far from exceptional as far as number-crunching power goes:
...
- 351
5
votes
EV SSL Certificates - does anyone care?
I too have been unable to find independent studies showing an increased perception of trust associated with the green bar.
Digicert published a white paper pompously titled "The Impact of ...
- 350
5
votes
Accepted
Do bitly "Branded short domains" support https?
YES. It's not official yet, but Bitly is starting to talk about their upcoming HTTPS support and it's already being rolled out.
Here are two examples: https://huff.to/1NozAOQ and https://tcrn.ch/...
- 227
5
votes
How do I get my site verified such that it shows a green box in Chrome's address bar?
Other answers say how to get the certificate, but don't mention that your users need to be using your site over HTTPS to see the green bar even once you have the certificate installed.
If showing the ...
- 97.2k
5
votes
Accepted
Untrusted Cloudflare SSL Certificate
I found the answer here: https://support.cloudflare.com/hc/en-us/articles/200170566-Why-isn-t-SSL-working-for-my-site-
Your domain/sub-domain is not active on Cloudflare’s network
Cloudflare’s ...
- 348
5
votes
Accepted
SSL Labs Key exchange < 100%, why? How do I make it?
In the following file:
/etc/apache2/mods-enabled/ssl.conf
It was necessary to append these lines to ensure the highest grade of key exchange:
SSLOpenSSLConfCmd ECDHParameters Automatic
...
- 393
5
votes
How to avoid SSL warnings about certificate not for the current site when redirecting alternate domains?
Cloudflare is a free solution for redirecting your alternate domains with HTTPS support. Here are detailed instructions for setting it up:
Visit Cloudflare
Create an account and verify your email ...
- 97.2k
Only top scored, non community-wiki answers of a minimum length are eligible