Choosing an SSL Provider?

An anonymous reader writes "I have recently been tasked with switching our SSL certificate provider and it's proving not to be easy. We use an internal authority for our own stuff and then we buy certificates to protect outward-facing sites (a lot of them). My question for this community is: How do you choose a certificate authority to use? There is price, service (why we're leaving our last vendor), warranty, and products offered as the only differentiators I can find. Is there any public resource that would show me actual customer reviews of CAs like Verisign, GeoTrust, Comodo, Trustwave, and DigiCert? Our last vendor did a really poor job with support and I would like to make a reasonably educated decision."

Comments

RapidSSL is your friend

[teknopurge]

They have cheap 128-bit cert that have Root in almost all browsers. The only issue we have run into is windows mobile devices.

If you're just after a basic root cert, RapidSSL(Equifax) is your best bet. If you need the stronger, blood-of-your-first-born cert, Verisign is the place to go.

Regards,

Re:RapidSSL is your friend

[TechyImmigrant]

>They have cheap 128-bit cert that have Root in almost all browsers.

Usually they are 1024 bit RSA with SHA-1 signing (80 bit). These are deprecated by NIST for use past 2010.

MS don't support SHA-256 signatures in XP, until SP3, which explains some of the delay in rolling out stronger roots.

Re:RapidSSL is your friend

[ObsessiveMathsFreak]

If you need the stronger, blood-of-your-first-born cert, Verisign is the place to go.

Knowing Verisign, they'll probably want that blood eventually.

Re:RapidSSL is your friend

[Anonymous Coward]

Stay with the "major" SSL vendors if you care at all about mobile devices.

We started using one from Comodo. Then we found that most cell phone browsers (i.e. those on consumer phones by Motorola, Nokia, LG, Samsung) don't recognize it. And there is no way for the end user to install another certificate authority on most of these devices. So we ended up getting another cert from Thawte.

On the other hand, if you don't care about supporting mobile devices, then just go for the price.

Re:RapidSSL is your friend

[friherd]

I agree, RapidSSL is quite good. I've used it for over 3 years without any issues.

Re:RapidSSL is your friend

[mvdwege]

Nope. RapidSSL is a brandname of Geotrust (which in turn is a brandname of Equifax). Geotrust also offers QuickSSL Premium certs, which are signed with the standard Equifax Secure CA root certificate, which, to my knowledge, is distributed with all mobile devices currently on the market.

The pricing for QuickSSL Premium certs is not much different from the bigger vendors, but the service we've gotten so far from Geotrust is excellent, and their simple no-nonsense verification systems means we get to deploy certs within five minutes from submitting the CSR.

Full disclosure: I work for a Geotrust reseller. We picked them because we got fed up with our previous supplier.

Mart

Re:RapidSSL is your friend

[v(*_*)vvvv]

For mobile be very careful because it is completely device specific. Even with the same manufacturer and network, the root certs can differ.

Compatibility is relative to browser capability though, in that newer more powerful phones with better browsers will have more certs. So if you are building an app for a specific phone or group of phones, just pick the cheapest common denominator.

GeoTrust QuickSSL Premium would probably be the cheapest if compatible. Not to be mistaken with the normal non-premium cert.

Re:RapidSSL is your friend

[Anonymous Coward]

The "GeoTrust QuickSSL Premium" cert is only $85/year (if you Google around -- I'd give you a link but people may think I'm affiliated with the vendor :), and supports all sorts of mobile devices (including WinMo).

What sort of support do you need?

[TechyImmigrant]

How do you support a cert? They're pretty much set once delivered.

1) You make a cert request. Pay Money.
2) They verify your identity.
3) They sign your cert request and return it as a signed cert.

It's not like you can upgrade a v3 cert to v3.1.

Re:What sort of support do you need?

[mackil]

How do you support a cert? They're pretty much set once delivered. Typically that is true. However when we tried an EV-SSL chained certificate, it wouldn't recognize the trust chain and caused all sorts of problems. We tried dealing with the support people, but they were very unhelpful and would only deal with us over email. Since they appeared to be in the UK (and we in the US), it was very frustrating in dealing with them. In the end we gave up and went back to a root certificate.

Re:What sort of support do you need?

[Anonymous Coward]

If your product deployment is waiting on the authority to sign the cert(12-24 hours sometimes), then good support becomes desirable.

Re:What sort of support do you need?

[Anonymous Coward]

I guess he means support with installation and configuring the servers. Possibly actually creating the keys and csr's in the first place.

If that's the case you really shouldn't be looking at a certificate provider for this.

On the other hand, perhaps he means turnaround time after issuing a new CSR, that would definitely be a factor. We use digicert, and find them to be very nippy.

Re:What sort of support do you need?

[Albanach]

I've used several of the super cheap providers in recent years and all have delivered pretty much instantly via email after the telephone verification.

In the past I've dealt with Verisign and Thawte in the days where they wanted to see bank statements and such like - certificates then could take days or weeks to arrive. These days I'd only expect that to be the case with EV-SSl certs.

I'm not clear what the issue the original poster is having. All the providers I've used in recent years have provided detailed instructions to make the certificate request. Assuming it's Apache or IIS, it seems hard to see what could go wrong?

Do they need a large number of certs quickly - then maybe a wildcard certificate or a root certificate (and spending $$$) is what they need.

There's not enough detail in the summary to define the question that needs answering.

Re:What sort of support do you need?

[speculatrix]

Actually, most SSL providers barely check identity, relying on email only which is pretty crap to be honest. To rectify this they have introduced a new tighter specification ssl cert which of course costs more money, but since 95% of the public barely know what https means, it's all pretty pointless.

Re:What sort of support do you need?

[Ucklak]

12-24 hours sometimes! Damn, what the hell. I can get a browser recognized Certificate in minutes. I can make my own in seconds and they're ALL the same level of 'security'.

Re:What sort of support do you need?

[TechyImmigrant]

How do you support a cert? They're pretty much set once delivered. Typically that is true. However when we tried an EV-SSL chained certificate, it wouldn't recognize the trust chain and caused all sorts of problems. We tried dealing with the support people, but they were very unhelpful and would only deal with us over email. Since they appeared to be in the UK (and we in the US), it was very frustrating in dealing with them. In the end we gave up and went back to a root certificate. I have has customers having this problem. I only supply higher key strength certificates. Your problem was likely due to the higher key strengths and MAC sizes being unsupported by Windoes/IE. I can throw 2048 RSA, SHA256 cert at firefox and it will validate the chain, but IE will not.

It tends to get even messier if you have ECC certs.

Re:What sort of support do you need?

[JWSmythe]

That's what I was wondering.

    I saw a reply to you, where they were talking about the chain cert. As long as you're not chaining, it's a piece of cake.

    I've helped a few people with their chained certs. Sometimes THAT is a pain, because sometimes you have to BEG for the intermediary cert.

    I've been buying cheap certs for years for a few things I do. Give the credit card, the drop an email to something resembling administrative at your domain, and then you get the cert.

    There was some mention about mobile devices. No one has mentioned if they do or don't work to me.

    I just tried my largest site from my blackberry. I got the message:

"The server certificate is not trusted by your handheld. Would you like to continue with the connection, close the connection, or view the certificate for more information?"
[Continue]
[Close]
[View Cert]
[Don't ask again]

    In viewing my cert, it says:

x freeinternetpress.com
* ntrusted Cert Chain
*Unkonwn Chain Status
Revocation Status: Unknown
Trust Status: Not Trusted
Expiration Date: Wed, Nov 19, 2008 11:41:17
Certificate Type: X509
Public Key Type: RSA 1024
Subject: freeinternetpress.com
OU=380674343
OU=See www.rapidssl.com/resources/cps (c)07
OU=Domain Control Validated - RapidSSL(R)
O=freeinternetpress.com
C=NA
CN=Equifax Secure Global eBusiness CA-1
O=Equifax Secure Inc.
C=US
Serial Number: 06FC DB

ok, that's enough typing. :) Really, people aren't doing ecommerce items from their phone. I get annoyed having to type more than 3 or 4 characters. People get short emails from me on the phone, and long ones from a mail client.

For the news site, SSL is for protecting the logins, submitting news, etc.. If the users want to go secure, they're given the option. Most of the users never do though.

Re:What sort of support do you need?

[jea6]

Not exactly. They all may provide a similar level of encryption but encryption != security. There are other factors that contribute to the "level of security" (what I'd call assurance) that different certificate vendors or sources can provide.

Re:What sort of support do you need?

[robertss]

Exactly! There is a lot of confusion about what the real purpose of SSL Certificates is. Most people think they are good for encryption and therefore a domain validated certificate, issued within a few minutes, is all you need. This is true in many cases (internal server, mail server, etc...)

However, a public site (e.g. e-commerce) that is trying to gain visitors trust requires more than just a domain validated certificate, even if it gets rids of all the error messages. Though some people consider them solely a money-making tool for VeriSign, there are several studies that show that EV SSL Certificates actually work to increase conversion rates: http://www.sslshopper.com/article-verisign-secured-seal-increases-sales-by-31.html

Support?

[jrumney]

What sort of support are you expecting for a certificate? Installation support should be available from the vendor of your servers. Was it renewal or revocation you had problems with? Renewal means more money for the CA, so it should just be a matter of phoning their sales team, they'll fall over themselves to provide you with service if you have a large number of certificates to renew. Revocation - I'm not sure enough customers will have had to deal with that to get enough feedback to make a judgement.

Re:Support?

[TechyImmigrant]

... Revocation - I'm not sure enough customers will have had to deal with that to get enough feedback to make a judgement. I run a small CA for a particular technology. My advice to the manufacturers obtaining certs is "Don't compromise your keys!". Revocation is painful.

Depends on priorities

[morgan_greywolf]

What are your priorities?

It sounds like service is pretty high up on the list. What about price?

There is everything from CACert.org, which offers free certs, but supported is limited to the community it serves, to budget providers to full-service providers like Verisign.

Do you need more than just a few certificates? Do you need someone to be available 24x7 for phone support or is e-mail support good enough? What do you need?

Like anything else in life, you decide based on what your needs are and how well that, in this case, a particular CA fits your needs.

Re:Depends on priorities

[crush]

Except that's a pretty good community and is more clueful and ethical than many of the for-money providers. The problem with CAcert is not on the support end, it's the fact that their root certificate is not distributed with current browsers. Each potential verificant would have to import their cert manually. Supposedly that's changing slowly with the Mozilla Foundation spelling out exactly what the audit process is to allow the inclusion of CAcert. We can but wait and hope. Personally I'd rather have community support for something like this.

Re:Depends on priorities

[Anonymous Coward]

I wouldn't call Verisign Full Service. I followed the instructions on their site to apply their cert to a RHEL5 server and the instructions were wrong. The 4th solution they sent finally worked.

Impression

[esocid]

I was under the impression that SSL providers had a hold on the "market" and didn't really need to provide that good support, but that is coming from someone who has never had to deal with that side of it. Here is an aggregation of a bunch of providers though, beware it's an ugly page.

Re:Impression

[mendax]

They do indeed have a hold on the market... in that the big guys listed in the question have their certificates in the main key store files of your browse, Java runtime installations, etc. which guarantees that they are trusted and cause the least amount of hassle.

I've thought for a long time that the answer to this problem is competition. What bugs me is why government hasn't gotten into the act. The purpose of an SSL certificate is to verify that the entity who owns the server you're communicating with is who they say they are. This is the role of a notary, a private individual who is commissioned by the government to verify that people are who they say they are when documents are signed. Sounds like a profit-making enterprise to me.

Re:Impression

[esocid]

I don't think getting the govt in on it would be a good idea. You'd then have people pandering to politicians and we'd end up with Diebold offering SSLs. Competition is still operating since I've seen multiple SSL providers on different sites, but Verisign is without question the top dog, whether that's due to it's solid performance or the hold it has, or both, but at least there's multiple alternatives if you aren't satisfied with who you have currently. Somehow I can't see that existing to such an extent with govt regulation.

Re:Impression

[Anonymous Coward]

No, they don't actually have their certs in MY browsers. The only certs that are in my browser are the ones I save. All of the inital certificate authorities' certs that came with have been removed.

Re:Impression

[jimmypw]

Really now, Whats the point in that? Surely thats just more inconveniance for yourself at the end of the day as your ultimatly going to re save a few that were already in there. Think hard about it.. your exposing yourself to more risk as the certificate that your saving could have come from an intercepted connection.

Re:Impression

[dekemoose]

Well la-dee freakin' dah, good for you.

Re:Impression

[Anonymous Coward]

I do save individual certificates for sites I expect to return to. This actually does more to alert me if I accidentally go to the wrong site, since I will get an unexpected notice about the unknown certificate.
I have no special trust relationship with Verisign or other CA provider and their signature doesn't tell me that I am really at the site I think I am.
The current way browsers warn about certificates seems to be more geared toward scaring people away from sites that don't pay protection money, rather than being actually designed to help people not be tricked into dealing with someone they didn't intend to.

Re:Impression

[Anonymous Coward]

I've often wondered what kind of security verisign and co have to secure their private keys. I've heard stories about PCs kept off in a secure vault under 24-hr armed guard until a new key needed to be generated. Obtaining such a key could potentially reap massive profits in the hands of an advasary.

The problem with browser certificates is that there are soo many providers nowadays and it just takes one not to care or to be lazy or stupid to bring down the entire house of cards. Trust is great but as the circle grows and encompasses everything how trustworthy can the system as a whole really be even assuming a high level of vigilance?

People pay a lot of money for SSL certs -- every time I see a provider advertising instant verification it really really pisses me off.

Remember that even verisign messed up certificate allocations to Microsoft...

Tools -> Internet Options -> Content -> Certificates -> Untrusted Publishers

SSL

[mackil]

We've used Geotrust since the beginning and have never had a problem. They are a bit more expensive than others, but we'll take the hit there for the good support.

There was one year where we wanted to try the EV-SSL. We decided to go cheap and went with Comodo. Big mistake. It didn't work, and after dealing 2 weeks with the support people there, we gave up and went back to Geotrust. They would only talk to us via email and were generally very unhelpful. I'm not saying that is what everyone experiences, I'm simply stating our own.

Re:SSL

[travisd]

...and of course GeoTrust is now owned by Verisign.

We used them as well. Price was the main thing - we did a "bulk" type plan since we were trying to get a hold on all of our rogue cert purchasers. We also got a decent portal out of them to expedite certs for any pre-vetted domain.

Re:SSL

[mackil]

...and of course GeoTrust is now owned by Verisign. Actually that is why we tried Comodo in the first place, in not wanting to fill the pockets of Verisign. Unfortunately it didn't work out.

Re:SSL

[Anonymous Coward]

Not to be a grammar police, but your use of "They" right after "...went back to Geotrust" relays exactly what you didn't mean, I do believe.

Re:SSL

[ComodoSupport]

I am the Support supervisor for Comodo CA Ltd. I'd like to first of all offer my apology for the bad experience you had with us. I'd also like to find out in more detail exactly where we went wrong in your particular situation and if there is anything we can do to make it up to you. I'll send you a direct email as well.

Rapid SSL Wildcard

[Kagato]

Go with a Rapid SSL wildcard cert. It will take care of most external needs with a single cert. They have a self service model that works pretty well. Cost is very reasonable.

Re:Rapid SSL Wildcard

[raju1kabir]

In theory you are not allowed to use the RapidSSL wildcard cert on more than one server unless you pay for additional licenses. Being cheap, we get around that by using a single front-facing server to proxy all the SSL requests for all our other web servers, but that may not work or organisations that have servers scattered around or have high SSL load.

Re:Rapid SSL Wildcard

[Anonymous Coward]

Where is the specification for this wildcard thing? I investigated this a little while ago and couldn't find anything, and therefore am not prepared to invest in something based solely on vendors' claims of "works in X% of browsers".

Buy a real SSL cert, with location info

[Animats]

Buy a real SSL cert, one with "Location" (L field) information and a real business name (not a domain name) in the "Organization" (O field). Avoid those cheap "Instant SSL" "Domain Control Only Validated" certs.

At SiteTruth, we consider the low-end certs worthless. They don't provide any information about who you're dealing with. We encourage other developers of certificate-validation software to take a similar position. You don't want to input a credit card number to a site with a "domain control only validated" certificate. "Domain control only" validated certs are enough for logging into a blog, perhaps, but not more than that.

Re:Buy a real SSL cert, with location info

[pyite]

Are you also amongst the group of people that think Extended Validation certificates are anything more than something to make Verisign more money?

Re:Buy a real SSL cert, with location info

[vux984]

I thought the main point of a SSL cert for most people was session encryption.

And the main reason we pay for one is so we get one the browser recognizes without throwing up a prompt about unrecognized certs that might be off-putting to a customer.

How many site visitors really look at the cert? Or care whether its got an company name or more. How many even KNOW there are different levels of cert? For most either the 'lock icon' is there or its not. They don't -check- the cert, or even know how?

Re:Buy a real SSL cert, with location info

[Anonymous Coward]

To an end user there are three types of SSL certs:

those that error,
those which display a padlock
and those which make the address bar go green in their crappy browser.

Re:Buy a real SSL cert, with location info

[tepples]

I thought the main point of a SSL cert for most people was session encryption. And the main point of an SSL cert that isn't self-signed is to keep ISPs between the browser and the server from acting as a man in the middle and intercepting all communication. If you have some other reasonably secure infrastructure for distributing software to your customers, your company can distribute its own root cert for customers to install, leaving VeriSign and all the CAs it has acquired out of the loop.

Re:Buy a real SSL cert, with location info

[jroysdon]

I found SiteTruth's search worthless. I put in my own domain and it said it was suspect, no address listed on the website. Totally bogus information. One of the first links is to the AUP page, which contains the same address WHOIS has listed. Even if I search giving the AUP link, it cannot find the address. Further, it says no usable certification info - I could see it complain that it doesn't like my CA, but there cert works just fine in any non-Microsoft browser. I find this site worthless as it fails to provide valid information. I could see it complaining that my SSL cert (free for non-commercial, personal use) is a domain-only, but it doesn't, it just says, "No valid cert." Finally, just because something doesn't have a valid business behind it (as in a personal website/email hosting), doesn't mean it is invalid or worthless. Don't give me your money - I'm not asking for it.

Re:Buy a real SSL cert, with location info

[caluml]

I thought the main point of a SSL cert for most people was session encryption. Don't forget about identifying the server at the other end. No point having ultra-mega-good encryption if it's with a MiTM.

Re:Buy a real SSL cert, with location info

[CalvinTheBold]

I think you may be a little mixed up.

The point of the encryption is transport layer security and privacy. The point of the certificate is TRUST. Having an encrypted session makes no difference if you are communicating with an impostor.

The prompt about unrecognized certs certainly SHOULD off-put the customer; it's likely to be that customer's only warning that the party on the other end of the connection isn't who it claims to be.

Re:Buy a real SSL cert, with location info

[Anonymous Coward]

If there's an unbroken chain of trust between a certificate vendors certificates and a root certificate installed into (most) modern browsers, what is the problem?

Re:Buy a real SSL cert, with location info

[Anonymous Coward]

Well, no one has ever heard of SiteTruth, so, what you consider worthless is really inconsequential.

From the average consumer's eyes, that little lock in the corner is what matters. It ensures a nebulous sense of security, and little other differentiation can be expected from the average user. IMO, levels of identity verification and encryption should be abstracted and seperately communicated to the user through the browser. Extended Validation, also known as the VeriSign Stupidity Tax, or Clueless CTO Tax, isn't the answer.

Also, for a blog, why pay for a cert? Use a self-signed one instead.

Re:Buy a real SSL cert, with location info

[tinkerghost]

I thought the main point of a SSL cert for most people was session encryption.

Depends entirely on the reason you're putting together a cert. Cert's on web services are much more than just for encryption, they are the primary means of secure verification. Verizon, for instance, will only accept Verisign Certs for their automated repair services and the cert information has to match what was sent to Verizon in the setup process.

Re:Buy a real SSL cert, with location info

[vux984]

I think you may be a little mixed up.

No. Think soley in terms of the average web user.

The point of the encryption is transport layer security and privacy.

Right. And that's what the average user is interested in when they see 'secure login', the lock icon, or the https prefix. I don't think most users even know that https is guaranteeing WHO they are talking to at all.

The point of the certificate is TRUST. Having an encrypted session makes no difference if you are communicating with an impostor.

That's true. But beside the point. From an engineering perspective, yes, the reason for the cert is trust, and the signing chain to root CA's etc establish a chain of trust.

But in practical terms, the average user doesn't have the foggiest idea what this all means.

So as a website developer looking to satisfy customers demands, I might want to provide seamless encryption which the customer understands and wants; so I need an SSL cert because the browsers don't support seamless encryption without one. And the customer gets what they demand.

They also get some 'trust', but its a side effect of the good engineering that went into the system. The customer doesn't actually -check- the cert and verify who they are talking to. And if someone sent them a fishing email pointing at 'bankotamerica.com' instead of 'bankofamerica.com' as long as bankotamerica.com has at least a domain only cert that their browser accepts, and their lock icon comes on, they'd be satisified.

Re:Buy a real SSL cert, with location info

[TheLink]

Wrong. The main point of an SSL cert that's by one of those CAs is for the very reason he said:

So _public_ users don't get a pop up prompt.

Nobody really gives a damn about the "other stuff" (e.g. real security, and even if users get a pop up, more than half the time they'll just click through ;) ).

After all when CAs like Verisign issue "Microsoft" certs to nonmicrosoft people[1], and lots of sites still use Verisign (who are already known for _intentionally_ doing very dubious stuff), where's the security?

If you actually want security you're better off deleting most CA root certs and stick to getting the browser to recognize certs for sites that you really trust on a per site basis.

You shouldn't be depending on CAs that don't really care. Because some random CA will sign some cert they shouldn't and then you're screwed since your browser has their cert built in, and so you don't get a prompt when you get MITM'ed at some WiFi + Latte place. Instead of your bank site, you end up passing your credentials to some hacker.

Whereas if you recognized the bank site just because of the bank's usual cert, and not because some evil/incompetent CA signed it, if a hacker presents a different cert, you will get a prompt. Naturally when the cert expires you get a prompt, but that's really not a big deal in practice.

[1] http://www.microsoft.com/technet/security/bulletin/MS01-017.mspx

Re:Buy a real SSL cert, with location info

[Bill, Shooter of Bul]

Well, that depends upon whether or not you want me as a customer. I look at the cert. Will not buy anything from a site with a CA, I don't trust. I might not make a dent in your sales, but I am often asked to recommend sites for friends, family, non for profits, and small businesses.

Re:Buy a real SSL cert, with location info

[Albanach]

I certainly do - my first SSL cert from Thawte cost a fraction of the $900 an EV SSL certificate costs from them, and required utility bills, bank statements etc to verify my identity.

Identity can, and has, been validated in the same fashion as EV-SSL certificates for a fraction of the price in the past. If they wanted to establish identity they could, and for less than an EV-SSL cert costs at present.

Re:Buy a real SSL cert, with location info

[Metasquares]

Firefox 3 accentuated the distinction between self-signed and CA certificates in the browser quite a bit. Now you get this "error page" that forces you to add an exception for self-signed certs before it will let you view the page. I guess they did it to combat certain types of phishing.

Re:Buy a real SSL cert, with location info

[firewrought]

At SiteTruth, we consider the low-end certs worthless.

But the self-signed cert you have for your own domain is laudable? Sheesh... it's even expired, not that you'd know since your "site verification site" doesn't even take the most basic precaution of defaulting to https.

Re:Buy a real SSL cert, with location info

[Animats]

That site has the address only on the "AUP" page, an unlikely place for a user to look for it. SiteTruth checked the "Contact" page, and didn't find it there. We look at about forty keywords ("contact", "about", "office", "address", "site map", etc.) likely to lead to an address, much as a user would.

The site does have an SSL certificate, but it's from StartCom, a relatively new root certificate authority, and we don't have them listed as a valid root CA. Now that Firefox is accepting them, we should start; we generally use the same root CA set as Firefox, but only update once a year or so. Many browsers won't recognize StartCom certs yet, either.

Re:Buy a real SSL cert, with location info

[Burz]

Yes, simply verifying the domain name when looking for the lock icon would fix the problem. Except that most people IMO don't even look for the lock.

And us techies are to blame for not educating users on using https to begin with. When I ask techs whether they instruct/remind people about https, they write the users off as too stupid... but when I ask when was the last time they tried, the answer is 'I just don't' or 'don't remember' which I uncharitably interpret as NEVER.

Sadly, most techs (incl. CNEs and such) don't even know how to use https in a web browser. Techies culture has a serious problem that must be fixed if we don't want the net to be handed over to authoritarian control.

Re:Buy a real SSL cert, with location info

[Burz]

And are you going to tell them the key to using it properly, to check the domain spelling??

What's that? "...no??"

Re:Buy a real SSL cert, with location info

[Animats]

Updated the root CA file on the SiteTruth servers to the Mozilla version of April 7, 2008. SiteTruth will now recognize StartCom-issued certs.

Now we get:

This certificate identifies the domain only, not the actual business.

Domain www.roysdon.net

• emailAddress=webmaster@roysdon.net
• CN=www.roysdon.net
• OU=Domain validated only
• OU=StartCom Free Certificate Member
• O=roysdon.net
• L=Turlock
• ST=California
• C=US

It's one of those low-rent "domain validated only" certs.

Re:Buy a real SSL cert, with location info

[Burz]

I agree. Its a stupid service founded on a misconception of what https is supposed to offer.

Https verifies the domain-based, Internet 'who' which is the important (and the most semantically verifiable) aspect of server's identity. Real-world addresses are actually more ambiguous and wouldn't matter anyway unless you have a penchant for entering sensitive info on sites you've never heard of before.

Re:Buy a real SSL cert, with location info

[lthown]

I literally laughed out loud. Good summary.

Re:Buy a real SSL cert, with location info

[vux984]

Well, that depends upon whether or not you want me as a customer. I look at the cert. Will not buy anything from a site with a CA, I don't trust. I might not make a dent in your sales, but I am often asked to recommend sites for friends, family, non for profits, and small businesses.

End of the day, the cost of losing you and your referrals isn't likely to cover the annual cost of the 'better' cert.

Come back when you've educated enough people that it matters. Better still educate so many people, that domain-only certs go the way of the do-do and the economies of scale drive down the price of better certs...

Win-win for everyone then.

Re:Buy a real SSL cert, with location info

[TechyImmigrant]

I certainly do - my first SSL cert from Thawte cost a fraction of the $900 an EV SSL certificate costs from them, and required utility bills, bank statements etc to verify my identity.

Identity can, and has, been validated in the same fashion as EV-SSL certificates for a fraction of the price in the past. If they wanted to establish identity they could, and for less than an EV-SSL cert costs at present. In other areas of business, certificates of higher cryptographic strength go for less than $0.04 a cert in bulk. The processing time for a signing system using a modern processor and a HSM is less than 1 second. To maintain the old prices is daylight robbery.

Re:Buy a real SSL cert, with location info

[silas_moeckel]

Funny I can do EV certs as a reseller and pretty much anybody with a D&B number and federal tax ID can become a reseller. So besides paying more money for the cert what is it really saying? SSL certs used to confer the same level of reputation and that got watered down via pricing wars now were up for yet another round of the same. Add some DNS hijacking and you can spoof just about any site with a valid SSL cert with all the ev goodness desired. SSL is good at securing a link between two hosts because thats what it's technically good for. The add on business bits about validating the identity of those hosts breaks when business gets involved since insurance is cheaper than validation.

Re:Buy a real SSL cert, with location info

[pabs]

IE7 is also much more obnoxious if it can't validate a certificate. It's slightly easier to skip through than Firefox 3, though.

Re:Buy a real SSL cert, with location info

[mvdwege]

You know what? All those paperwork hoops CAs make you jump through are useless. The cert only verifies the identity of the server, none of that paperwork is reflected in the actual certificate itself. And your CA only has to take your word for it that all those papers belong to a legitimate business.

The paperwork is security theater, to justify the higher price. For the purpose of an SSL cert, to certify that a particular FQDN belongs to a particular server, domain-control checks are sufficient.

Mart

Re:Buy a real SSL cert, with location info

[jroysdon]

Low-rent as in free. Yup, it just verifies you're going to my domain/server, which is the only need, and just for family users accessing webmail.

So, I would say you should add a "yellow" caution "!" option, just as you have a yellow "?" option (instead of red stop, don't proceed) that says, "Verifies Domain-only, often used for personal-use, not owner of website - Don't trust for financial transactions".

The SSL cert is totally legit and there is nothing wrong with it and how it is being used. The personal website doesn't have anything to do with a business, so it is invalid to say the SSL cert doesn't verify something (business info) that cannot be verified (as it doesn't exist).

BTW, where does it get this info?
"Information from secondary sources
Commercial site."

Do you label all .net sites as commercial?

Giving false positives trains users to ignore your information.

Just my two cents, but thanks for updating your root CA.

I'll add the address to the contact page as well.

Re:Buy a real SSL cert, with location info

[schmiddy]

Don't feel bad. I just did a search for "sitetruth" on sitetruth.com, and it rates all of its own pages with a yellow question mark ("Site ownership identified but not verified").

I don't think anyone actually uses SiteTruth anyway.

Re:Buy a real SSL cert, with location info

[Animats]

If you add the address to the contact page, SiteTruth should pick it up in 30 days or so. The whole point of SiteTruth is to associate a business name and address with a web site. Any site that's even vaguely commercial should have a clearly visible business name and physical address. In some jurisdictions that's required by law. We're trying to make a dent in the "on the Internet, no one knows if you're a dog" problem. Which, after all, was what SSL certificates were originally supposed to be for - validation of the identity of the remote party.

The "commercial/non-commercial" distinction is hard. Yahoo R&D tried training a Bayesian spam filter to make that distinction, but it didn't work out too well and that was only deployed on the R&D site. We initially presume ".com", ".net", and ".biz", plus their country domain counterparts like ".co.uk", to be commercial, while ".org" and ".edu" are presumed noncommercial. An Open Directory listing in a suitable category can override this. Presence of ad links makes a site commercial.

The main use of SiteTruth is not the search engine front end; it's AdRater, which rates Google ads as they go by. SiteTruth is a technology demo, an alpha test, and a means for gathering information about Google advertisers (not users). So we like to get comments from knowledgeable people. More uses of the data are coming.

We're one of the few operations out there seriously trying to do something about all the junk sites on the web.

Re:Buy a real SSL cert, with location info

[StartCom]

StartCom has currently two CA root and the older one has been around for a while already. Speaking about the older one, Mozilla, Apple and KDE (most likely some others) ship them. The newer root which is now the default served from https://www.startssl.com/ is in Mozilla since last year and in Apple soon to come. Microsoft and Opera don't support the StartCom CA root for now. Concerning price vs. value ratio (if IE isn't of particular concern) StartCom offers domain validated certificate for free (Class 1) and upgrade to Class 2 for a small fee for identity and organization validation each. Class 2 allows for unlimited certificates (for the subscriber) and the combining of unlimited validated domains, sub domain names and wild cards within the same certificate or in different certificates.

Re:Buy a real SSL cert, with location info

[Anonymous Coward]

Buy a real SSL cert, one with "Location" (L field) information and a real business name (not a domain name) in the "Organization" (O field). Avoid those cheap "Instant SSL" "Domain Control Only Validated" certs.

At SiteTruth, we consider the low-end certs worthless.

Funny you say that. I support an ecommerce site that uses a cheap-o Godaddy SSL certificate with "Domain Control Validated".

After 300,000 individual sales, not once did anyone complain or comment on the SSL certificate.

Re:Buy a real SSL cert, with location info

[yabos]

I certainly think it's a huge rip off(EV certs)

If you look at Godaddy's middle cost cert it says:
Verifies domain name and domain name control, identity of requesting person or company, and authority to make request.

This is exactly the same as an EV cert except a browser will turn the address bar green if it detects the EV bit. They could easily do this with a regular SSL certificate that has more than just the domain name. If you're a CA you should be validating all the information put in by the customer and if you're signing it then the user should be able to assume the CA verified this information. I don't see what the whole point of the EV cert is except doubling profit for a single bit changed in the cert.

Re:Buy a real SSL cert, with location info

[Anonymous Coward]

The point of the SSL Certificate is point-to-point encryption AND trust. Most SSL certificates have real money behind them if there is an issue.

It depends on your needs but

[gerry_br]

I have had success with both OpenSRS and GoDaddy for SSL certs. OpenSRS will allow you to easily supply the needs of your customers. Never had a problem with using either. Also, what type of support do you need? My experience is you install them and they work, then you renew them/reinstall as needed. just mu $0.02

Re:It depends on your needs but

[witherstaff]

OpenSRS is a nice setup. When I was involved in the ISP and hosting world they were consistently well spoken of.

Simply use a lock favicon for your website

[Anonymous Coward]

Look at the "/." just before the http in your location bar. Just turn it into a lock icon for your website.

Re:Simply use a lock favicon for your website

[sakdoctor]

Mod parent up.

Seriously what a torrent of bullshit. Certs are encryption keys, and the rest is just marketing.
Users don't even care so long as there is a padlock on their browser. The danger of this "money can buy trust" idea is that it just leads to escalation. If a yellow padlock is all too common and can be bought for $5.99 then next you will need a green tick that proves among other things that the company has given at least $999 to verisign.

I rate the firefox invalid ssl cert warning as insightful, and the IE one as alarmist, bordering on mass hysteria.

Re:Simply use a lock favicon for your website

[sherriw]

Yes, thank you! The IE7 warning on shared certs has made a friend of mine's little online shop nearly unusable. It scares people off. But it's just a hobby shop and can't really afford the trouble of getting their own cert. The shared one comes free with their host, but is now useless. I emailed the IE7 team to complain and the official line was, if you are using a shared certificate, you must be a phisher. ARG!

Re:Simply use a lock favicon for your website

[Anonymous Coward]

There is something wrong if he can't afford the trouble of getting a Trustico.com resold rappidssl cert...

1 year for $14.95, and 5 years for $63.54

Only PIA is needing a dedicated IP for the virtual host. Heck I have SSL certs on my "play" personal servers now.

Re:Simply use a lock favicon for your website

[uberzip]

But Firefox 3's warning makes the average user think the site is broken as it looks too similar to a page not found error rather than giving a warning in a message box. Even one of my developers was confused by the Firefox 3 SSL warning because he didn't read the screen but just interpreted it to mean that the site was down. I think this and IE7 have alarmist reactions to certs. Consider that intercepting data traveling between client and server is not a common source of security breaches and is actually very difficult in most situations (where the user is hooked directly to their ISP). If company's understood this and read the news they'd realize that its much more worthwhile to worry about encrypting their databases and data stores rather than the connection to their clients. Every occurrence of stolen data that I can think of has not happened during the transmission of data but at the storage location. That's not to say that SSL certs are worthless, but its not something my company worries about as much as securing the data we have on site. We buy our cheap SSL certs and leave it at that.

Re:Simply use a lock favicon for your website

[toporok]

I use shared SSL with 1and1 and granted 1and1 sucks a big one when it comes to service or doing things like backup or informing that somebody hacked your site, deleted your content and uploaded some muslim terrorist propaganda site but in terms of ssl and dns, their service is pretty solid.

Re:Simply use a lock favicon for your website

[Sancho]

If they're using Apache, check out mod_gnutls. It supports SNI (Server Name Indication) meaning that your virtual hosts on the same IP can have different SSL certs.

Re:Simply use a lock favicon for your website

[uberzip]

I guess I should also point out that my use of SSL certs is just to secure data tranmission. I certainly see the use of them if you are running a commerce site and want to ensure people that you are a legit company. In that case the expensive certs are useful to a degree. For our company, we don't have any need to prove to the client that we are a legit company via ssl certs as there is already an established relationship. I have found it laughably bad in terms of how ssl certs are granted though. A few years ago we ordered some certs from verisign for a lot of $$$. All they wanted from us in order to prove that we were a legit company was a faxed letter on our company letterhead... not necessarily a deterrent for a scam artist. I could easily make up any letter head and send it along.

Re:Simply use a lock favicon for your website

[Anonymous Coward]

You forgot to say place a little green bar on the top of your page with an official looking logo that says "Super Secure Hacker Proof Site Guarantee"

I am telling you, 99% of web users wouldn't know the difference.

Re:Simply use a lock favicon for your website

[ceejayoz]

Oh geez, that's a good (nasty) idea...

Re:Simply use a lock favicon for your website

[Anonymous Coward]

I don't have an location bar with graphics support, you insensitive clod!

Re:Simply use a lock favicon for your website

[Kent Recal]

Count me in, parent and grandparent are dead-on.

I don't hate VeriSign because they have a license to print money.
I hate them because their boundless greed seriously damages all
our efforts to educate joe sixpack about what is a "secure website" and
what is not.

No kidding, they're charging a thousand bucks for a cert that turns
your address bar green in some browsers. What's next, $2000 for a purple address bar?
$3000 for color of my choice? $10000 for a .gif of the CEO's hairy butt?

VeriSign wants joe-sixpack to believe that "green addressbar" (or purple, or hairy)
means more trustworthy than "just the padlock". This is false education and completely
misses the point.

Malicious parties can get a "green adressbar"-cert just like your your bank can.
Yes, there are more hurdles and paperwork involved. Up to the point that a criminal
organization with the ressources to pull of and profit from a bank phishing
scam might indeed consider them "mildly annoying". No one in their right mind can
tell me that this green-bar-shenigan will bite enough into a scammer's bottom line
to put them out of the game.

No, the green-bar is not more than a scam of its own.
Designed for the sole purpose of paying the next Yacht for some VeriSign execs.

So how do we solve the real problem?

Remove the implicit trust for VeriSign and all other "certificate authorities" from the browser.
The browser should display a warning, along with the cert details, whenever I visit a SSL site for the first time.

It doesn't matter if the cert is signed by myself or by some external "authority"
who at one time in the past called up a possibly spoofed phone number and collected
money from a potentially stolen CC. Display the warning in both cases!

I'm connecting to a site that intends to establish trust with me for the first time.
Alert me of that fact. Tell me to double-check my addressbar, heck, display the full URL
directly in the popup window. Tell me that if this is a banking site then I should call
them up and ask for a fingerprint to verify against the cert. Tell me that if this site
pretends to be my banking site that I know I have previously used then I should be
especially suspicious and rather type in the URL manually again.

Then, when I have followed that procedure (or chose to not care and just click OK),
save the cert and don't nag me again in the future.

It all boils down to:
VerSign certs are not more trustworthy than self-signed certs.

Once you've realized that, the solution becomes painfully obvious...

Re:Simply use a lock favicon for your website

[MikeBabcock]

What we could do is go to a web of trust system where when you decide to sign off on your trust of a specific cert it goes into the public databases of said trust metrics so that eventually we have a system where you can see that 89% of people believe this is the real bankofamerica.com site and so on.

Re:Simply use a lock favicon for your website

[jonbryce]

But the purpose of the SSL certificate isn't really to stop interception of data en route. It is to tell you whether or not the site you are visiting really belongs to who they say it belongs to.

I get emails every other day trying to persuade me to that they are from Natwest Bank or Halifax Bank and I should visit their site to enter my security details. This is a major problem, and that's why we have these error pages.

Digicert all the way

[cryogenix]

If you want good support, go with Digicert. Absolutely phenomenal support. You don't go through hold queues to get to some person god knows where. Usually the person who picks up the phone is the one that helps you and they know what they are talking about. I've been extremely happy with them.

Re:Digicert all the way

[Anonymous Coward]

I haven't had to call DigiCert support yet, but can say that their wildcard cert is very cool. We switched from about 30-some Thawte certs to a single Digicert wildcard cert, and save about $4500/yr.

When I checked, I thought I found rapidssl's cert was 'licensed' for use on a single server, whereas digicert lets you use it anywhere.

Re:Digicert all the way

[snsh]

I work for a government agency that has been donating tons of money to Verisign for the past 10+ years. They were the only approved SSL vendor in our system, and we paid them top dollar for every new application server that went up. I think each cert cost us like $600 a year which is comparable to the cost of maintenance from Dell.

Finally we got Digicert in our purchasing system, and bought a wildcard cert for $400 a year. We can use it on any server, and more importantly, we can use it on every server - they're the only wildcard vendor I could find that licenses it to be used on unlimited servers concurrently. Digicert also offers invoice billing, which you need for government.

So we still have Verisign for EV on our payment server. They do have like 90% of the SSL market and they are the brand leader (not as many people recognize Godaddy, Comodo, or Entrust). And they're the only vendor that seems to have an EV plugin for Firefox v2. But for all else, Digicert wildcard is what we'll use.

Re:Digicert all the way

[Anonymous Coward]

We had issues with mobile phones not liking the wildcard certs. That was an issue with our mail server. Because we had purchased a wildcard cert, the digicert tech generated me a named one specifically for the mail server at no additional charge which fixed the issue. Again, top notch support.

Re:Digicert all the way

[cryogenix]

I could have phrased that better (and logged in first). The issue was not with the mail server software. The issue was we were using the wildcard certificate with the mail server for a mobile webmail interface and various mobile browsers such as blazer would constant generate certificate warnings.

Verisign has poor service

[Anonymous Coward]

We have dealt with verisign and had issues with their certs. The worse part is getting them to correct it. It can take WEEKs with them. All in all, I would recommend not going with them.

Your old provider

[hansamurai]

Since you're already anonymous, why not reveal who your crappy provider was so we know who to avoid?

Support?

[Anonymous Coward]

It's an SSL cert, not a new born child.

You purchase it for 3 years, install it, then forget for another 3 years. The website emails you a month before expiration, you rinse, and repeat as desired.

go with

[ZonkerWilliam]

Verisign, always used them for public cert's.

Comodo

[Anonymous Coward]

I've used Comodo for 5 years with great success. They are very fast (10 minutes) at reissuing certificates if I need to move to a new piece of hardware or server platform. I use the E-PKI Manager which allows me to get certs issued in just a couple of minutes. Now that they have switched over to the AddTrust/UTN User First root authorities the compatibility has improved over what it was 5 years ago.

Most of the vendors do not offer a good way to manage Digital IDs, but Comodo lets me order those as well.

The only difficulty I've had with them is ordering a Code Signing Certificate, the process is a little backwards but does work.

I currently have 4 SSL certs and about 15 DigitalIDs from them.

It's in the name

[Anonymous Coward]

Believe it or not a lot of people look at the CA when considering it's 'security'. Unfortunately, Verisign is like 'Kleenex' in the SSL game. It all depends on who your customer/audience is. What are the certs for? www?

SSL Shopper

[CSMatt]

SSL Shopper has a great list of SSL certificate providers and reviews, as well as the ability to compare different providers side by side using their SSL wizard.

Re:SSL Shopper

[perlith]

Nice link! Also keep in mind if your organization utilizes mobile devices, you need to verify if the mobile device has a built-in root certificate for that SSL provider. You really don't want to explain to your executives why their mobile devices aren't "just working"....

Re:SSL Shopper

[CSMatt]

Nice link! Thanks.

It used to be on Wikipedia, but it looks like someone removed it.

Re:SSL Shopper

[SirAuron]

Nice find! That is definitely going into my bookmarks.

It's a wash

[cusco]

The company I work at goes with Verisign, but that's only because Verisign is one of our customers. Unless your customers are financial houses or some equally paranoid group no one is going to give a rip where the certificate comes from as long as their browser automagically recognizes it. I've only met one person in my decade in IT who checks web site certificate validity (she works at a major investment firm) on a regular basis, and that's only because her job requires that she do so before transferring X-many millions of dollars.

Thawte

[NekoXP]

You can't go wrong with Thawte..

Re:Thawte

[grnrckt94]

I second the Thawte...

Re:Thawte

[Burz]

Thawte is now also owned by Verisign.

Re:Thawte

[Nikademus]

Honestly, I tried many many SSL providers. And Thawte is by far he one who has the best support (free instant chat) and work with most mobile devices. It's maybe more expensive than some others but I wouldn't go back because I never got any problem with them, which is something I couldn't say from others.

Re:Thawte

[Anonymous Coward]

Really? I've been waiting nearly a month for our Cert from Thawte and they've stopped replying to our support emails. They were quite happy to take our $1400 though.

Re:Thawte

[Anonymous Coward]

Thawte is a pretty decent trusted root. Decent price. Never tried their support. Only have a few certs with them.

Re:Thawte

[Anonymous Coward]

Was that irony?
If your certificate ever expires and you've forgotten to renew and need it done ASAP, you don't want to use thawte.

We use three different providers

[Anonymous Coward]

At my company, we use three different providers depending on the need.

Client Facing
We use Verisign for anything a client will interact with since we can use the Verisign Secured Seal on any web content on our site. Our studies have shown a percentage of our users actually know of the Versign secured logo and helps to assure them of the security.

Non-client Facing
We use Thawte certificates since these are much cheaper than Verisign, and are fully compatible with most browsers/mobile devices.

QA/Dev Servers
We use GoDaddy for internal/external tests and projects. They are cheap and quick, which makes them useful in a non production environment.

Re:We use three different providers

[Anonymous Coward]

Any reason you don't use your own internal CA for the internal websites?

Cheapest non-intermediate certs

[bastion_xx]

I've used VeriSign, Thawte (pre-VeriSign days) QuoVadis (for Bermuda companies), Comodo, GoDaddy, and RapidSSL (geotrust rebrand).

If I have a multi-million dollar e-Commerce site, I'd use an EV cert from a VeriSign or similar company. For the other 99.99999% of uses, it'll be the cheapest certificate that is signed by a trusted root in the IE, FF, and Safari browsers. Don't care if it's domain validation only, as long as it works.

RapidSSL has been good for price, root signing, and the wildcard certs work well to.

Friend ? Look at their conversion rates..

[Anonymous Coward]

.. $69 = 69 euro ? I don't think so ! Avoid like the plague...

Re:Friend ? Look at their conversion rates..

[teknopurge]

We pay $10/cert.

$$ vs requirements

[Anonymous Coward]

Choosing an SSL provider really depends on your requirements. If all that you need is a SSL cert for encrypted traffic and have no other corporate or audit requirements to adhear to, then almost any ssl provider with 99% browser compatibility will work. These certificates are usually in the $49-150 range. If you have to adhear to a policy, or if you want your "secured by xxxx" logo to be a well known name, then I would recommend Thawte. Others have recommended Verisign, but what most people do not realize is that Verisign and Thawte are the same company; and that you can purchase a Thawte SSL certificate for a little less than half of the price for the exact same thing.

https://www.thawte.com/ssl-digital-certificates/buy-ssl-certificates/?click=buyssl-buttonsleft
$699 one year

https://ssl-certificate-center.verisign.com/process/retail/product_selector;jsessionid=F682F047C9C50A9204F1B5A1F3971614?uid=d62acac0de1cbeb4b281f52d35982a1d&product=GHA002
$1,499 on year

Both certificates will pass all of the major security benchmarks (pci, hippa, iso20001, etc)

depends on devices...

[bentley79]

With more users accessing the web from mobile devices, certificate choice matters even more now. Motorola phones, for example, only have a verisign cert on them, so users will get annoying "untrusted site" warnings for sites with Equifax certs. Also, J2ME applications on these phones cannot connect to sites with non-verisign certs. This becomes a bigger problem for mashup java apps that try to access secure apis on multiple services. You end up greatly restricting how your service can be used if you go for a cheap, easy Equifax certificate.

Re:depends on devices...

[Ucklak]

Now ain't that a racket.
Still secure but because Verisign obviously has a hand in the mobile distribution market, no one else is 'secure'.
I see is as the losers are the Motorola users tied to Verisign only certs.

Godaddy. And, SSL use will increase.

[sherriw]

I used GoDaddy for the one standard cert I ever had to order and had no problems at all. My one complaint is that when I ordered it, their pricing was $19.99, it has now gone up to $29.99.

The cert auto renewed and I wasn't expecting that, but a ticket to their support center and I got it canceled and refunded. So pretty good service I think.

But watch out. The more that ISPs start filtering content, and the more that governments increase monitoring and censoring data on the web... you're going to see rising demand for SSL certs and rising instances of the, pay more money for a green url bar nonsense.

The SSL providers are trying to sell you on the idea that it's the cert that makes the site trustworthy. Meanwhile, all you really need the cert for is the encryption.

IE7 has succeeded in making shared certs utterly useless. Too bad for the little guy who was using the shared cert provided free from his hosting company, because you can no longer use it without an enormous frightening message from the browser.

Look for more of this to come.

Re:Godaddy. And, SSL use will increase.

[jmichaelg]

Meanwhile, all you really need the cert for is the encryption.

You need both the encryption and the knowledge that the site on the other end is the one you intended to converse with.

One without the other isn't worth much.

Re:Godaddy. And, SSL use will increase.

[barius]

I had a poor experience with GoDaddy support. I was forced to revoke a cert less than a year into a 2 year contract because our site was hax0red and they refused to refund or even give me another cert for the remaining time.

Granted it's a cheap cert, but they would have saved themselves money to have simply given me a new cert when I requested rather than keep running me in circles between their ra and billing depts for several days.

Re:Godaddy. And, SSL use will increase.

[Anonymous Coward]

http://nodaddy.com/

SSL Monopolies, SubCAs, PKI use, and supply/demand

[CarpetShark]

I could be wrong about this, but I think the problem is that PKI was intended to be much more hierarchical, like DNS.

In other words, I think the idea was probably that ISPs or other organisations would purchase bigISP.com certs, that allowed them to be certificate authorities too.

Then, an ISP's customers could go to THEM for certs. The customer's site cert would be signed by their CA; the ISP, and the ISP's in turn would be signed by the big names.

I think that does work. If so, then the problem is almost certainly that ISPs and such just don't buy those big certs, because so few people use SSL on their sites.

BUT... note that CA certs could be used much more widely than they are -- for email signing/encryption, server/client authentication in WANs, etc.

May I ask ...

[RKBA]

May I ask which vendor did a really poor job with support?

Re:May I ask ...

[Anonymous Coward]

The vendor was Verisign. And after reading some of these posts I think some clarity may help everyone. We have about 600 ssl certificates in geographically distributed data centers, with another 25,000 other types of internal certificates. You would not just go to CACert or RapidSSL for this. We need an API and Control Panel, Audit privileges, management tools etc.

Re:May I ask ...

[StartCom]

Look at this next time your contract expires, concerning at least for your internal sites: https://www.startssl.com/?app=5

Re:SSL Monopolies, SubCAs, PKI use, and supply/dem

[greed]

What you describe does work, though it gets annoying.

Basically, when your server negotiates SSL with the browser, it has to provide all the certificates in the trust chain that the browser doesn't have. So, bigISP.com has a certificate signing certificate from VeriSign, and signs a Web certificate for your company. Any time an SSL request comes in, your server has to present it's public certificate and the public certificate of bigISP.com's signing certificate. The browser already has VeriSign's public certificate signing certificate.

So, it's kind of like DNS resolution, where you have to "know" the root server, and then can build a chain down to get the actual name server to ask. But, in this case, you need a trust chain of signed certificates. With one or two layers, it's not _that_ big a deal...

The real downside is maintenance. Each layer has its own expiry, and you have to re-establish the chain whenever a certificate in it expires. That means new private certs and updating the public certs that are sent with the SSL transaction.

If, instead, your certificate is signed by a certificate for which there is a public key pre-loaded into the browser, you only have 1 certificate to update when it expires or when the signing certificate expires.

I use a self-signed certificate signing certificate for my home systems and for my department's SSL servers at work. But there's a very limited number of people who are supposed to access those servers, so they can be given the public signing certificate by hand. And even then, I wind up on vacation and unable to get to my IMAPS server because I forgot the signing certificate is going to expire on me....

So, keeping the chain short is actually worth-while, just from a maintenance perspective.

Speaking with some experience

[gimpyben]

I've ordered and installed hundreds of SSL certificates (usually one or two a week). We use GeoTrust for nearly all of our certificates and I have never had any sort of problems. Their turn-around time is very fast too, at least in comparison to VeriSign and Thawte. Probably the easiest thing you can do to ease the process of ordering certificates is to make sure your domain WHOIS info is up to date. But really, as long as you know what info you want to have on your cert, there isn't much to getting one ordered.

Anonymous Coward

[Anonymous Coward]

Check out http://www.securityspace.com/s_survey/sdata/200603/certca.html

The survey is about 2 year old.

StartCom - Free SSL

[k1e0x]

Not really for the OP but I wanted to mention StartCom if someone was looking for a free cert as opposed to a self signed one. http://www.startcom.org/

Godaddy

[StealthyRoid]

I've had reasonably good experiences with Godaddy, and as far as I know, they're one of the cheapest around. SSL cert signing is mostly just snake oil anyway. It's not like the company signing your cert for you has any impact on the actual security of your site, and I can't imagine that many customers look at the cert signer and go "RapidSSL? No way! Fuck those guys! I'm gonna go spend my money at some other dildo store". So, your best bet is to go with the cheapest one around that's likely to be in all the major browsers' trusted CA list.

Re:Godaddy

[im_rotting]

Though, Verisign is the Kleenex of SSL certificate signing.

Poor support or just PITA

[Geak]

I work for a web hosting provider. We do provide SSL certs which can be purchased on an annual basis and are easy enough to install. (Basically you subscribe to it and it's installed automagically for you). However, if you buy your own SSL cert things get more complicated - at least for us 1st level support types. We have to install the cert manually which can be a massive undertaking - especially if the customer doesn't understand how it works. This usually results in numerous emails back and forth with the customer because they don't provide the "EXACT" information they used to register the cert. Since certs are purchased annually, and some customers have a habit of jumping from one hosting provider to another every couple of months, this can add to the complication. My advice would be to find a web hosting provider that caters to your needs and stick with them. Purchase your SSL cert from them for minimal headache. You may end up paying a little more because you are going through a reseller instead of purchasing directly from the issuer but it's definately worth it.

Support Free Certs...

[actionbastard]

Become a member of CaCert.org http://www.cacert.org/.

Support their certificates and their root CA.

Advocate for support in OSS browsers like Firefox.

Tell everyone you know about CACert.

Certs want to be free like information (and beer, too).

Re:Support Free Certs...

[bunratty]

Certs being free information would completely invalidate their purpose. If you disagree, go ahead and send me your cert. You wouldn't mind me impersonating you, would you?

Thawteweft?

[Dareth]

What is this, some kind of Thawteweft? http://ww2.wizards.com/gatherer/CardDetails.aspx?&id=145799

NameCheap

[Anonymous Coward]

Check out NameCheap.com. They have cheap RapidSSL certs w/ GREAT customer service...100% guarantee. Had a cert not install that was our fault. We lost the key (doh!)...they refunded our original request, and then processed our new request, can't beat that! They have the normal various levels of encryption available. Never found a reason to waste money on Verisign. And no..I have no affiliation w/ them at all...I've just been using them for the past 4 or 5 years w/ 0 problems.

Verisign - my experience

[Zontar_Thing_From_Ve]

The company I work for uses Verisign. We can't really use self-generated certs or cheapish certs from companies nobody has heard of. We have to use certs from somebody who is a name vendor so our customers get those warm, fuzzy feelings that customers need to keep doing business with us. Verisign's customer support is very good. I had a relatively minor issue and they had it fixed within 1 minute of my call. I was shocked. Verisign is not cheap. SSL certs cost $399 for just the basic bare bones ones for 1 year. You'll pay more for more bells and whistles and the longer it lasts, the more you pay, but you do get a discounted price for multi-year renewals.

Thawte

[FreeBSD evangelist]

For what it's worth, we use Thawte and have never had a problem. Even let us re-roll a cert when (our error) we messed up the cert request.

Trivia: Thawte was founded by Mark Shuttleworth, the guy behind Ubuntu Linux.

Geotrust QuckSSL Premium

[unity100]

Cheap, all known, instant activation, and allows you to display a verified site seal on your site. nothing can beat it.

wildcard certs through digicert

[Anonymous Coward]

We've used digcert for a few months now and I am totally impressed for a few reasons.

1. Easy to use wildcard certs.
2. Instructions for all the different apps I would ever use them for.
3. Their support guys are awesome. I had some issues with using a cert for a web services project, and they spent about 45 minutes on the phone, even though it turned out to be a PEBKAC.

Mod parent UP please

[Burz]

The vendor was Verisign. And after reading some of these posts I think some clarity may help everyone. We have about 600 ssl certificates in geographically distributed data centers, with another 25,000 other types of internal certificates. You would not just go to CACert or RapidSSL for this. We need an API and Control Panel, Audit privileges, management tools etc.

Re:

[clint999]

Updated the root CA file on the SiteTruth servers to the Mozilla version of April 7, 2008. SiteTruth will now recognize StartCom-issued certs. Now we get: This certificate identifies the domain only, not the actual business. Domain www.roysdon.net ema

Cert to sign your own certs

[Anonymous Coward]

Is it possible to get a CSR signed from a CA in most browser CA lists which you can use to sign all your own certs, effectively becoming a CA yourself? Or does that defeat the purpose... cause it seems a lot cheaper. I'm kinda new with this...

CA Perspective

[Anonymous Coward]

Disclaimer: I work for a Certificate Authority.

1. You definitely want organizational validation on your cert. This is the process a CA follows to ensure you are who you say you are and without this, the identity part of the cert is meaningless. No way would I buy anything online from anyone that doesn't have organizational validation on their cert.

2. Although many people (myself included from a pure technical perspective) think that EV is primarily about new revenue streams, the browsers are all actively working to support it - as are the CA's. So the reality is that most people who do commerce on the internet should at least consider the long term impact of the green bar in the browser. In short, it will present consumers with a more obvious indication of whether a sites identity has been verified. http://en.wikipedia.org/wiki/Extended_Validation_Certificate

IE7 and FF3 will support it, so even if you don't like the idea, it may matter to your customers.

You may want to check that your selected CA at least supports EV (and has a valid EV root in IE7 and Firefox) so that you have the option to "upgrade".

3. Cost isn't everything, but it probably is something. Verisign is generally the most expensive, and is the "big name" that most people probably know best - but their product is essentially the same as anyone else's so long as they are distributed in "trusted roots" for major browsers. I.E. to have your certificate trusted in browsers they need to come from a source that Microsoft, Mozilla, etc. put a collection of "trusted" root certificates in their browser that make your browser "trust" others. If you're not trusted, you still get encryption but your users will not be able to be assured of your identify. I list some of the most common CA's below that are definitely "trusted".

4. You may or may not care about the warranty associated with a cert. In many cases, the price tag is directly tied to the warranty. I can't speak to the actual *value* of the warranty.

5. If you plan to buy a number of certs, you should reach out to the CA to see if they have bulk pricing.

6. Support does matter but I'm really not sure how to compare CA's other than anecdotal evidence. If you know how to install the cert, support matters less. In my experience, many people don't know - and in that case you'd want to understand whether you can get help from somewhere getting the cert you paid for working.

Some commonly seen and trusted CA's:
1. trustwave/securetrust
2. comodo
3. geotrust
4. verisign
5. thawte
(several of these are actually owned by verisign).

GoDaddy

[pyite69]

I've been happy with GoDaddy for two reasons:

1) Cheap ($30/year for one cert, $200/year for wildcard)

2) Super Bowl Spokesperson has huge tracts of land.

The drawback is that you need a CA cert - but if this is a problem then you should probably find a new line of work.

Correct me if I'm wrong...

[gnuASM]

...but doesn't obtaining a certificate from the CA require you to send them a copy of the private key? The purpose of the certificate is to ensure that your site is properly identified, and who it states to be. Excuse me, but don't I need absolute trust with the party I am doing business with in order to reveal ANY private key on my server? I don't know about you, but I absolutely do NOT trust any third parties with my business, let alone my customers' information, trends, activities, etc.

Encryption is not my cup of tea, but, as I understand it, is the CA and ISP in collaboration able to impersonate your site by redirecting it and falsifying validation? And barring that fact, with the ISP and CA in collaboration with a government agency, will they not be able to not only capture the encrypted data, but also DECRYPT it because they have a copy of your private key for the site?

Barring the ISP's involvement, wouldn't "spying" on the backbone itself be good enough, with the CAs collaborating, to decrypt ANY and ALL encrypted data that traverses this country's networks?

The dissemination of a private key of ANY kind is what has kept me from using ANY CA at all.

Now, correct me if I'm wrong, but isn't that the power you give the CA when you send your Certificate Request in?

Re:Correct me if I'm wrong...

[ElizabethGreene]

No, you are mistaken. The CA signs YOUR public key with THEIR private key, and sends it back to you.

You send the client your public key, and encrypt traffic with your private key for them to decrypt with your public key...

Before decrypting, the client checks your public key against the CA to see if your public key is correct and valid, and for the domain they requested.

Your private key is yours and yours alone, if you give it away, you've given out the keys to the store.

-ellie

Re:Correct me if I'm wrong...

[RazzleDazzle]

Ok, you are wrong. You never ever send your private key to anyone. Period. When you request a CA to sign a certificate to you they need a CSR (certificate signing request) from you. This is basically your public key and some tidbits of info about you or your intended use (like domain name, company name, etc). I believe the entire CSR is then signed with the private key but you never ever send the private key to anyone. Ever. Not sure if this should be repeated one more time but just in case: you never ever give your private key to anyone, especially that BOFH.

Re:Correct me if I'm wrong...

[fishtop records]

You are wrong. You generate your request, which has your public key. You keep your private key private

Re:SSL Monopolies, SubCAs, PKI use, and supply/dem

[ElizabethGreene]

Your assertion is correct, the original intent was to have a hierarchy of SSL providers like DNS. In practice the cost of becoming a dns registrar was relatively inexpensive. As I understand it, the cost of obtaining a key signing certificate from an existing CA is extremely high, if you can get one at all.* This is the reason that companies like GoDaddy find it easier to acquire a defunct SSL provider with a widely accepted Root certificate. * The cause for this is simple to deduce. It would be illogical for a company (Verisign) to sell the required materials for operation to a primary competitor.

you can get geotrust certificates for less

[Max4400]

my web host (cphosting.com) provided me Geotrust quick ssl certificate for just $49 / year which geotrust sells for more then $169 / year. I researched on net and found companies like namecheap.com, theplanet.com are selling geotrust certificates for much lower price then geotrust own web site. So make sure you get certificate from your web host and show them competition web sites to match the price.

Entrust

[m0e]

I'm surprised few have mentioned Entrust.

They've been around about 11 years and have been rather superb for us. We switched to them from using Verisign because it seemed like paying almost a grand a year for a 128/256 validated cert was absolutely ridiculous. Entrust has just as much browser and application (e.g. JBoss) exposure as Verisign and their certs are only $159-199/yr (depending on how many certs you purchase). EV certs are considerably cheaper as well.

Granted it takes them a few business days for the first cert you order, subsequent orders seem to have a turnaround time of 24 hrs.

They work for us, they're relatively cheap, and they don't require chained certificates like some of the cheaper CAs that have popped up over the past few years. As always, do your research and compare the CAs once you've whittled down the short list. :)

Many "commercial CA" are the same

[fishtop records]

I love the information on the vendors' sites. Its opague. Thawte, GeoTrust and Verisign are the same, Verisigh bought them. They claim to be different, use different logos, root CAs, etc. but they are really the same company. I did this same search a few months back and ended up buying a wildcard cert from GeoTrust. It does not do good mobile phone 'presigning" but other than that, they work fine

RapidSSL are the way to go

[jackd]

Have purchased hundreds of Geotrust/Equifax RapidSSL certificates over the years, in the past couple only from their reseller servertastic.com. Dirt cheap, quick automated purchasing process and works across all browsers, except some mobile devices like a Motorola Q9 I played with the other day.

Comodo InstantSSL for me

[Anonymous Coward]

I've been happy with Comodo's InstantSSL. But you can find cheaper certs from Comodo.

Their InstantSSL (for me) was a nice balance between no-business-validation junk and overpriced-ev-certs.

Support, when I needed it, was fantastic. I basically called them the day my cert expired (oops), and they helped renew it ASAP by validating my company while I was on the phone.
They even helped me figure out a way to pay them using my company's Paypal account because I was out of town at the time (and their website didn't provide Paypal as an option.) And all that hassle was for a cert for under $100 total, but now they have a happy customer willing to recommend them.

SSL Certificate Authority Options

[Anonymous Coward]

Here's a document I wrote on just this subject

http://lackof.org/taggart/hacking/certs/

Comodo is Nice

[Blackknight]

To quote one of my former coworkers, we use Comodo, like the dragon. Their prices are decent and every time I've dealt with their support they've been responsive and helpful.

A cert, is a cert, is a cert

[Anonymous Coward]

Just make sure the company is included in all browsers, then look for price and finally if needed the supplementals. I work for a large retail chain and we have a public facing site with an Extended Validation certificate - gives the customers the warm and fuzzy. We also have several hundred certificates on POS devices (those are signed internally). We went with Trustwave for our Extended Validation certificate because of price and their PKI management tool. No more having to track with Excel!!

assurance numbers?

[reiisi]

There are only two: 0 and "internally certified, not yet invalidated".

So, security issues aside, I think the grandparent's assertion that the product is pretty much the same has meaning.

Now, as to whether it allows you to make ssl (tls)-enabled web pages that don't pop warnings up, that's a different matter, and a different kind of "assurance".

It didn't have to be such a racket, but it definitely looks, smells, tastes, and dances like one at this point in time.

Get one certificate

[reiisi]

the one that allows you to be your own root.

Then be your own root.

It's the only solution that has any real meaning at this point, unless you merely want to "safely" clear all the warning messages that 3rd-party tools throw at you.

You must understand this to understand the meaning of TLS:

You are the party of the first part.

The party with whom you are conversing is the party of the second part, which, pretty much means your ISP, more specifically, the owner of your connection point.

Anyone else is third party, and that includes the current crops of CAs.

The current crops of CAs don't want you to believe this. Microsoft doesn't want you to believe this. There are many in the government who don't want you to believe this. Big corporations don't want you to believe this. Many schools and hospitals, churches, etc. don't want you to believe this. They want you to believe they are somehow more dependable than even the party of the first part.

You know what that makes them?

If you believe in God, God is the party of the zero-eth part.

If you don't believe in God (and often even if you claim to believe in God), the entity you place most trust in, usually the entity you subconsciously ascribe to being ultimately "in-charge" of whatever piece of the cosmos directly effects you, would be the party of the zero-eth part.

So, yeah, verisign and microsoft and others want to be your God.

I don't think that is the way it was originally intended to work, but that's pretty much the way that TLS currently works.

meaningful certificates

[reiisi]

Other than getting rid of annoying and mostly meaningless warning messages, CACert is the best of the options you list.

Unless you trust your community less than you trust someone whom you have never met, whose job is to grab hundreds of e-mails like the one you sent, and turn as many of them into opportunities to cash the check as possible.

The best solution is to be your own root, but that currently only works for your own organization. You could also kludge together a mutual assurance scheme with organizations that you work with a lot, but that doesn't buy you much the way certificates are currently used, and CACert has solved, fairly correctly, a number of the problems you will face if you do so.

open source java

[reiisi]

Compiling your own java might solve the problem of the built-in certificate providers. I'll have to look at that.

Are you sure?

[reiisi]

Have you patched out the hard-wired certificate(s)?

PKI "trust" relationship structures

[reiisi]

The hierarchical structure is just one. It was primarily meant to be used by, erm, DNSes and the like.

Credit chains were supposed to be separate and structured differently.

Internal operations (inside your own company or department) chains and lateral operations (outside your company or department) chains get complicated, and the single hierarchy doesn't work very well. Actually, none of the structures that were originally suggested work very well. But they are supposed to be separate from the external operations chains.

(Lateral -- buying and selling are the operation you probably think of first, but, of course, there are plenty of others.)

Surfing chains were not really considered properly, which is part of the reason that even the hierarchy chains for domain names and IP numbers are not yet implemented.

Consider this -- were are trying to perform "trust" functions on the surfing chains.

Six guesses as to whom we should blame for this mess. Make sure you include a very large purveyor of OS and application software, a couple of "root" certificate providers, the market, the guys who invented PKI, and yourself in the list. (Shoot. If you want, include me for failing to invent technology for this that would work on several occasions in the past thirty years.)

Re:SSL Monopolies, SubCAs, PKI use, and supply/dem

[Anonymous Coward]

Each layer has its own expiry, and you have to re-establish the chain whenever a certificate in it expires. That means new private certs and updating the public certs that are sent with the SSL transaction.

No. It means your SSL provider is fubar. Do yourself a favor and avoid any issuer that tries to sell you a cert with validity range outside of its own, and while you're at it file a bug report against any software you know of that accepts that kind of malformed cert. (IExplore, I'm looking at you!)

When you buy a cert, you should be given a cert chain with every element being absolutely valid for its entire usage range. Otherwise you bought snake oil.

Suppose I create "BozosRus" root authority with a self signed cert valid until next week and issue you a cert that's valid until the cows come home. A year from now you want your cert to be revoked for some reason, but I can't do that because my issuing cert already expired, so nobody will trust me that you're not valid. So now you have a perpetually valid cert guaranteed by an expired CA that can't be revoked, right? Wrong! Because security conscious users won't accept a cert whose validity dates fall outside the issuer's, and we demand that non-compliant browsers fix their bugs. (IExplore, I'm looking at you again!)

Acquired by Verisign

[dereference]

GeoTrust announced it "signed a definitive agreement to be acquired by VeriSign" in May 2006. The acquisition was finalized around September 2006. They're still issuing QuickSSL Premium certs from Equifax.

For what it's worth, this whole article is a dupe from 2006.

Re:Acquired by Verisign

[mvdwege]

Ah. I was going by what they used as a root CA. I tend not to follow the business news that close. Thanks for the info.

Mart

My experiences with Thawte, GoDaddy & RapidSSL

[Nuitari The Wiz]

My customer had a 500$ Thawte certificate at the beginning which entailed a very lengthy and complicated verification process. I still remember how annoyed he was to having to fill out all of the paperwork they required to get the cert.

We then switched to rapidssl until it got bought by Geotrust. It still required a phone verification but that was much less annoying.

When it comes around to renewing it, we'll go with GoDaddy, if only because it's cheaper.

As a side note, as with a lot of things related to godaddy, retailmenot.com has a lot of coupons to get a rebate on the list price.

SSL only protects the data path

[brianozz]

One thing all you guys are missing is that the SSL cert only protects the data path over the net. In the day of switches (having replaced hubs) that's actually pretty secure. There's far more risk at the client (PC) or server (host) ends - that's where most of the data is stolen. All this is really about appearance rather than providing real security. Not saying that we shouldn't use certs, but an expensive cert is just a distraction from the potential lack of security on the server end. As a webhost and unix admin I'd much rather application developers put the effort they waste on discussing SSL into writing secure applications!!

its even more diffucult Re:depends on devices...

[Anonymous Coward]

Its even more difficult. Certs on mobile devices are completely random.

The device vendor (nokia, se, ...) preloads some certificates.

Then the operator (t-mobile, vodafone, ...) modifies the preloaded certs.

If a device is supported by some certificate depends on the device model and the shop where you bought it.

Most of the devices support verisign certs, but sometimes there is only the Operator root cert included, then you are lost.

OCSP Support

[Anonymous Coward]

One additional criteria is OCSP support.

Do they have their own responder. Is the responder fast? Do they have multiple responders world-wide?

OCSP response is usually pre-computed. How frequently is the response computed (3days, 1week)

Network Solutions, anyone?

[Anonymous Coward]

I have been working with Network Solutions. They have been pretty easy to deal with, and they have a nice website to manage and renew certs. They were a lot cheaper than Verisign. As far as I know, the guy who runs the web servers is happy a a clam.

Another Source

[Pensive Monk]

Take a look at RSA: http://www.rsa.com/node.aspx?id=1267

Resellers are the way to go

[Anonymous Coward]

You've made a good point: resellers are the way to go for best pricing.

I'm posting this anonymously because I don't need any complaints that I'm advertising ... we resell several companies' Certificates, including RapidSSL and Comodo, and of course we're cheaper than their own reseller pricing; we have to be in a competitive marketplace or else we wouldn't stay in the business.

We offer US-based 24/7 response (telephone and/or email) from real humans, and we offer full reissue insurance on each of our certs for the life of the certificate.

So yes, if you search, you can buy good certs inexpensively.

With A Rebel Yell

[LiveFreeOrDieInTheGo]

Just over a year ago, I needed to transact credit cards. I use a self signed certificate authority. The credit card clearinghouse I use said "no way" during the application process. I showed them how I could apply for and receive a SSL root cert by supplying just a post office box and virtually any true or ficticous demographic info. Now, if people really want what is sold on the sites I administer, then they can complain to the browser publishers about the lousy "content blocked" notices. BTW, people still get in because they really want what is sold!

I have NO intention of supporting Verisign!

Comodo actually does something good with proceeds

[awpoopy]

Comodo uses some of the proceeds to make very good anti-virus, anti-malware, firewall, etc. software. I have used their anti-virus software for some time and it does a better job than McAfee. It's free and less of a resource hog, especially the "on access scanning engine". Best of all, every application is separate, however ties in well with the others if you choose to install more than one. If you want everything except a software firewall on your windblows box (like most of Slashdot, right?)(because we have one running as a separate machine - right?), then you can just download the individual packages. Comodo is doing it right: Good product, good service and they use proceeds to provide free software.

Server Licensing

[Anonymous Coward]

Some CAs try to make you pay for each server the cert will be installed on - go to Verisign to buy one and they ask you to enter the number of server licenses. Thing is, there is no extra work for the CA, so the extra cost for you is pure profit to the CA. If you're running a cluster, this is something to consider. I use Godaddy certs and I know they don't charge per-server - not sure about other CAs.

Choosing the right SSL Provider? Its Comodo......

[comodo]

Hi I am Yuvaraj, Being in Comodo Marketing Intelligence Team, I can assure you that the Best to go for would be Comodo SSL certificates. I can give the Justification of why you need to choose Comodo. 1.) Speed & Stringent Verification Process - For True Assurance 2.) Cheap at Price and High at Quality & assurance 3.) Gives You a Corner of Trust Logo for free* to make the visitors trust you 4.) Unique, patent-pending EV AUTO-Enhancer(TM) - Automatic EV Deployment and Maintenance Technology - automatically upgrades Microsoft® Internet Explorer 7.0 on Windows(TM) XP to full "Green Address Bar" functionality. Valued at $1,500, Comodo provides this technology free to all our EV SSL Certificate 5.) Industry Leading Support - you can visit http://www.instantssl.com/ and can see how our live support team functions. 6.)Comodo is the initiator of the CA/B forum (Certification Authority / Browsers Forum) visit http://www.cabforum.org/ And also you can get a free trial certificate......and then if you are satisfied ( I know for sure you will get satisfied) you can go for the paid ones. Thanks, Yuvaraj