Ask HN: What's the best company to buy SSL certificates from?

https://news.ycombinator.com/item?id=3556796

by cioc • 14 years ago

124 70 14 years ago

news.ycombinator.com

What's your goal? There are all types of certificates, some cheap and some expensive. If you're aiming for cheap, companies like Namecheap and GoDaddy sell them for peanuts but they're "cheap" certificates, not with bells and whistles.

Mavyrk• 14 years ago

Is there a chance you could elaborate on this some? What would some example "bells and whistles" be with regards to SSL certs?

XERQ2• 14 years ago

Verisign EV certs get the green text along with the name of the company in the browser (ex: https://paypal.com)

More information: http://www.verisign.com/ssl/ssl-information-center/extended-...

zumda2• 14 years ago

Mostly, they are the same. There are some "addons" that are possible with SSL certificats. For example wildcard certificats which are valid on all subdomains, included support, encryption strength, browser support and others.

charliesome• 14 years ago

I like Gandi. You get a free SSL certificate for a year with your domain, and it's $12 a year after that.

agwa• 14 years ago

They say you also get a free 1-year certificate with domain name renewals, implying that if you renew your domains for 1 year you can get a perpetual stream of free certs.

orftz• 14 years ago

The only downside is that Gandi's certificates are not wildcard; i.e. they only apply to your root domain.

blakdawg• 14 years ago

startssl.com is free.

leftnode• 14 years ago

I get mine through DNSimple. I'm sure they're a reseller for another company, but $20 a year for a single domain SSL and $100 a year for wildcard.

dangrossman• 14 years ago

That's expensive. The same GeoTrust RapidSSL certificate is $9.95/year through Namecheap, for example.

XERQ2• 14 years ago

We've used Comodo certs for our projects, given out for free by our provider SSD Nodes (http://www.webhostingtalk.com/showthread.php?t=1122631). I think the certs by themselves are $9-10/year if you decided to get them on your own.

josephb• 14 years ago

NameCheap has been great for me, for SSL certificates and domains.

oblasco• 14 years ago

Comodo with PositiveSSL is bargain for 9$ USD

charliepark• 14 years ago

I get ours through our registrar (who also does our sideproject hosting), DreamHost. They have $15/year certificates (via Comodo), and you automatically get both the root and the www. subdomain of the certificate, included in the price.

8ig8• 14 years ago

FWIW, Stripe recommends DigiCert: https://stripe.com/help/ssl

> We recommend DigiCert — their certificates have very wide acceptance (for example, Facebook uses a DigiCert certificate). Other options include NameCheap and GoDaddy. They have slightly lower acceptance but their basic certificates cost $10 to $20.

pasbesoin• 14 years ago

FB's been switching over the VeriSign -- at least, in my neck of the woods. I pay attention to certs, so I noticed this and took some time to somewhat reassure myself that no MITM was going on. (If I'm wrong, someone please tell me!)

jvdh• 14 years ago

StartSSL.com offers free yearly simple SSL certificates, and are supported by all major browsers. If you want higher-grade, you'll have to pay. They're very open about wanting to provide free simple certificates for everyone.

_urga2• 14 years ago

Re: StartSSL see http://www.belshe.com/2012/02/04/rethinking-ssl-for-mobile-a...

maaku2• 14 years ago

That's disingenuous. You should be bundling your CA cert with your cert anyway, which would avoid that problem.

nicksuan• 14 years ago

Some of those numbers don't look correct at all. For example I can't find any host name that takes longer than ~500ms to do DNS resolution over 3G. (That's almost worst case scenario, where everything except the TLD is uncached.)

RyanMcGreal5• 14 years ago

What's the difference between a simple certificate and something higher-grade? What does the simple certificate lack that a higher grade certificate provides?

JoachimSchipper2• 14 years ago

Extended verification certificates (EV; "actually verified") cause the browser bar to turn green. That will make people more likely to trust you.

mp3geek• 14 years ago

We use StartSSL-free on https://secure.fanboy.co.nz .. no issues with it :)

shocks• 14 years ago

I use http://exoware.net/ They're a small company, but they care and they do a good job so we get along just fine. SSL starts at £15 a year and goes up. £70 per year for a wildcard.

hencq• 14 years ago

Slightly off topic, but how are people using SSL with App Engine? Last time I checked they didn't support SSL on your own domain. I'm not sure if this is similar for e.g. Heroku. I presume most non-trivial apps would have some kind of secure login.

18pfsmt• 14 years ago

Looks like it went into testing last October [1], otherwise people have been using their appspot subdomains.

[1]http://googleappengine.blogspot.com/2011/10/app-engine-ssl-f...

ck22• 14 years ago

Don't feed the SSL cartel

Free SSL cert accepted by all modern browsers https://www.startssl.com/?app=1

They are owned and operated by http://www.startcom.org/

mike-cardwell2• 14 years ago

startssl.com is part of the cartel you don't want to feed... Yes, they offer free certificates, but only in order to market their paid certificates.

FWIW, I use free certs from startssl.com myself.

If you really want to avoid the "cartel", use cacert.org or a self signed cert.

saiko-chriskun• 14 years ago

I will use cacert as soon as they're part of the standard cert group on all the major browsers :P

plaes• 14 years ago

I use cacert.org (free) on my private stuff. Unfortunately they are not included with Mozilla, so leaning towards startssl.com for my public project.

conanite• 14 years ago

Side question: what's the best company for SSL certificates where you're hosting multiple distinct domains for various clients on the same server? I've read about SAN certs, but I haven't found any documentation ...

nodata2• 14 years ago

What do you want to do? Have multiple sites using the same ip address and port share a certificate? Get an SNI certificate, but beware of WinXP.

Erwin• 14 years ago

DigiCert claims that you can add/remove alternative names on already purchased certificates right from their account (you don't even need to include them in the CSR just the primary), but I haven't tried it personally. I wonder about what authentication you, as owner of www.foo.com, have to undergo to add e.g. myapp.client.com to the alternate name.

The downside seems that the organization/country/city fields must be the same but that doesn't show unless you use EV The upside is no painful IP acquisition, CSR and renewal process.

jd• 14 years ago

As far I know the only thing that works reliably is to get multiple IPs and multiple (wildcard) SSL certificates. You can try to save a little money by getting startssl certificates (free) or by using SSL host headers (multiple SSL on one IP address), but it doesn't work on all browsers so you end up wasting time explaining to your customers why they get an error when they access their site.

rickard• 14 years ago

What is "SSL host headers"? Is it wildcard certs, as Microsoft describes them on http://www.microsoft.com/technet/prodtechnol/WindowsServer20... ?

crististm• 14 years ago

I can imagine the SSL cert sellers laughing at those buying them. How is it that money can BUY TRUST is beyond my comprehension.

nodata2• 14 years ago

Well how can you trust a company you have never dealt with before? It used to be that SSL certificates were a mark of insurance, proof that they had thought about securing your data in transmission, and proof that someone had validated the company as being real (like an auditor should). Nowadays points 1 and 3 are no longer true.

ofutur• 14 years ago

Get the best SSL cert for the job...

If you just want to secure a login page for your own personal use, get a free cert from StartSSL.

If you need to give access to the page to more people, it's best to get a cheap cert from Comodo, etc. because they're compatible with more mobile devices. Don't spend more than $15

If you intend on selling something from the site, I'd recommend getting some form of company validation on top of the standard domain validation which is performed when buying cheaper certs. GeoTrust, Comodo, Globalsign, etc. can help. It should cost less than $100.

The best certs to get to re-assure your customers are the EV ones. No need to go full Verisign and waste ton of money on them, you can get them cheap-ish from Globalsign, Comodo and Geotrust resellers.

If you're getting a cert generated by an established certificate authority, it doesn't really matter who you buy it from. Aim for the best price for the level of support that you want to get.

foobarbazetc• 14 years ago

Ignore anyone in this thread telling you to use StartSSL.

When you care about your cert (validated, EV, etc): DigiCert. When you don't care that much: RapidSSL from Namecheap.

The end.

RyanMcGreal5• 14 years ago

> Ignore anyone in this thread telling you to use StartSSL.

Why? What's wrong with it?

nimrody• 14 years ago

You might care about your cert. However, your users do not care at all. Most users (not most HN readers!) have no idea what is the difference between certificates.

Do you really think users pause to check what type of SSL certificate the site has? .. And what CA had signed that certificate? They don't -- even when they access their bank.

tyrelb• 14 years ago

name.com

ibejoeb2• 14 years ago

I like https://www.alphassl.com/. It's one hop down the chain from the Global Sign root.

ibejoeb2• 14 years ago

Also, you might be interested in the trust relationships between the major CAs.

- https://www.eff.org/files/colour_map_of_CAs.pdf

- https://www.eff.org/files/DefconSSLiverse.pdf

getsat• 14 years ago

Digicert is ballin'. Using them on a few sites.

georgelawrence• 14 years ago

A little off topic, but I'm thinking of using CloudFlare's "Easiest SSL Ever"... Is anyone here using it?

http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...

traxtech• 14 years ago

Not yet, but that's my plan :) I'll setup CloudFlare soon, for the "go live" of my new startup this month.

dshep• 14 years ago

I had a good experience with StartCom.

finnw• 14 years ago

I cannot recommend Comodo.

I paid for one of their certificates (through a re-seller) but they refused to issue it on the grounds that they could not verify my phone number. It was true that it was not in the directories they referred to, but they did not make that clear before selling the certificate.

I would have made a chargeback, but was paranoid about them informing other CAs of the fact - it would be a disaster if I was never able to get another SSL certificate.

qedeshbala• 14 years ago

I would definitely advice to you startssl.com, they offer free ssl certificates.

Ask HN: What's the best company to buy SSL certificates from?

Related Stories