Slashdot Mirror

I just executed the same process for my TLDs, and I m shocked as it works for me very easy and quickly.

Cheapest SSL

A few months ago, I got a certificate signed by a CA that is trusted by essentially all browsers. The cost was $15 per year. They even bothered to check that I had access to the admin's account on the server I was requesting the cert for. How is $15 per year too expensive for a small site or special project?

I got one also recently for $15/yr. Seems they raised the price to $79 for the basic 128 cert. That may keep kiddies away... Also my boss...

A few months ago, I got a certificate signed by a CA that is trusted by essentially all browsers. The cost was $15 per year. They even bothered to check that I had access to the admin's account on the server I was requesting the cert for. How is $15 per year too expensive for a small site or special project?

You seem to have included an extra 0 in your price.

These guys will sell an SSL cert for $15, or $12/yr if you buy 5 years. I'm not sure who's offering $10, but somebody probably is. They verify your e-mail address and phone number, and take a recording of your voice over the phone. None of this proves anything, but it does make you a bit easier to track down in case you set up a phishing site.

By the way, if anyone's looking for a cheaper SSL cert than Verisign, I've recently been going with RapidSSLOnline, which is a reseller for RapidSSL, also known as GeoTrust, which is accepted by all modern browsers (which does NOT include Netscape 4, or anything with a CA bundle stolen from Netscape 4).

As Kaminsky points out, they verify your identity by... relying on DNS. Specifically, they send e-mail to a common address at your domain (root@example.com, webmaster@example.com, etc.) or a contact address listed in whois (your choice). They also call you (at a phone number you provide) and record your voice, which doesn't really do anything except make it easier for the police to find you after you get caught, but if you're worried about that, you'll buy a pre-paid cell phone with cash. I noticed in the grocery store the other day that they're selling Visa gift cards, which you can buy with cash and then use as a debit card anywhere that takes Visa, without giving any ID to anyone.

Anyway, I'm not affiliated with RapidSSL/GeoTrust or RapidSSLOnline, but they're cheap and their certs work for me.

By the way, RapidSSL/GeoTrust also offers a FreeSSL cert which is valid for one month (and you get to skip the Visa gift card step, since you don't have to pay for it). Be aware that the FreeSSL cert is NOT valid for mail servers, although it works fine for HTTPS.

As soon as CACert improves its management system so it can pass Mozilla's auditing process, it can be included in Mozilla products. For now, you can use a free SSL certificate from StartSSL. You can also buy a cheap SSL certificate from RapidSSL Online that is recognized by all popular browsers.

Don't buy from GoDaddy. There are better and cheaper alternatives.

$14.95 - http://www.rapidsslonline.com/rapidssl-certificates.php

And unlike godaddy that on is not a chained cert.

The real problem is https not http - you don't get the host header until well after you had to present a certificate to the browser.

Except that isn't exactly 100% true, either. This flies in the face of years and years of conventional wisdom, but I'm already doing it! You can host any number of SSL sites at *different* domains using the same certificate, with certain limitations, if it's set up correctly. I host nearly a hundred websites at the same IP address with different domains, without errors in common browsers. (Firefox, IE, Safari, Opera)

This trick is accomplished with wildcard SSL certificates! As you can see, Prices aren't even all that unreasonable. All it is is a certificate that wildcards subdomains. EG: *.mydomain.com instead of "secure.mydomain.com".

So technically, if you could get one of the "approved" certificate providers to make a wildcard DNS for *.com, SSL could be applied to any number of SSL websites on the same server, and you could host every single .com website with SSL support on a single IP address. (if you could come up with a server or cluster that could handle the load, that is)

This fact might be viewed by some as a *MASSIVE* security hole. Imagine being unable to trust *any* SSL website certificates!?!?

The problem is the limit of root domains: .com, .org, .net, .gov, .biz, the 2-letter countries, and a few others. This creates an artificial chokepoint with limited numbers of root domains.

But we may soon see an end to this, since ICANN has been making noises about unlimited TLDs. Really, there's no reason to have limited TLDs, when you think about it - even technically. This doesn't completely answer the question/issue of SSL certificates and domain names, but it sure does reduce the problem, and in fact, would improve security!