Skip to main content
Share Your Experience: Take the 2024 Developer Survey
92 votes
Accepted

Why should I pay for an SSL certificate?

Why should I pay for an SSL certificate? For most uses, there's no good reason to pay for them. See the very bottom for a summary of the exceptions. Let's take a step back and explain what ...
marcelm's user avatar
  • 804
42 votes
Accepted

Do I have to pay a web hosting company for an SSL certificate?

SSL certificates need to be installed in the server config, so for "typical web hosting" your hosting provider can easily restrict your ability to add your own certs (and even generating ...
davidgo's user avatar
  • 7,959
33 votes
Accepted

How do I get my site verified such that it shows a green box in Chrome's address bar?

The 'green box' in the Chrome address bar isn't anything to do with verification by Google - as Stephen alluded to in the comments on your question, it's an indication that your site has an Extended ...
Tim Malone's user avatar
  • 1,256
29 votes

How do I get my site verified such that it shows a green box in Chrome's address bar?

As Tim Malone said, this is a special type of SSL certificate that is usually sold at a premium by certificate authorities. The going rate is usually at least a couple of hundred dollars. What Tim ...
Ashley Strout's user avatar
26 votes
Accepted

StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome

I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of ...
Tom Brossman's user avatar
  • 2,291
23 votes

Do I need a certificate to redirect via CNAME?

Neverever's answer is correct. You do need an SSL certificate. I wanted to add that it is because there is no such thing as a CNAME redirect. A CNAME is not a redirect. A CNAME instructs the ...
Stephen Ostermiller's user avatar
16 votes
Accepted

SSL certificate wildcard / single name - will it work for subdirectories?

You don't need a "wildcard" certificate to secure subdirectories. All SSL certs will secure subdirectories. SSL certs secure hosts (domains). A "wildcard cert" will ordinarily secure subdomains eg. &...
MrWhite's user avatar
  • 42.8k
15 votes

How do I get my site verified such that it shows a green box in Chrome's address bar?

I think this question deserves a bit more background... There's different types of SSL/TLS certificates that can be issued by a Certificate Authority (CA), who basically acts like a notary, certifying ...
unknownprotocol's user avatar
14 votes

Does SSL require a client side certificate of any kind at all?

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to ...
Steffen Ullrich's user avatar
12 votes
Accepted

Do I need a certificate to redirect via CNAME?

Yes, you'll still need an SSL certificate for abc.example.com Due to the nature of CNAME redirection, when you type abc.example.com in the browser, the URL stays abc.example.com, and this is where ...
Rick Su's user avatar
  • 281
12 votes

Do I have to pay a web hosting company for an SSL certificate?

Some hosting companies require that you pay them for their SSL certificates. It is not always possible to install a certificate from a third party. That being said, such a host is rare. Most ...
Stephen Ostermiller's user avatar
11 votes
Accepted

In what path I can find the .crt file for Let's Encrypt SSL?

After successfully running Lets Encrypt for example.com, the latest certificate files can be found in the following location: /etc/letsencrypt/live/example.com/privkey.pem /etc/letsencrypt/live/...
Stephen Ostermiller's user avatar
10 votes
Accepted

What can I do to pay less for SSL?

You no longer need an IP address for each site. There are two possibilities. You could get one subject alternative name (SAN) certificate that covers all your domains. SAN certificates have ...
Stephen Ostermiller's user avatar
9 votes

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention: openssl speed rsa2048 ...
Tom Brossman's user avatar
  • 2,291
9 votes
Accepted

Does SSL require a client side certificate of any kind at all?

Your friend is correct. The browser has to have the root certification authority certificate, so that it can verify that the server certificate has been signed by a legitimate certification authority.
Mike Scott's user avatar
  • 2,291
9 votes

How to avoid SSL warnings about certificate not for the current site when redirecting alternate domains?

Cloudflare is a free solution for redirecting your alternate domains with HTTPS support. Here are detailed instructions for setting it up: Visit Cloudflare Create an account and verify your email ...
Stephen Ostermiller's user avatar
8 votes

StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome

StartSSL confirmed that this is because of the partially revoked StartCom root certificate. They are working on getting their root certificate fully trusted by browsers again. It sounds like end of ...
Stephen Ostermiller's user avatar
7 votes

Untrusted Cloudflare SSL Certificate

Your invalid certificate authority error is due to the fact that CloudFlare issued it, not because of how you were routing traffic. This is because you used a type of certificate meant only to secure ...
Tom Brossman's user avatar
  • 2,291
7 votes

Why should I pay for an SSL certificate?

Let's Encrypt is superior in many ways, including the ones that you have mentioned, such as: It's free. Hard to get past that. It has automatic renewal (I'm sure it's not JUST exclusive with Let's ...
Esmoothy's user avatar
  • 156
7 votes

Do I have to pay a web hosting company for an SSL certificate?

Depending on your use case, one quick way of making a site SSL enabled would be to put it behind Cloudflare and use one of their free certificates. If you can get your web host to install a ...
Edd's user avatar
  • 171
6 votes

SSL certificate wildcard / single name - will it work for subdirectories?

Wildcard SSL certificates are used to secure sub-domains. For example, mail.example.com shop.example.com anysub.example.com You can install any single domain SSL certificate on your website, it can ...
Jason Parms's user avatar
6 votes

In what path I can find the .crt file for Let's Encrypt SSL?

Quick Answer ubuntu: /etc/letsencrypt/live/domain.com/cert.pem (Certificate) /etc/letsencrypt/live/domain.com/privkey.pem (Private Key) Details You are looking for file like cert.crt, actually ...
Firas Abd Alrahman's user avatar
6 votes
Accepted

HTTP webpage is showing "Not Secure" in Chrome

This is a move to make the web more secure. Additionally, it protects all visitors to your site. The long-term solution is to implement SSL on your website(s), as all websites will eventually need to ...
Josh Salganik's user avatar
5 votes

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

I decided to run openssl speed with three key sizes: 1024, 2048 and 4096 bits. Here are the results on my home PC, which is decent but far from exceptional as far as number-crunching power goes: ...
user's user avatar
  • 351
5 votes
Accepted

Do bitly "Branded short domains" support https?

YES. It's not official yet, but Bitly is starting to talk about their upcoming HTTPS support and it's already being rolled out. Here are two examples: https://huff.to/1NozAOQ and https://tcrn.ch/...
smudge's user avatar
  • 227
5 votes

How do I get my site verified such that it shows a green box in Chrome's address bar?

Other answers say how to get the certificate, but don't mention that your users need to be using your site over HTTPS to see the green bar even once you have the certificate installed. If showing the ...
Stephen Ostermiller's user avatar
5 votes
Accepted

Untrusted Cloudflare SSL Certificate

I found the answer here: https://support.cloudflare.com/hc/en-us/articles/200170566-Why-isn-t-SSL-working-for-my-site- Your domain/sub-domain is not active on Cloudflare’s network Cloudflare’s ...
Gavin's user avatar
  • 348
5 votes
Accepted

SSL Labs Key exchange < 100%, why? How do I make it?

In the following file: /etc/apache2/mods-enabled/ssl.conf It was necessary to append these lines to ensure the highest grade of key exchange: SSLOpenSSLConfCmd ECDHParameters Automatic ...
Vlastimil Burián's user avatar
5 votes
Accepted

SSL Labs Cipher Strength < 100%, why? How do I make it?

The picture basically depicts two things: All ciphers listed in SSLCipherSuite in your Apache2 configuration, which are defined as RSA+*, in my case I had RSA+AESGCM256:RSA+AES256:RSA+AES defined, ...
Vlastimil Burián's user avatar
4 votes

How do I remove HTTPS results from Google after the domain has been redirected and the SSL certificate taken down?

You can redirect the HTTPS version - you just need to have an SSL certificate for that domain. Since the HTTPS version is what has apparently been indexed by Google, you'd be better off just setting ...
Andrew Lott's user avatar
  • 5,864

Only top scored, non community-wiki answers of a minimum length are eligible