Slashdot Mirror

"elegant, reliable & cheap (free)" You can get pretty darn close with http://www.comodogroup.com/products/free_products. html

I like Comodo AV

http://www.comodogroup.com/products/free_products. html#2?entryURL=

I just checked comodo.com and it says "starting from only $249 for a 2 year certificate". That's more than twice the $50 a year you quoted. Do they have some other cert that's cheaper?

Commercial certificates can be found for much less nowdays (check this CA for example). Anti-spam organisations can put up their own free CA if need be: this would scale as well or better than a generalised DomainKeys.

When I read about Yahoo's anti-forgery solution, TLS striked me as a more standard compliant one as well as a more mature security measure. You do not need to review new code, it is already there for current MTAs.

SMTP transaction encryption is generally not regarded as a bad thing.

Just so you know, WhichSSL.com is owned by Comodo Group, which makes InstantSSL certificates. So, it's biased towards InstantSSL certificates. Geotrust (under the guise of "FreeSSL") hosts its own similar website (originally WhichSSL.org) called SSLReview which has its own predictable slant.

Basically, they are both low budget certificates and while they compete somewhat on price, mostly they try to sell their strengths and over-FUD the other certificate's weaknesses. InstantSSL has a wider browers recognition (99% of all browsers vs. FreeSSL's 95%); WhichSSL warns you could be losing thousands of customers. FreeSSL (Geocities, actually) owns its own root, whereas InstantSSL uses the Baltimore root; SSLReview warns that certificates bought through InstantSSL might not be reliable or stable as a result.

Right now I'm using InstantSSL myself; even with Geocities behind them FreeSSL just doesn't look as polished or professional, and since the security of the certificates are identical, I'm going mostly on the confidence my customers will feel when I send them to the InstantSSL website to show that they're a professional company.

Geotrust's $119 certificates are validated only by emailing the WHOIS admin contact, (at least according to the CPS, which you would expect to be correct. See esp. B.1 and B.2.

InstantSSL's $49 SSL certificates do validate the organisation, not just the control of the domain. See their CPS esp. 4.3 and 6.4.

Disclaimer: I work for Comodo, which does the validation for InstantSSL, although I am not involved in the process myself. However although I like Comodo, and they pay my wages, I don't speak for Comodo (hence posting anonymously), and am soley responsible for the content of this message.

By the way, they also do free email certificates (identity not validated) which other people charge $10-$20 for.

Comodo has a great deal. $49. their service is excellent and i have had no problems at all.

The only point of buying one, after all, being that visitors aren't subjected to confusing warnings about certificates.

Besides that one certificate I haven't dealt with Comodo so won't recommend at random -- but they supplied the certificate quickly, cheaply enough, and it works.

You can even get a free 30-day trial cert.